Edit tour

Windows Analysis Report
dry.dll

Overview

General Information

Sample Name:	dry.dll
Analysis ID:	575240
MD5:	4bec705de3584b911018c84f31659a17
SHA1:	b29ff37578ef950b702ec5db59161294c2e1a7b3
SHA256:	13aa6bed5b3a656b9c86cc2d397f765779f4a7dff49f73d58bd97e11423e0635
Tags:	dlldridexexe
Infos:

Detection

Dridex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Changes memory attributes in foreign processes to executable or writable

Machine Learning detection for sample

Queues an APC in another process (thread injection)

Contains functionality to inject code into remote processes

Sigma detected: Suspicious Call by Ordinal

Machine Learning detection for dropped file

Uses Atom Bombing / ProGate to inject into other processes

PE file contains section with special chars

Uses a Windows Living Off The Land Binaries (LOL bins)

Queries the volume information (name, serial number etc) of a device

Yara signature match

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Contains functionality to execute programs as a different user

PE file contains sections with non-standard names

Queries the installation date of Windows

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Found evasive API chain checking for process token information

Binary contains a suspicious time stamp

PE file contains more sections than normal

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6572 cmdline: loaddll64.exe "C:\Users\user\Desktop\dry.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)

cmd.exe (PID: 6612 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dry.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 4484 cmdline: rundll32.exe "C:\Users\user\Desktop\dry.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5792 cmdline: rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReader MD5: 73C519F050C20580F8A62C849D49215A)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

consent.exe (PID: 4904 cmdline: C:\Windows\system32\consent.exe MD5: 74D31E4F51873160D91B1F80E0C472D0)

consent.exe (PID: 3576 cmdline: C:\Users\user\AppData\Local\DLKXiO\consent.exe MD5: 74D31E4F51873160D91B1F80E0C472D0)

SysResetErr.exe (PID: 4676 cmdline: C:\Windows\system32\SysResetErr.exe MD5: 6A3F2F3C36FE45A87E3BFA80B6D92E07)

SysResetErr.exe (PID: 2064 cmdline: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe MD5: 6A3F2F3C36FE45A87E3BFA80B6D92E07)

consent.exe (PID: 6440 cmdline: C:\Windows\system32\consent.exe MD5: 74D31E4F51873160D91B1F80E0C472D0)

consent.exe (PID: 4740 cmdline: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe MD5: 74D31E4F51873160D91B1F80E0C472D0)

rdpshell.exe (PID: 6520 cmdline: C:\Windows\system32\rdpshell.exe MD5: 4994A0ADA359924026FE631E54FC7A5D)

cmstp.exe (PID: 4628 cmdline: C:\Windows\system32\cmstp.exe MD5: 2A9828E0C405422D166E0141054A04B3)

cmstp.exe (PID: 6000 cmdline: C:\Users\user\AppData\Local\y1c6p\cmstp.exe MD5: 2A9828E0C405422D166E0141054A04B3)

SystemPropertiesComputerName.exe (PID: 5732 cmdline: C:\Windows\system32\SystemPropertiesComputerName.exe MD5: BEE134E1F23AFD3AE58191D265BB9070)

DWWIN.EXE (PID: 5392 cmdline: C:\Windows\system32\DWWIN.EXE MD5: 3C21F944D5FF44E45BC753919F6AE445)

DWWIN.EXE (PID: 4336 cmdline: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE MD5: 3C21F944D5FF44E45BC753919F6AE445)

SystemPropertiesDataExecutionPrevention.exe (PID: 4940 cmdline: C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe MD5: 1A34577AEDE83993615D7F2E37024D4D)

sppsvc.exe (PID: 5788 cmdline: C:\Windows\system32\sppsvc.exe MD5: FEEC8055C5986182C717DD888000AEF6)

sppsvc.exe (PID: 5012 cmdline: C:\Users\user\AppData\Local\GsjW\sppsvc.exe MD5: FEEC8055C5986182C717DD888000AEF6)

SndVol.exe (PID: 3156 cmdline: C:\Windows\system32\SndVol.exe MD5: CDD7C7DF2D0859AC3F4088423D11BD08)

SndVol.exe (PID: 5664 cmdline: C:\Users\user\AppData\Local\0rPbJb\SndVol.exe MD5: CDD7C7DF2D0859AC3F4088423D11BD08)

rundll32.exe (PID: 568 cmdline: rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReaderInputWithEncodingCodePage MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5456 cmdline: rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReaderInputWithEncodingName MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000001B.00000002.448574954.00007FFC6E291000.00000020.00000001.01000000.0000000C.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001B.00000002.448574954.00007FFC6E291000.00000020.00000001.01000000.0000000C.sdmp	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x37e93:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
00000008.00000002.305054509.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000008.00000002.305054509.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x37e93:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
00000006.00000002.296790826.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000006.00000002.296790826.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x37e93:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
0000001E.00000002.477365919.00007FFC6E291000.00000020.00000001.01000000.0000000E.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001E.00000002.477365919.00007FFC6E291000.00000020.00000001.01000000.0000000E.sdmp	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x37e93:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
00000004.00000002.289927845.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000004.00000002.289927845.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x37e93:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
0000000F.00000002.410915340.00007FFC67DE1000.00000020.00000001.01000000.00000009.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000000F.00000002.410915340.00007FFC67DE1000.00000020.00000001.01000000.00000009.sdmp	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x37e93:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
00000003.00000002.366937086.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000003.00000002.366937086.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x37e93:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
00000023.00000002.514434351.00007FFC6E291000.00000020.00000001.01000000.00000010.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000023.00000002.514434351.00007FFC6E291000.00000020.00000001.01000000.00000010.sdmp	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x37e93:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x37e93:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.rundll32.exe.7ffc68290000.2.unpack	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
4.2.rundll32.exe.7ffc68290000.2.unpack	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x38293:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
8.2.rundll32.exe.7ffc68290000.2.unpack	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
8.2.rundll32.exe.7ffc68290000.2.unpack	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x38293:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
3.2.rundll32.exe.7ffc68290000.2.unpack	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
3.2.rundll32.exe.7ffc68290000.2.unpack	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x38293:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
27.2.cmstp.exe.7ffc6e290000.3.unpack	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
27.2.cmstp.exe.7ffc6e290000.3.unpack	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x38293:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
35.2.sppsvc.exe.7ffc6e290000.3.unpack	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
35.2.sppsvc.exe.7ffc6e290000.3.unpack	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x38293:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
0.2.loaddll64.exe.7ffc68290000.2.unpack	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0.2.loaddll64.exe.7ffc68290000.2.unpack	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x38293:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
6.2.rundll32.exe.7ffc68290000.2.unpack	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
6.2.rundll32.exe.7ffc68290000.2.unpack	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x38293:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
15.2.SysResetErr.exe.7ffc67de0000.3.unpack	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
15.2.SysResetErr.exe.7ffc67de0000.3.unpack	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x38293:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
30.2.DWWIN.EXE.7ffc6e290000.3.unpack	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
30.2.DWWIN.EXE.7ffc6e290000.3.unpack	crime_win64_dridex_bot_hook	Detects latest Dridex bot hook	@VK_Intel	0x38293:$code: E8 38 5D 00 00 8B 5C 24 5C 48 8D 95 70 01 00 00 44 2B F3 48 8D 4D 70 41 B8 04 00 00 00 41 83 EE 05 44 89 B5 70 01 00 00 E8 10 5D 00 00 BA CD 9C FF 56 B9 CB 69 E2 6A 8B F3 48 89 5D A8 48 C7 45 ...
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Call by Ordinal

Source: Process started

Author: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\dry.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\dry.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dry.dll",#1, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6612, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\dry.dll",#1, ProcessId: 4484

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: dry.dll	Virustotal: Detection: 70%	Perma Link
Source: dry.dll	Metadefender: Detection: 55%	Perma Link
Source: dry.dll	ReversingLabs: Detection: 82%

Antivirus / Scanner detection for submitted sample

Source: dry.dll

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\oudoiG\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\oudoiG\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\0rPbJb\UxTheme.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\WINSTA.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\s8hTTPzEx\DUI70.dll	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen4
Source: C:\Users\user\AppData\Local\GsjW\XmlLite.dll	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen7
Source: C:\Users\user\AppData\Local\DLKXiO\WMsgAPI.dll	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen7

Machine Learning detection for sample

Source: dry.dll

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\oudoiG\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\oudoiG\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\0rPbJb\UxTheme.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\WINSTA.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\s8hTTPzEx\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\GsjW\XmlLite.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\DLKXiO\WMsgAPI.dll	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE9CF6C VirtualAlloc,GetLastError,BCryptCreateHash,ReadProcessMemory,BCryptHashData,BCryptFinishHash,BCryptDestroyHash,VirtualFree,BCryptFinishHash,BCryptDestroyHash,GetLastError,		30_2_00007FF7EAE9CF6C
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE9D15C BCryptCreateHash,_wcsnicmp,BCryptHashData,BCryptHashData,BCryptFinishHash,BCryptDestroyHash,		30_2_00007FF7EAE9D15C

Source: dry.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: consent.pdb source: consent.exe, 0000000D.00000000.375430040.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmp, consent.exe, 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmp, consent.exe, 00000017.00000000.417554670.00007FF60D131000.00000002.00000001.01000000.0000000A.sdmp, consent.exe, 00000017.00000002.418228151.00007FF60D131000.00000002.00000001.01000000.0000000A.sdmp, consent.exe0.5.dr, consent.exe.5.dr
Source:	Binary string: SndVol.pdbGCTL source: SndVol.exe, 00000025.00000000.519784312.00007FF7A30D2000.00000002.00000001.01000000.00000011.sdmp, SndVol.exe.5.dr
Source:	Binary string: cmstp.pdbGCTL source: cmstp.exe, 0000001B.00000002.448541294.00007FF768F8F000.00000002.00000001.01000000.0000000B.sdmp, cmstp.exe, 0000001B.00000000.426211728.00007FF768F8F000.00000002.00000001.01000000.0000000B.sdmp, cmstp.exe.5.dr
Source:	Binary string: FFgnji\|RgnjiR.pdb source: SysResetErr.exe, 0000000F.00000002.410461412.00000204E63D7000.00000004.00000020.00020000.00000000.sdmp, SysResetErr.exe, 0000000F.00000002.410154109.00000204E622E000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000001B.00000002.448408637.0000016FCD5A2000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000001B.00000002.448269347.0000016FCD449000.00000004.00000020.00020000.00000000.sdmp, DWWIN.EXE, 0000001E.00000002.476969443.0000025594C81000.00000004.00000020.00020000.00000000.sdmp, DWWIN.EXE, 0000001E.00000002.477066927.0000025594DE1000.00000004.00000020.00020000.00000000.sdmp, sppsvc.exe, 00000023.00000002.513393199.0000029561289000.00000004.00000020.00020000.00000000.sdmp, sppsvc.exe, 00000023.00000002.513278214.0000029561127000.00000004.00000020.00020000.00000000.sdmp, dry.dll, VERSION.dll.5.dr, VERSION.dll0.5.dr, UxTheme.dll.5.dr, WINSTA.dll.5.dr, DUI70.dll.5.dr, XmlLite.dll.5.dr, WMsgAPI.dll.5.dr
Source:	Binary string: sppsvc.pdb source: sppsvc.exe, 00000023.00000000.488372541.00007FF6A254B000.00000002.00000001.01000000.0000000F.sdmp, sppsvc.exe, 00000023.00000002.514242869.00007FF6A254B000.00000002.00000001.01000000.0000000F.sdmp, sppsvc.exe.5.dr
Source:	Binary string: SysResetErr.pdb source: SysResetErr.exe, 0000000F.00000000.387584584.00007FF67A426000.00000002.00000001.01000000.00000008.sdmp, SysResetErr.exe, 0000000F.00000002.410882238.00007FF67A426000.00000002.00000001.01000000.00000008.sdmp, SysResetErr.exe.5.dr
Source:	Binary string: dwwin.pdbGCTL source: DWWIN.EXE, 0000001E.00000000.454947885.00007FF7EAEA6000.00000002.00000001.01000000.0000000D.sdmp, DWWIN.EXE, 0000001E.00000002.477319814.00007FF7EAEA6000.00000002.00000001.01000000.0000000D.sdmp, DWWIN.EXE.5.dr
Source:	Binary string: cmstp.pdb source: cmstp.exe, 0000001B.00000002.448541294.00007FF768F8F000.00000002.00000001.01000000.0000000B.sdmp, cmstp.exe, 0000001B.00000000.426211728.00007FF768F8F000.00000002.00000001.01000000.0000000B.sdmp, cmstp.exe.5.dr
Source:	Binary string: sppsvc.pdbGCTL source: sppsvc.exe, 00000023.00000000.488372541.00007FF6A254B000.00000002.00000001.01000000.0000000F.sdmp, sppsvc.exe, 00000023.00000002.514242869.00007FF6A254B000.00000002.00000001.01000000.0000000F.sdmp, sppsvc.exe.5.dr
Source:	Binary string: dwwin.pdb source: DWWIN.EXE, 0000001E.00000000.454947885.00007FF7EAEA6000.00000002.00000001.01000000.0000000D.sdmp, DWWIN.EXE, 0000001E.00000002.477319814.00007FF7EAEA6000.00000002.00000001.01000000.0000000D.sdmp, DWWIN.EXE.5.dr
Source:	Binary string: consent.pdbUGP source: consent.exe, 0000000D.00000000.375430040.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmp, consent.exe, 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmp, consent.exe, 00000017.00000000.417554670.00007FF60D131000.00000002.00000001.01000000.0000000A.sdmp, consent.exe, 00000017.00000002.418228151.00007FF60D131000.00000002.00000001.01000000.0000000A.sdmp, consent.exe0.5.dr, consent.exe.5.dr
Source:	Binary string: SndVol.pdb source: SndVol.exe, 00000025.00000000.519784312.00007FF7A30D2000.00000002.00000001.01000000.00000011.sdmp, SndVol.exe.5.dr
Source:	Binary string: SysResetErr.pdbGCTL source: SysResetErr.exe, 0000000F.00000000.387584584.00007FF67A426000.00000002.00000001.01000000.00000008.sdmp, SysResetErr.exe, 0000000F.00000002.410882238.00007FF67A426000.00000002.00000001.01000000.00000008.sdmp, SysResetErr.exe.5.dr

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682EDBE0 FindFirstFileExW,	0_2_00007FFC682EDBE0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E3DBE0 FindFirstFileExW,	15_2_00007FFC67E3DBE0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F871E0 memset,GetPrivateProfileStringW,FindFirstFileW,wcscmp,memset,FindNextFileW,	27_2_00007FF768F871E0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F84008 memset,memset,memset,SHGetFolderPathW,memset,SHGetFolderPathW,lstrlenW,CmMalloc,CmFree,CmFree,memset,FindFirstFileW,GetLastError,memset,memset,FindNextFileW,FindClose,	27_2_00007FF768F84008
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2EDBE0 FindFirstFileExW,	27_2_00007FFC6E2EDBE0

Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE

Code function: 30_2_00007FF7EAE96678 memset,StrStrIW,GetLogicalDriveStringsW,QueryDosDeviceW,StrStrIW,

30_2_00007FF7EAE96678

Source: sppsvc.exe, 00000023.00000000.488372541.00007FF6A254B000.00000002.00000001.01000000.0000000F.sdmp, sppsvc.exe, 00000023.00000002.514242869.00007FF6A254B000.00000002.00000001.01000000.0000000F.sdmp, sppsvc.exe.5.dr

String found in binary or memory: http://xml.org/sax/properties/lexical-handler&<>"'SelectionLanguageXPathSelectio

Source: unknown

DNS traffic detected: queries for: canonicalizer.ucsuri.tcs

E-Banking Fraud

Yara detected Dridex unpacked file

Source: Yara match	File source: 4.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.cmstp.exe.7ffc6e290000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.sppsvc.exe.7ffc6e290000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.7ffc68290000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.SysResetErr.exe.7ffc67de0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.DWWIN.EXE.7ffc6e290000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.448574954.00007FFC6E291000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.305054509.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.296790826.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.477365919.00007FFC6E291000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.289927845.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.410915340.00007FFC67DE1000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.366937086.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.514434351.00007FFC6E291000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 8.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 3.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 27.2.cmstp.exe.7ffc6e290000.3.unpack, type: UNPACKEDPE	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 35.2.sppsvc.exe.7ffc6e290000.3.unpack, type: UNPACKEDPE	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 0.2.loaddll64.exe.7ffc68290000.2.unpack, type: UNPACKEDPE	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 6.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 15.2.SysResetErr.exe.7ffc67de0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 30.2.DWWIN.EXE.7ffc6e290000.3.unpack, type: UNPACKEDPE	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 0000001B.00000002.448574954.00007FFC6E291000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 00000008.00000002.305054509.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 00000006.00000002.296790826.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 0000001E.00000002.477365919.00007FFC6E291000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 00000004.00000002.289927845.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 0000000F.00000002.410915340.00007FFC67DE1000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 00000003.00000002.366937086.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 00000023.00000002.514434351.00007FFC6E291000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel
Source: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects latest Dridex bot hook Author: @VK_Intel

PE file contains section with special chars

Source: sppsvc.exe.5.dr	Static PE information: section name: ?g_Encry
Source: sppsvc.exe.5.dr	Static PE information: section name: ?g_Encry
Source: sppsvc.exe.5.dr	Static PE information: section name: ?g_Encry
Source: sppsvc.exe.5.dr	Static PE information: section name: ?g_Encry

Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmstp.exe C:\Windows\system32\cmstp.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\y1c6p\cmstp.exe C:\Users\user\AppData\Local\y1c6p\cmstp.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmstp.exe C:\Windows\system32\cmstp.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\y1c6p\cmstp.exe C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Jump to behavior

Source: 4.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 8.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 3.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 27.2.cmstp.exe.7ffc6e290000.3.unpack, type: UNPACKEDPE	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 35.2.sppsvc.exe.7ffc6e290000.3.unpack, type: UNPACKEDPE	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 0.2.loaddll64.exe.7ffc68290000.2.unpack, type: UNPACKEDPE	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 6.2.rundll32.exe.7ffc68290000.2.unpack, type: UNPACKEDPE	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 15.2.SysResetErr.exe.7ffc67de0000.3.unpack, type: UNPACKEDPE	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 30.2.DWWIN.EXE.7ffc6e290000.3.unpack, type: UNPACKEDPE	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 0000001B.00000002.448574954.00007FFC6E291000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 00000008.00000002.305054509.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 00000006.00000002.296790826.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 0000001E.00000002.477365919.00007FFC6E291000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 00000004.00000002.289927845.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 0000000F.00000002.410915340.00007FFC67DE1000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 00000003.00000002.366937086.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 00000023.00000002.514434351.00007FFC6E291000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white
Source: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: crime_win64_dridex_bot_hook date = 2020-03-24, author = @VK_Intel, description = Detects latest Dridex bot hook, reference = internal, tlp = white

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\DWWIN.EXE

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682DB120	0_2_00007FFC682DB120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C3940	0_2_00007FFC682C3940
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682D8990	0_2_00007FFC682D8990
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B6190	0_2_00007FFC682B6190
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C4310	0_2_00007FFC682C4310
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682ECC90	0_2_00007FFC682ECC90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F6610	0_2_00007FFC682F6610
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682D7EA0	0_2_00007FFC682D7EA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682FBF20	0_2_00007FFC682FBF20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682E1FE0	0_2_00007FFC682E1FE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B58F0	0_2_00007FFC682B58F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682FA0E0	0_2_00007FFC682FA0E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682BD0E0	0_2_00007FFC682BD0E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682918D0	0_2_00007FFC682918D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F5910	0_2_00007FFC682F5910
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B3110	0_2_00007FFC682B3110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC6829B100	0_2_00007FFC6829B100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F9970	0_2_00007FFC682F9970
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B3960	0_2_00007FFC682B3960
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682BA960	0_2_00007FFC682BA960
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682BE950	0_2_00007FFC682BE950
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682CE190	0_2_00007FFC682CE190
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682EE190	0_2_00007FFC682EE190
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682FB180	0_2_00007FFC682FB180
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC68292980	0_2_00007FFC68292980
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F19C0	0_2_00007FFC682F19C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B2210	0_2_00007FFC682B2210
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F3270	0_2_00007FFC682F3270
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F7260	0_2_00007FFC682F7260
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682E3A50	0_2_00007FFC682E3A50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B2A50	0_2_00007FFC682B2A50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC68297A40	0_2_00007FFC68297A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C82B0	0_2_00007FFC682C82B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F6AB0	0_2_00007FFC682F6AB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682AFAB0	0_2_00007FFC682AFAB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C0AF0	0_2_00007FFC682C0AF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B52D0	0_2_00007FFC682B52D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682BD2D0	0_2_00007FFC682BD2D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC6829BB20	0_2_00007FFC6829BB20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682BDB20	0_2_00007FFC682BDB20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F4B10	0_2_00007FFC682F4B10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C7B10	0_2_00007FFC682C7B10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C7310	0_2_00007FFC682C7310
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C9B70	0_2_00007FFC682C9B70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F9360	0_2_00007FFC682F9360
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC68295350	0_2_00007FFC68295350
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682A23B0	0_2_00007FFC682A23B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C9390	0_2_00007FFC682C9390
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F1B80	0_2_00007FFC682F1B80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B6BF0	0_2_00007FFC682B6BF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B7BE0	0_2_00007FFC682B7BE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682A83D0	0_2_00007FFC682A83D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682BC3D0	0_2_00007FFC682BC3D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682BEC30	0_2_00007FFC682BEC30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC68295C20	0_2_00007FFC68295C20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682CA400	0_2_00007FFC682CA400
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C0450	0_2_00007FFC682C0450
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B1C40	0_2_00007FFC682B1C40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B8C40	0_2_00007FFC682B8C40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682A54B0	0_2_00007FFC682A54B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682A74A0	0_2_00007FFC682A74A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C2C80	0_2_00007FFC682C2C80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F84D0	0_2_00007FFC682F84D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682DED20	0_2_00007FFC682DED20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682A3D60	0_2_00007FFC682A3D60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B95B0	0_2_00007FFC682B95B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC6829C5A0	0_2_00007FFC6829C5A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F9580	0_2_00007FFC682F9580
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C45F0	0_2_00007FFC682C45F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC6829DDE0	0_2_00007FFC6829DDE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC6830D650	0_2_00007FFC6830D650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC68291620	0_2_00007FFC68291620
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682EFE10	0_2_00007FFC682EFE10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C2610	0_2_00007FFC682C2610
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC68309E70	0_2_00007FFC68309E70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682FCE00	0_2_00007FFC682FCE00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682A6670	0_2_00007FFC682A6670
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682A9660	0_2_00007FFC682A9660
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682EF650	0_2_00007FFC682EF650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B2650	0_2_00007FFC682B2650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C0650	0_2_00007FFC682C0650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F4640	0_2_00007FFC682F4640
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682BF640	0_2_00007FFC682BF640
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682FCEB6	0_2_00007FFC682FCEB6
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682FCEAD	0_2_00007FFC682FCEAD
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682FCEA6	0_2_00007FFC682FCEA6
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682FCE9D	0_2_00007FFC682FCE9D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682FCE94	0_2_00007FFC682FCE94
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC68296E90	0_2_00007FFC68296E90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682FCE8B	0_2_00007FFC682FCE8B
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682F6E80	0_2_00007FFC682F6E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC68297E80	0_2_00007FFC68297E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682BBE80	0_2_00007FFC682BBE80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C0EE0	0_2_00007FFC682C0EE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682E46D0	0_2_00007FFC682E46D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC683036C0	0_2_00007FFC683036C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682ACF30	0_2_00007FFC682ACF30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682C1730	0_2_00007FFC682C1730
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B1F10	0_2_00007FFC682B1F10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682A8700	0_2_00007FFC682A8700
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682AC700	0_2_00007FFC682AC700
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682DDF40	0_2_00007FFC682DDF40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC68296790	0_2_00007FFC68296790
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682AD780	0_2_00007FFC682AD780
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682BDFE0	0_2_00007FFC682BDFE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682BEFD0	0_2_00007FFC682BEFD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC68291010	0_2_00007FFC68291010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682A0870	0_2_00007FFC682A0870
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682B1850	0_2_00007FFC682B1850
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682A9050	0_2_00007FFC682A9050
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F910D0	13_2_00007FF679F910D0
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F93940	13_2_00007FF679F93940
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F9D574	13_2_00007FF679F9D574
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F92C60	13_2_00007FF679F92C60
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F92070	13_2_00007FF679F92070
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F9F290	13_2_00007FF679F9F290
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F9C6CC	13_2_00007FF679F9C6CC
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F9ED30	13_2_00007FF679F9ED30
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FF67A421424	15_2_00007FF67A421424
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E31FE0	15_2_00007FFC67E31FE0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E4BF20	15_2_00007FFC67E4BF20
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E27EA0	15_2_00007FFC67E27EA0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E46610	15_2_00007FFC67E46610
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E145F0	15_2_00007FFC67E145F0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E3CC90	15_2_00007FFC67E3CC90
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E1A400	15_2_00007FFC67E1A400
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E19390	15_2_00007FFC67E19390
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E14310	15_2_00007FFC67E14310
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E28990	15_2_00007FFC67E28990
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E06190	15_2_00007FFC67E06190
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E13940	15_2_00007FFC67E13940
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E2B120	15_2_00007FFC67E2B120
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DF0870	15_2_00007FFC67DF0870
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E01850	15_2_00007FFC67E01850
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DF9050	15_2_00007FFC67DF9050
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DE1010	15_2_00007FFC67DE1010
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E0DFE0	15_2_00007FFC67E0DFE0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E0EFD0	15_2_00007FFC67E0EFD0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E5A7BB	15_2_00007FFC67E5A7BB
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DFD780	15_2_00007FFC67DFD780
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E5AF81	15_2_00007FFC67E5AF81
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DE6790	15_2_00007FFC67DE6790
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E2DF40	15_2_00007FFC67E2DF40
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E11730	15_2_00007FFC67E11730
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DFCF30	15_2_00007FFC67DFCF30
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DF8700	15_2_00007FFC67DF8700
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DFC700	15_2_00007FFC67DFC700
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E01F10	15_2_00007FFC67E01F10
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E5EEF0	15_2_00007FFC67E5EEF0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E10EE0	15_2_00007FFC67E10EE0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E346D0	15_2_00007FFC67E346D0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E536C0	15_2_00007FFC67E536C0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E4CEAD	15_2_00007FFC67E4CEAD
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E4CEB6	15_2_00007FFC67E4CEB6
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E4CE9D	15_2_00007FFC67E4CE9D
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E4CEA6	15_2_00007FFC67E4CEA6
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DE7E80	15_2_00007FFC67DE7E80
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E4CE94	15_2_00007FFC67E4CE94
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E0BE80	15_2_00007FFC67E0BE80
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E46E80	15_2_00007FFC67E46E80
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DE6E90	15_2_00007FFC67DE6E90
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E4CE8B	15_2_00007FFC67E4CE8B
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E59E70	15_2_00007FFC67E59E70
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DF9660	15_2_00007FFC67DF9660
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DF6670	15_2_00007FFC67DF6670
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E5D650	15_2_00007FFC67E5D650
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E10650	15_2_00007FFC67E10650
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E3F650	15_2_00007FFC67E3F650
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E0F640	15_2_00007FFC67E0F640
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E5A63F	15_2_00007FFC67E5A63F
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E44640	15_2_00007FFC67E44640
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E02650	15_2_00007FFC67E02650
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DE1620	15_2_00007FFC67DE1620
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E12610	15_2_00007FFC67E12610
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E3FE10	15_2_00007FFC67E3FE10
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E4CE00	15_2_00007FFC67E4CE00
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DEDDE0	15_2_00007FFC67DEDDE0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E095B0	15_2_00007FFC67E095B0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DEC5A0	15_2_00007FFC67DEC5A0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E49580	15_2_00007FFC67E49580
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DF3D60	15_2_00007FFC67DF3D60
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E2ED20	15_2_00007FFC67E2ED20
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E484D0	15_2_00007FFC67E484D0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DF74A0	15_2_00007FFC67DF74A0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DF54B0	15_2_00007FFC67DF54B0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E12C80	15_2_00007FFC67E12C80
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E5AC60	15_2_00007FFC67E5AC60
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E10450	15_2_00007FFC67E10450
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E01C40	15_2_00007FFC67E01C40
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E08C40	15_2_00007FFC67E08C40
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E0EC30	15_2_00007FFC67E0EC30
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DE5C20	15_2_00007FFC67DE5C20
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E07BE0	15_2_00007FFC67E07BE0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E06BF0	15_2_00007FFC67E06BF0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E0C3D0	15_2_00007FFC67E0C3D0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DF83D0	15_2_00007FFC67DF83D0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E37BB0	15_2_00007FFC67E37BB0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DF23B0	15_2_00007FFC67DF23B0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E41B80	15_2_00007FFC67E41B80
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E19B70	15_2_00007FFC67E19B70
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E49360	15_2_00007FFC67E49360
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DE5350	15_2_00007FFC67DE5350
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DEBB20	15_2_00007FFC67DEBB20
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E0DB20	15_2_00007FFC67E0DB20
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E17B10	15_2_00007FFC67E17B10
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E17310	15_2_00007FFC67E17310
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E44B10	15_2_00007FFC67E44B10
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E10AF0	15_2_00007FFC67E10AF0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E5E2D0	15_2_00007FFC67E5E2D0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E0D2D0	15_2_00007FFC67E0D2D0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E052D0	15_2_00007FFC67E052D0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E182B0	15_2_00007FFC67E182B0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E46AB0	15_2_00007FFC67E46AB0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DFFAB0	15_2_00007FFC67DFFAB0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E43270	15_2_00007FFC67E43270
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E47260	15_2_00007FFC67E47260
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E33A50	15_2_00007FFC67E33A50
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DE7A40	15_2_00007FFC67DE7A40
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E02A50	15_2_00007FFC67E02A50
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E02210	15_2_00007FFC67E02210
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E419C0	15_2_00007FFC67E419C0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E1E190	15_2_00007FFC67E1E190
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E30990	15_2_00007FFC67E30990
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E3E190	15_2_00007FFC67E3E190
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DE2980	15_2_00007FFC67DE2980
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E4B180	15_2_00007FFC67E4B180
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E49970	15_2_00007FFC67E49970
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E03960	15_2_00007FFC67E03960
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E0A960	15_2_00007FFC67E0A960
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E0E950	15_2_00007FFC67E0E950
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E45910	15_2_00007FFC67E45910
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DEB100	15_2_00007FFC67DEB100
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E03110	15_2_00007FFC67E03110
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E4A0E0	15_2_00007FFC67E4A0E0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E0D0E0	15_2_00007FFC67E0D0E0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E058F0	15_2_00007FFC67E058F0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67DE18D0	15_2_00007FFC67DE18D0
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D1210D0	23_2_00007FF60D1210D0
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D122C60	23_2_00007FF60D122C60
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D122070	23_2_00007FF60D122070
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D12F290	23_2_00007FF60D12F290
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D12C6CC	23_2_00007FF60D12C6CC
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D12ED30	23_2_00007FF60D12ED30
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D12D574	23_2_00007FF60D12D574
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D123940	23_2_00007FF60D123940
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F8591C	27_2_00007FF768F8591C
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F82F1C	27_2_00007FF768F82F1C
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F81254	27_2_00007FF768F81254
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F89160	27_2_00007FF768F89160
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F8637C	27_2_00007FF768F8637C
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F87480	27_2_00007FF768F87480
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F84794	27_2_00007FF768F84794
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F82CB8	27_2_00007FF768F82CB8
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F899BC	27_2_00007FF768F899BC
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F8AAD4	27_2_00007FF768F8AAD4
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F896D8	27_2_00007FF768F896D8
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F871E0	27_2_00007FF768F871E0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F84AFC	27_2_00007FF768F84AFC
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F89E10	27_2_00007FF768F89E10
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F84008	27_2_00007FF768F84008
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2D7EA0	27_2_00007FFC6E2D7EA0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2FBF20	27_2_00007FFC6E2FBF20
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2E1FE0	27_2_00007FFC6E2E1FE0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2ECC90	27_2_00007FFC6E2ECC90
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C45F0	27_2_00007FFC6E2C45F0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F6610	27_2_00007FFC6E2F6610
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C4310	27_2_00007FFC6E2C4310
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C9390	27_2_00007FFC6E2C9390
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2CA400	27_2_00007FFC6E2CA400
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2DB120	27_2_00007FFC6E2DB120
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C3940	27_2_00007FFC6E2C3940
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2D8990	27_2_00007FFC6E2D8990
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B6190	27_2_00007FFC6E2B6190
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2FCEB6	27_2_00007FFC6E2FCEB6
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2FCEAD	27_2_00007FFC6E2FCEAD
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2FCEA6	27_2_00007FFC6E2FCEA6
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2FCE9D	27_2_00007FFC6E2FCE9D
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2FCE94	27_2_00007FFC6E2FCE94
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E296E90	27_2_00007FFC6E296E90
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2FCE8B	27_2_00007FFC6E2FCE8B
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E30EEF0	27_2_00007FFC6E30EEF0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F6E80	27_2_00007FFC6E2F6E80
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E297E80	27_2_00007FFC6E297E80
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2BBE80	27_2_00007FFC6E2BBE80
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C0EE0	27_2_00007FFC6E2C0EE0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2E46D0	27_2_00007FFC6E2E46D0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E3036C0	27_2_00007FFC6E3036C0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2ACF30	27_2_00007FFC6E2ACF30
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C1730	27_2_00007FFC6E2C1730
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B1F10	27_2_00007FFC6E2B1F10
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2A8700	27_2_00007FFC6E2A8700
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2AC700	27_2_00007FFC6E2AC700
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2DDF40	27_2_00007FFC6E2DDF40
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E296790	27_2_00007FFC6E296790
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2AD780	27_2_00007FFC6E2AD780
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E30AF81	27_2_00007FFC6E30AF81
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2BDFE0	27_2_00007FFC6E2BDFE0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2BEFD0	27_2_00007FFC6E2BEFD0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E30A7BB	27_2_00007FFC6E30A7BB
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E291010	27_2_00007FFC6E291010
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2A0870	27_2_00007FFC6E2A0870
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B1850	27_2_00007FFC6E2B1850
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2A9050	27_2_00007FFC6E2A9050
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2A54B0	27_2_00007FFC6E2A54B0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2A74A0	27_2_00007FFC6E2A74A0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C2C80	27_2_00007FFC6E2C2C80
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F84D0	27_2_00007FFC6E2F84D0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2DED20	27_2_00007FFC6E2DED20
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2A3D60	27_2_00007FFC6E2A3D60
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B95B0	27_2_00007FFC6E2B95B0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E29C5A0	27_2_00007FFC6E29C5A0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F9580	27_2_00007FFC6E2F9580
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E29DDE0	27_2_00007FFC6E29DDE0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E30A63F	27_2_00007FFC6E30A63F
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E30D650	27_2_00007FFC6E30D650
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E291620	27_2_00007FFC6E291620
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2EFE10	27_2_00007FFC6E2EFE10
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C2610	27_2_00007FFC6E2C2610
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E309E70	27_2_00007FFC6E309E70
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2FCE00	27_2_00007FFC6E2FCE00
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2A6670	27_2_00007FFC6E2A6670
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2A9660	27_2_00007FFC6E2A9660
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2EF650	27_2_00007FFC6E2EF650
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B2650	27_2_00007FFC6E2B2650
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C0650	27_2_00007FFC6E2C0650
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F4640	27_2_00007FFC6E2F4640
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2BF640	27_2_00007FFC6E2BF640
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C82B0	27_2_00007FFC6E2C82B0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F6AB0	27_2_00007FFC6E2F6AB0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2AFAB0	27_2_00007FFC6E2AFAB0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E30E2D0	27_2_00007FFC6E30E2D0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C0AF0	27_2_00007FFC6E2C0AF0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B52D0	27_2_00007FFC6E2B52D0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2BD2D0	27_2_00007FFC6E2BD2D0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E29BB20	27_2_00007FFC6E29BB20
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2BDB20	27_2_00007FFC6E2BDB20
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F4B10	27_2_00007FFC6E2F4B10
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C7B10	27_2_00007FFC6E2C7B10
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C7310	27_2_00007FFC6E2C7310
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C9B70	27_2_00007FFC6E2C9B70
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F9360	27_2_00007FFC6E2F9360
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E295350	27_2_00007FFC6E295350
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2E7BB0	27_2_00007FFC6E2E7BB0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2A23B0	27_2_00007FFC6E2A23B0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F1B80	27_2_00007FFC6E2F1B80
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B6BF0	27_2_00007FFC6E2B6BF0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B7BE0	27_2_00007FFC6E2B7BE0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2A83D0	27_2_00007FFC6E2A83D0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2BC3D0	27_2_00007FFC6E2BC3D0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2BEC30	27_2_00007FFC6E2BEC30
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E295C20	27_2_00007FFC6E295C20
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E30AC60	27_2_00007FFC6E30AC60
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C0450	27_2_00007FFC6E2C0450
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B1C40	27_2_00007FFC6E2B1C40
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B8C40	27_2_00007FFC6E2B8C40
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B58F0	27_2_00007FFC6E2B58F0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2FA0E0	27_2_00007FFC6E2FA0E0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2BD0E0	27_2_00007FFC6E2BD0E0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2918D0	27_2_00007FFC6E2918D0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F5910	27_2_00007FFC6E2F5910
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B3110	27_2_00007FFC6E2B3110
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E29B100	27_2_00007FFC6E29B100
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F9970	27_2_00007FFC6E2F9970
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B3960	27_2_00007FFC6E2B3960
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2BA960	27_2_00007FFC6E2BA960
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2BE950	27_2_00007FFC6E2BE950
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2CE190	27_2_00007FFC6E2CE190
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2E0990	27_2_00007FFC6E2E0990
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2EE190	27_2_00007FFC6E2EE190
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2FB180	27_2_00007FFC6E2FB180
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E292980	27_2_00007FFC6E292980
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F19C0	27_2_00007FFC6E2F19C0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B2210	27_2_00007FFC6E2B2210
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F3270	27_2_00007FFC6E2F3270
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2F7260	27_2_00007FFC6E2F7260
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2E3A50	27_2_00007FFC6E2E3A50
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B2A50	27_2_00007FFC6E2B2A50
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E297A40	27_2_00007FFC6E297A40
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE9D3E4	30_2_00007FF7EAE9D3E4
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE9CF6C	30_2_00007FF7EAE9CF6C
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAEA2858	30_2_00007FF7EAEA2858
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE9B9FC	30_2_00007FF7EAE9B9FC
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE911A0	30_2_00007FF7EAE911A0
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE99D80	30_2_00007FF7EAE99D80
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE91568	30_2_00007FF7EAE91568
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE8C568	30_2_00007FF7EAE8C568
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE9D15C	30_2_00007FF7EAE9D15C
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE9026C	30_2_00007FF7EAE9026C
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE98E50	30_2_00007FF7EAE98E50
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE8DA34	30_2_00007FF7EAE8DA34

Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: String function: 00007FF768F8BA24 appears 90 times
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: String function: 00007FF7EAEA4DB2 appears 36 times

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682FBF20 NtQuerySystemInformation,	0_2_00007FFC682FBF20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682D6070 NtClose,	0_2_00007FFC682D6070
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F910D0 EtwRegisterTraceGuidsW,HeapSetInformation,EventRegister,RtlInitString,LsaRegisterLogonProcess,RtlInitString,LsaLookupAuthenticationPackage,LsaCallAuthenticationPackage,LsaDeregisterLogonProcess,memset,WinStationQueryInformationW,GetCommandLineW,swscanf_s,swscanf_s,swscanf_s,GlobalFree,NtOpenProcess,ImpersonateLoggedOnUser,GetUserPreferredUILanguages,RevertToSelf,SetProcessPreferredUILanguages,CoInitializeEx,ConvertStringSecurityDescriptorToSecurityDescriptorW,MakeAbsoluteSD,GetLastError,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,MakeAbsoluteSD,CoInitializeSecurity,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,memset,GetSidLengthRequired,LocalAlloc,InitializeSid,GetTokenInformation,GetSidSubAuthority,LocalFree,EtwEventWrite,EtwEventWrite,NtQueryVolumeInformationFile,EtwEventWrite,LocalAlloc,EtwSendNotification,LocalFree,NtQueryInformationToken,NtQueryInformationToken,NtClose,EtwEventWrite,EtwEventWrite,NtDuplicateObject,CloseHandle,NtWriteVirtualMemory,RtlInitString,LsaRegisterLogonProcess,RtlInitString,LsaLookupAuthenticationPackage,LsaCallAuthenticationPackage,LsaDeregisterLogonProcess,LocalAlloc,EtwSendNotification,LocalFree,NtClose,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,LocalFree,NtClose,NtClose,LocalFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CertFreeCertificateContext,memset,EventUnregister,CoUninitialize,EtwUnregisterTraceGuids,DestroyIcon,RtlNtStatusToDosError,RegGetValueW,RtlNtStatusToDosError,RtlNtStatusToDosError,RtlNtStatusToDosError,#2574,GetLastError,GetLastError,GetLastError,GetCurrentProcess,SetPriorityClass,GetLastError,EtwEventWrite,EtwEventWrite,RtlNtStatusToDosErrorNoTeb,NtClose,RtlNtStatusToDosError,RtlNtStatusToDosError,NtClose,TerminateThread,WaitForSingleObject,EtwEventWrite,EtwEventWrite,UninitLocalMsCtfMonitor,WaitForSingleObject,GetLastError,CloseHandle,	13_2_00007FF679F910D0
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F91F60 NtDuplicateToken,RtlNtStatusToDosErrorNoTeb,ImpersonateLoggedOnUser,RevertToSelf,	13_2_00007FF679F91F60
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F93380 HeapAlloc,NtReadVirtualMemory,NtDuplicateObject,NtDuplicateObject,EtwEventWrite,NtDuplicateObject,NtClose,NtClose,HeapFree,	13_2_00007FF679F93380
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F959B4 RtlInitString,LsaRegisterLogonProcess,RtlInitString,LsaLookupAuthenticationPackage,LsaCallAuthenticationPackage,LsaDeregisterLogonProcess,LocalAlloc,EtwSendNotification,LocalFree,NtClose,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,LocalFree,NtClose,NtClose,LocalFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CertFreeCertificateContext,memset,EventUnregister,CoUninitialize,EtwUnregisterTraceGuids,	13_2_00007FF679F959B4
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F9AFD0 NtDuplicateToken,RtlNtStatusToDosErrorNoTeb,	13_2_00007FF679F9AFD0
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F9A808 memset,RtlAdjustPrivilege,LsaRegisterLogonProcess,NtAllocateLocallyUniqueId,RegGetValueW,LsaLogonUser,LsaLogonUser,RtlNtStatusToDosError,NtClose,LsaFreeReturnBuffer,LsaDeregisterLogonProcess,	13_2_00007FF679F9A808
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F9B020 NtQueryInformationToken,RtlNtStatusToDosError,LocalAlloc,NtQueryInformationToken,LocalFree,RtlSubAuthoritySid,RtlSubAuthoritySid,	13_2_00007FF679F9B020
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F9AAB0 LocalAlloc,memset,memcpy,SeciAllocateAndSetCallFlags,RtlInitString,LsaRegisterLogonProcess,RtlNtStatusToDosError,NtAllocateLocallyUniqueId,LsaLogonUser,GetTokenInformation,GetTokenInformation,RtlEqualSid,GetLastError,LsaFreeReturnBuffer,CloseHandle,LsaDeregisterLogonProcess,CoTaskMemFree,LocalFree,	13_2_00007FF679F9AAB0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E26070 NtClose,	15_2_00007FFC67E26070
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E04850 NtCreateSection,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject,	15_2_00007FFC67E04850
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E4BF20 NtQuerySystemInformation,	15_2_00007FFC67E4BF20
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E145F0 RtlAddVectoredContinueHandler,VirtualProtect,VirtualProtect,RtlCreateUserThread,NtClose,	15_2_00007FFC67E145F0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E1ADF0 CreateFileMappingW,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject,	15_2_00007FFC67E1ADF0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E1A400 NtReadVirtualMemory,	15_2_00007FFC67E1A400
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E19390 NtDuplicateObject,RtlQueueApcWow64Thread,	15_2_00007FFC67E19390
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D1210D0 EtwRegisterTraceGuidsW,HeapSetInformation,EventRegister,RtlInitString,LsaRegisterLogonProcess,RtlInitString,LsaLookupAuthenticationPackage,LsaCallAuthenticationPackage,LsaDeregisterLogonProcess,memset,WinStationQueryInformationW,GetCommandLineW,swscanf_s,swscanf_s,swscanf_s,GlobalFree,NtOpenProcess,ImpersonateLoggedOnUser,GetUserPreferredUILanguages,RevertToSelf,SetProcessPreferredUILanguages,CoInitializeEx,ConvertStringSecurityDescriptorToSecurityDescriptorW,MakeAbsoluteSD,GetLastError,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,MakeAbsoluteSD,CoInitializeSecurity,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,memset,GetSidLengthRequired,LocalAlloc,InitializeSid,GetTokenInformation,GetSidSubAuthority,LocalFree,EtwEventWrite,EtwEventWrite,NtQueryVolumeInformationFile,EtwEventWrite,LocalAlloc,EtwSendNotification,LocalFree,NtQueryInformationToken,NtQueryInformationToken,NtClose,EtwEventWrite,EtwEventWrite,NtDuplicateObject,CloseHandle,NtWriteVirtualMemory,RtlInitString,LsaRegisterLogonProcess,RtlInitString,LsaLookupAuthenticationPackage,LsaCallAuthenticationPackage,LsaDeregisterLogonProcess,LocalAlloc,EtwSendNotification,LocalFree,NtClose,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,LocalFree,NtClose,NtClose,LocalFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CertFreeCertificateContext,memset,EventUnregister,CoUninitialize,EtwUnregisterTraceGuids,DestroyIcon,RtlNtStatusToDosError,RegGetValueW,RtlNtStatusToDosError,RtlNtStatusToDosError,RtlNtStatusToDosError,#2574,GetLastError,GetLastError,GetLastError,GetCurrentProcess,SetPriorityClass,GetLastError,EtwEventWrite,EtwEventWrite,RtlNtStatusToDosErrorNoTeb,NtClose,RtlNtStatusToDosError,RtlNtStatusToDosError,NtClose,TerminateThread,WaitForSingleObject,EtwEventWrite,EtwEventWrite,UninitLocalMsCtfMonitor,WaitForSingleObject,GetLastError,CloseHandle,	23_2_00007FF60D1210D0
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D12AAB0 LocalAlloc,memset,memcpy,SeciAllocateAndSetCallFlags,RtlInitString,LsaRegisterLogonProcess,RtlNtStatusToDosError,NtAllocateLocallyUniqueId,LsaLogonUser,GetTokenInformation,GetTokenInformation,RtlEqualSid,GetLastError,LsaFreeReturnBuffer,CloseHandle,LsaDeregisterLogonProcess,CoTaskMemFree,LocalFree,	23_2_00007FF60D12AAB0
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D121F60 NtDuplicateToken,RtlNtStatusToDosErrorNoTeb,ImpersonateLoggedOnUser,RevertToSelf,	23_2_00007FF60D121F60
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D1259B4 RtlInitString,LsaRegisterLogonProcess,RtlInitString,LsaLookupAuthenticationPackage,LsaCallAuthenticationPackage,LsaDeregisterLogonProcess,LocalAlloc,EtwSendNotification,LocalFree,NtClose,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,LocalFree,NtClose,NtClose,LocalFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CertFreeCertificateContext,memset,EventUnregister,CoUninitialize,EtwUnregisterTraceGuids,	23_2_00007FF60D1259B4
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D123380 HeapAlloc,NtReadVirtualMemory,NtDuplicateObject,NtDuplicateObject,EtwEventWrite,NtDuplicateObject,NtClose,NtClose,HeapFree,	23_2_00007FF60D123380
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D12AFD0 NtDuplicateToken,RtlNtStatusToDosErrorNoTeb,	23_2_00007FF60D12AFD0
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D12B020 NtQueryInformationToken,RtlNtStatusToDosError,LocalAlloc,NtQueryInformationToken,LocalFree,RtlSubAuthoritySid,RtlSubAuthoritySid,	23_2_00007FF60D12B020
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D12A808 memset,RtlAdjustPrivilege,LsaRegisterLogonProcess,NtAllocateLocallyUniqueId,RegGetValueW,LsaLogonUser,LsaLogonUser,RtlNtStatusToDosError,NtClose,LsaFreeReturnBuffer,LsaDeregisterLogonProcess,	23_2_00007FF60D12A808
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2FBF20 NtQuerySystemInformation,	27_2_00007FFC6E2FBF20
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2D6070 NtClose,	27_2_00007FFC6E2D6070
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2B4850 NtCreateSection,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject,	27_2_00007FFC6E2B4850
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2CADF0 CreateFileMappingW,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject,	27_2_00007FFC6E2CADF0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C45F0 RtlAddVectoredContinueHandler,VirtualProtect,VirtualProtect,RtlCreateUserThread,NtClose,	27_2_00007FFC6E2C45F0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2C9390 NtDuplicateObject,RtlQueueApcWow64Thread,	27_2_00007FFC6E2C9390
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2CA400 NtReadVirtualMemory,	27_2_00007FFC6E2CA400
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE90BF8 DbgPrintEx,NtQueryInformationProcess,DbgPrintEx,DbgPrintEx,ReadProcessMemory,DbgPrintEx,GetLastError,	30_2_00007FF7EAE90BF8
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAEA2388 NtQueryLicenseValue,	30_2_00007FF7EAEA2388
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE90F60 memset,NtQueryInformationProcess,DbgPrintEx,NtOpenKey,RtlInitUnicodeStringEx,NtQueryValueKey,DbgPrintEx,CloseHandle,	30_2_00007FF7EAE90F60
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAEA20F0 NtAllocateVirtualMemory,NtClose,memmove,NtDeviceIoControlFile,NtFreeVirtualMemory,NtClose,	30_2_00007FF7EAEA20F0
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAEA207C NtCreateFile,	30_2_00007FF7EAEA207C
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAEA2858 LoadLibraryExW,GetProcAddress,NtQueryLicenseValue,FreeLibrary,NtQueryLicenseValue,	30_2_00007FF7EAEA2858
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE9F450 memset,RtlInitUnicodeString,NtSetSystemInformation,	30_2_00007FF7EAE9F450
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE9F1BC memset,RtlAdjustPrivilege,NtSetSystemInformation,NtSetSystemInformation,RtlInitUnicodeString,NtSetSystemInformation,RtlAdjustPrivilege,	30_2_00007FF7EAE9F1BC
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE911A0 memset,memset,VirtualAlloc,NtOpenKey,memset,NtQueryValueKey,DbgPrintEx,memset,NtQueryValueKey,memset,NtQueryValueKey,memset,NtQueryValueKey,DbgPrintEx,DbgPrintEx,DbgPrintEx,DbgPrintEx,DbgPrintEx,NtClose,VirtualFree,	30_2_00007FF7EAE911A0
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE83598 memset,NtSuspendProcess,WerReportCreate,WerpGetReportFlags,WerpSetCallBack,WerReportSubmit,WerReportCloseHandle,NtResumeProcess,	30_2_00007FF7EAE83598
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAEA3990 NtQueryInformationToken,RtlNtStatusToDosErrorNoTeb,RtlAllocateHeap,memset,NtQueryInformationToken,RtlNtStatusToDosErrorNoTeb,RtlInitUnicodeString,RtlCompareUnicodeString,	30_2_00007FF7EAEA3990
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE89990 memset,ZwQueryInformationThread,ReadProcessMemory,GetLastError,	30_2_00007FF7EAE89990
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE9E980 IsWindow,_wcsicmp,memset,NtQuerySystemInformation,	30_2_00007FF7EAE9E980
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE91568 memset,GetProcessId,GetLastError,VirtualAlloc,GetCurrentProcess,DuplicateHandle,CreateEventW,NtQuerySystemInformation,GetThreadId,VirtualAllocEx,WriteProcessMemory,RtlDetermineDosPathNameType_U,RtlGetNtSystemRoot,DbgPrintEx,DbgPrintEx,RtlGetCurrentTransaction,RtlSetCurrentTransaction,NtQueryInformationProcess,DbgPrintEx,DbgPrintEx,DbgPrintEx,InitializeProcThreadAttributeList,GetLastError,GetLastError,VirtualAlloc,InitializeProcThreadAttributeList,GetLastError,UpdateProcThreadAttribute,GetLastError,CreateProcessW,GetLastError,NtWaitForMultipleObjects,VirtualFreeEx,CloseHandle,CloseHandle,CloseHandle,CloseHandle,DeleteProcThreadAttributeList,VirtualFree,RtlSetCurrentTransaction,CloseHandle,VirtualFree,	30_2_00007FF7EAE91568
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE95140 NtQueryInformationProcess,	30_2_00007FF7EAE95140
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE92920 ZwQueryInformationThread,GetProcessId,I_QueryTagInformation,LocalFree,wcschr,RegOpenKeyExW,RegCloseKey,	30_2_00007FF7EAE92920
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE90EE8 memset,NtQueryInformationProcess,DbgPrintEx,	30_2_00007FF7EAE90EE8
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE90AE0 DbgPrintEx,NtQueryInformationProcess,DbgPrintEx,DbgPrintEx,ReadProcessMemory,DbgPrintEx,GetLastError,	30_2_00007FF7EAE90AE0
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE89AD8 memset,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,memset,ReadProcessMemory,	30_2_00007FF7EAE89AD8
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAEA2268 NtDeviceIoControlFile,NtClose,	30_2_00007FF7EAEA2268
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAE8DA34 ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,NtQuerySystemInformation,NtOpenEvent,NtWaitForSingleObject,NtClose,RtlAllocateAndInitializeSid,RtlInitUnicodeString,memset,NtAlpcConnectPort,memset,NtAlpcSendWaitReceivePort,RtlFreeSid,NtClose,	30_2_00007FF7EAE8DA34

Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE

Code function: 30_2_00007FF7EAEA20F0: NtAllocateVirtualMemory,NtClose,memmove,NtDeviceIoControlFile,NtFreeVirtualMemory,NtClose,

30_2_00007FF7EAEA20F0

Source: dry.dll

Binary or memory string: OriginalFilenamestreams.exeJ vs dry.dll

Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe0.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe0.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe0.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe0.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe0.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: consent.exe0.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: DUI70.dll.5.dr	Static PE information: Number of sections : 12 > 10
Source: WINSTA.dll.5.dr	Static PE information: Number of sections : 12 > 10
Source: UxTheme.dll.5.dr	Static PE information: Number of sections : 12 > 10
Source: WMsgAPI.dll.5.dr	Static PE information: Number of sections : 11 > 10
Source: VERSION.dll.5.dr	Static PE information: Number of sections : 12 > 10
Source: VERSION.dll0.5.dr	Static PE information: Number of sections : 12 > 10
Source: dry.dll	Static PE information: Number of sections : 11 > 10
Source: XmlLite.dll.5.dr	Static PE information: Number of sections : 12 > 10

Source: dry.dll	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: XmlLite.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: UxTheme.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WMsgAPI.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WINSTA.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll0.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: dry.dll	Virustotal: Detection: 70%
Source: dry.dll	Metadefender: Detection: 55%
Source: dry.dll	ReversingLabs: Detection: 82%

Source: dry.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\dry.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dry.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReader
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dry.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReaderInputWithEncodingCodePage
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReaderInputWithEncodingName
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\consent.exe C:\Windows\system32\consent.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\DLKXiO\consent.exe C:\Users\user\AppData\Local\DLKXiO\consent.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SysResetErr.exe C:\Windows\system32\SysResetErr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\consent.exe C:\Windows\system32\consent.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rdpshell.exe C:\Windows\system32\rdpshell.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmstp.exe C:\Windows\system32\cmstp.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\y1c6p\cmstp.exe C:\Users\user\AppData\Local\y1c6p\cmstp.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesComputerName.exe C:\Windows\system32\SystemPropertiesComputerName.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\DWWIN.EXE
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesDataExecutionPrevention.exe C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\GsjW\sppsvc.exe C:\Users\user\AppData\Local\GsjW\sppsvc.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SndVol.exe C:\Windows\system32\SndVol.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\0rPbJb\SndVol.exe C:\Users\user\AppData\Local\0rPbJb\SndVol.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dry.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReader	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReaderInputWithEncodingCodePage	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReaderInputWithEncodingName	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dry.dll",#1	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\consent.exe C:\Windows\system32\consent.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\DLKXiO\consent.exe C:\Users\user\AppData\Local\DLKXiO\consent.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SysResetErr.exe C:\Windows\system32\SysResetErr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\consent.exe C:\Windows\system32\consent.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rdpshell.exe C:\Windows\system32\rdpshell.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmstp.exe C:\Windows\system32\cmstp.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\y1c6p\cmstp.exe C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesComputerName.exe C:\Windows\system32\SystemPropertiesComputerName.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\DWWIN.EXE	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesDataExecutionPrevention.exe C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\GsjW\sppsvc.exe C:\Users\user\AppData\Local\GsjW\sppsvc.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe

Code function: 27_2_00007FF768F84794 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,InitiateSystemShutdownW,AdjustTokenPrivileges,CloseHandle,

27_2_00007FF768F84794

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: DWWIN.EXE.5.dr	Binary string: S\Device\IPTOptInLevelNtQuerySecurityPolicySoftware\Microsoft\Windows\CurrentVersion\Policies\DataCollection\UsersSoftware\Microsoft\Windows\CurrentVersion\Policies\DataCollectionAllowTelemetrypolicymanager.dllPolicyManager_GetPolicyPolicyManager_FreeGetPolicyDataSystemLimitEnhancedDiagnosticDataWindowsAnalyticsConfigureTelemetryOptInChangeNotificationDisableTelemetryOptInChangeNotificationConfigureTelemetryOptInSettingsUxDisableTelemetryOptInSettingsUxSoftware\Policies\Microsoft\Windows\DataCollectiononecore\base\telemetry\permission\product\telemetrypermission.cppTelemetryPermission-AllowDisableTelemetryPermission-DefaultLevelKernel-ProductInfoAllowTelemetry_PolicyManagerReserved.PlatformSignedCodeIntegrity.Telemetry
Source: DWWIN.EXE.5.dr	Binary string: %X%sInPageCoFireInPageError%s\system32\cofire.exe"%s" "%s" "%s"\Device\LanmanRedirector\%s :psapi.dllGetMappedFileNameWsfc_os.dllSfcIsFileProtectedFindFirstFileNameWFindNextFileNameWwdi.dll;D

Source: classification engine

Classification label: mal100.troj.evad.winDLL@45/15@5/0

Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe

Code function: 13_2_00007FF679F92C60 memset,ImpersonateLoggedOnUser,RevertToSelf,CoTaskMemFree,GetSystemMetrics,CoCreateInstance,GetDriveTypeW,memset,GetLastError,

13_2_00007FF679F92C60

Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE

Code function: 30_2_00007FF7EAE9E55C OpenSCManagerW,OpenServiceW,StartServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,RtlInitUnicodeString,

30_2_00007FF7EAE9E55C

Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe

Code function: 15_2_00007FFC67E1B420 GetProcessId,CreateToolhelp32Snapshot,Thread32First,Thread32Next,

15_2_00007FFC67E1B420

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReader

Source: C:\Users\user\AppData\Local\GsjW\sppsvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\{b1a0966b-ebe1-a316-4592-063e04716434}
Source: C:\Users\user\AppData\Local\GsjW\sppsvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\{a32f501c-157b-d61c-09ee-04263fde8dbb}

Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe

Code function: 13_2_00007FF679FA0E88 FindResourceExW,LoadResource,LockResource,

13_2_00007FF679FA0E88

Source: cmstp.exe	String found in binary or memory: /k certutil.exe -f -enterprise -v -addstore Root "%s"
Source: DWWIN.EXE	String found in binary or memory: %s /stop
Source: DWWIN.EXE	String found in binary or memory: %s /stop

Source: dry.dll

Static PE information: Image base 0x140000000 > 0x60000000

Source: dry.dll

Static file information: File size 1372160 > 1048576

Source: dry.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: dry.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: consent.pdb source: consent.exe, 0000000D.00000000.375430040.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmp, consent.exe, 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmp, consent.exe, 00000017.00000000.417554670.00007FF60D131000.00000002.00000001.01000000.0000000A.sdmp, consent.exe, 00000017.00000002.418228151.00007FF60D131000.00000002.00000001.01000000.0000000A.sdmp, consent.exe0.5.dr, consent.exe.5.dr
Source:	Binary string: SndVol.pdbGCTL source: SndVol.exe, 00000025.00000000.519784312.00007FF7A30D2000.00000002.00000001.01000000.00000011.sdmp, SndVol.exe.5.dr
Source:	Binary string: cmstp.pdbGCTL source: cmstp.exe, 0000001B.00000002.448541294.00007FF768F8F000.00000002.00000001.01000000.0000000B.sdmp, cmstp.exe, 0000001B.00000000.426211728.00007FF768F8F000.00000002.00000001.01000000.0000000B.sdmp, cmstp.exe.5.dr
Source:	Binary string: FFgnji\|RgnjiR.pdb source: SysResetErr.exe, 0000000F.00000002.410461412.00000204E63D7000.00000004.00000020.00020000.00000000.sdmp, SysResetErr.exe, 0000000F.00000002.410154109.00000204E622E000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000001B.00000002.448408637.0000016FCD5A2000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000001B.00000002.448269347.0000016FCD449000.00000004.00000020.00020000.00000000.sdmp, DWWIN.EXE, 0000001E.00000002.476969443.0000025594C81000.00000004.00000020.00020000.00000000.sdmp, DWWIN.EXE, 0000001E.00000002.477066927.0000025594DE1000.00000004.00000020.00020000.00000000.sdmp, sppsvc.exe, 00000023.00000002.513393199.0000029561289000.00000004.00000020.00020000.00000000.sdmp, sppsvc.exe, 00000023.00000002.513278214.0000029561127000.00000004.00000020.00020000.00000000.sdmp, dry.dll, VERSION.dll.5.dr, VERSION.dll0.5.dr, UxTheme.dll.5.dr, WINSTA.dll.5.dr, DUI70.dll.5.dr, XmlLite.dll.5.dr, WMsgAPI.dll.5.dr
Source:	Binary string: sppsvc.pdb source: sppsvc.exe, 00000023.00000000.488372541.00007FF6A254B000.00000002.00000001.01000000.0000000F.sdmp, sppsvc.exe, 00000023.00000002.514242869.00007FF6A254B000.00000002.00000001.01000000.0000000F.sdmp, sppsvc.exe.5.dr
Source:	Binary string: SysResetErr.pdb source: SysResetErr.exe, 0000000F.00000000.387584584.00007FF67A426000.00000002.00000001.01000000.00000008.sdmp, SysResetErr.exe, 0000000F.00000002.410882238.00007FF67A426000.00000002.00000001.01000000.00000008.sdmp, SysResetErr.exe.5.dr
Source:	Binary string: dwwin.pdbGCTL source: DWWIN.EXE, 0000001E.00000000.454947885.00007FF7EAEA6000.00000002.00000001.01000000.0000000D.sdmp, DWWIN.EXE, 0000001E.00000002.477319814.00007FF7EAEA6000.00000002.00000001.01000000.0000000D.sdmp, DWWIN.EXE.5.dr
Source:	Binary string: cmstp.pdb source: cmstp.exe, 0000001B.00000002.448541294.00007FF768F8F000.00000002.00000001.01000000.0000000B.sdmp, cmstp.exe, 0000001B.00000000.426211728.00007FF768F8F000.00000002.00000001.01000000.0000000B.sdmp, cmstp.exe.5.dr
Source:	Binary string: sppsvc.pdbGCTL source: sppsvc.exe, 00000023.00000000.488372541.00007FF6A254B000.00000002.00000001.01000000.0000000F.sdmp, sppsvc.exe, 00000023.00000002.514242869.00007FF6A254B000.00000002.00000001.01000000.0000000F.sdmp, sppsvc.exe.5.dr
Source:	Binary string: dwwin.pdb source: DWWIN.EXE, 0000001E.00000000.454947885.00007FF7EAEA6000.00000002.00000001.01000000.0000000D.sdmp, DWWIN.EXE, 0000001E.00000002.477319814.00007FF7EAEA6000.00000002.00000001.01000000.0000000D.sdmp, DWWIN.EXE.5.dr
Source:	Binary string: consent.pdbUGP source: consent.exe, 0000000D.00000000.375430040.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmp, consent.exe, 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmp, consent.exe, 00000017.00000000.417554670.00007FF60D131000.00000002.00000001.01000000.0000000A.sdmp, consent.exe, 00000017.00000002.418228151.00007FF60D131000.00000002.00000001.01000000.0000000A.sdmp, consent.exe0.5.dr, consent.exe.5.dr
Source:	Binary string: SndVol.pdb source: SndVol.exe, 00000025.00000000.519784312.00007FF7A30D2000.00000002.00000001.01000000.00000011.sdmp, SndVol.exe.5.dr
Source:	Binary string: SysResetErr.pdbGCTL source: SysResetErr.exe, 0000000F.00000000.387584584.00007FF67A426000.00000002.00000001.01000000.00000008.sdmp, SysResetErr.exe, 0000000F.00000002.410882238.00007FF67A426000.00000002.00000001.01000000.00000008.sdmp, SysResetErr.exe.5.dr

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFC682E7E4C push rax; iretd

0_2_00007FFC682E7E4D

Source: dry.dll	Static PE information: section name: .cwkw
Source: dry.dll	Static PE information: section name: .pbpwn
Source: dry.dll	Static PE information: section name: .pem
Source: dry.dll	Static PE information: section name: .vpd
Source: dry.dll	Static PE information: section name: .ianurq
Source: sppsvc.exe.5.dr	Static PE information: section name: ?g_Encry
Source: sppsvc.exe.5.dr	Static PE information: section name: ?g_Encry
Source: sppsvc.exe.5.dr	Static PE information: section name: ?g_Encry
Source: sppsvc.exe.5.dr	Static PE information: section name: ?g_Encry
Source: SndVol.exe.5.dr	Static PE information: section name: .imrsiv
Source: SndVol.exe.5.dr	Static PE information: section name: .didat
Source: consent.exe.5.dr	Static PE information: section name: .didat
Source: consent.exe.5.dr	Static PE information: section name: consent
Source: SysResetErr.exe.5.dr	Static PE information: section name: .imrsiv
Source: consent.exe0.5.dr	Static PE information: section name: .didat
Source: consent.exe0.5.dr	Static PE information: section name: consent
Source: XmlLite.dll.5.dr	Static PE information: section name: .cwkw
Source: XmlLite.dll.5.dr	Static PE information: section name: .pbpwn
Source: XmlLite.dll.5.dr	Static PE information: section name: .pem
Source: XmlLite.dll.5.dr	Static PE information: section name: .vpd
Source: XmlLite.dll.5.dr	Static PE information: section name: .ianurq
Source: XmlLite.dll.5.dr	Static PE information: section name: .lvil
Source: UxTheme.dll.5.dr	Static PE information: section name: .cwkw
Source: UxTheme.dll.5.dr	Static PE information: section name: .pbpwn
Source: UxTheme.dll.5.dr	Static PE information: section name: .pem
Source: UxTheme.dll.5.dr	Static PE information: section name: .vpd
Source: UxTheme.dll.5.dr	Static PE information: section name: .ianurq
Source: UxTheme.dll.5.dr	Static PE information: section name: .ilyvtg
Source: WMsgAPI.dll.5.dr	Static PE information: section name: .cwkw
Source: WMsgAPI.dll.5.dr	Static PE information: section name: .pbpwn
Source: WMsgAPI.dll.5.dr	Static PE information: section name: .pem
Source: WMsgAPI.dll.5.dr	Static PE information: section name: .vpd
Source: WMsgAPI.dll.5.dr	Static PE information: section name: .ianurq
Source: DUI70.dll.5.dr	Static PE information: section name: .cwkw
Source: DUI70.dll.5.dr	Static PE information: section name: .pbpwn
Source: DUI70.dll.5.dr	Static PE information: section name: .pem
Source: DUI70.dll.5.dr	Static PE information: section name: .vpd
Source: DUI70.dll.5.dr	Static PE information: section name: .ianurq
Source: DUI70.dll.5.dr	Static PE information: section name: .dqihw
Source: WINSTA.dll.5.dr	Static PE information: section name: .cwkw
Source: WINSTA.dll.5.dr	Static PE information: section name: .pbpwn
Source: WINSTA.dll.5.dr	Static PE information: section name: .pem
Source: WINSTA.dll.5.dr	Static PE information: section name: .vpd
Source: WINSTA.dll.5.dr	Static PE information: section name: .ianurq
Source: WINSTA.dll.5.dr	Static PE information: section name: .kfs
Source: VERSION.dll.5.dr	Static PE information: section name: .cwkw
Source: VERSION.dll.5.dr	Static PE information: section name: .pbpwn
Source: VERSION.dll.5.dr	Static PE information: section name: .pem
Source: VERSION.dll.5.dr	Static PE information: section name: .vpd
Source: VERSION.dll.5.dr	Static PE information: section name: .ianurq
Source: VERSION.dll.5.dr	Static PE information: section name: .fez
Source: VERSION.dll0.5.dr	Static PE information: section name: .cwkw
Source: VERSION.dll0.5.dr	Static PE information: section name: .pbpwn
Source: VERSION.dll0.5.dr	Static PE information: section name: .pem
Source: VERSION.dll0.5.dr	Static PE information: section name: .vpd
Source: VERSION.dll0.5.dr	Static PE information: section name: .ianurq
Source: VERSION.dll0.5.dr	Static PE information: section name: .jksgp
Source: DWWIN.EXE.5.dr	Static PE information: section name: .didat

Source: SndVol.exe.5.dr

Static PE information: 0x6E534A77 [Sun Aug 27 01:25:11 2028 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 7.76153125253
Source: initial sample	Static PE information: section name: .text entropy: 7.76153125253
Source: initial sample	Static PE information: section name: .text entropy: 7.76153125253
Source: initial sample	Static PE information: section name: .text entropy: 7.76153125253
Source: initial sample	Static PE information: section name: .text entropy: 7.76153125253
Source: initial sample	Static PE information: section name: .text entropy: 7.76153125253
Source: initial sample	Static PE information: section name: .text entropy: 7.76153125253
Source: initial sample	Static PE information: section name: .text entropy: 7.76153125253

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\GsjW\sppsvc.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\0rPbJb\SndVol.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\y1c6p\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\GsjW\XmlLite.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\DLKXiO\WMsgAPI.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\oudoiG\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\0rPbJb\UxTheme.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\s8hTTPzEx\DUI70.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\dfAZPUGwQ\WINSTA.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F8591C memset,memset,RegOpenKeyExW,RegQueryValueExW,lstrcmpiW,LoadStringW,MessageBoxW,RegCloseKey,GetPrivateProfileIntW,GetPrivateProfileIntW,LoadStringW,LoadStringW,LoadStringW,MessageBoxW,CmMalloc,GetPrivateProfileStringW,CmRealloc,CmMalloc,GetPrivateProfileStringW,CmRealloc,GetPrivateProfileStringW,GetPrivateProfileStringW,WritePrivateProfileStringW,lstrlenW,lstrlenW,WritePrivateProfileStringW,CmFree,CmFree,GetSystemDirectoryW,	27_2_00007FF768F8591C
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F89160 GetSystemDirectoryW,memset,GetPrivateProfileStringW,RegOpenKeyExW,RegDeleteValueW,RegDeleteValueW,RegCloseKey,memset,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,CmMalloc,CreateFileW,CloseHandle,GetOSVersion,GetOSMajorVersion,CmFree,	27_2_00007FF768F89160
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F86068 RegOpenKeyExW,RegQueryValueExW,GetPrivateProfileIntW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,	27_2_00007FF768F86068
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F8637C GetSystemDirectoryW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,LoadStringW,RegOpenKeyExW,RegQueryInfoKeyW,RegCloseKey,LoadStringW,lstrlenW,lstrlenW,lstrlenW,LoadStringW,LoadStringW,MessageBoxW,GetSystemDirectoryW,LoadStringW,MessageBoxW,	27_2_00007FF768F8637C
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F87480 LoadStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileIntW,LoadStringW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,LoadStringW,MessageBoxW,LoadStringW,MessageBoxW,CmFree,GetPrivateProfileIntW,CmFree,lstrlenW,CmFree,CmFree,LoadStringW,MessageBoxW,WritePrivateProfileStringW,WritePrivateProfileStringW,CmFree,memset,memset,memset,RegOpenKeyExW,RegQueryValueExW,ExpandEnvironmentStringsW,lstrcmpiW,LoadStringW,MessageBoxW,CmMalloc,GetPrivateProfileStringW,CmRealloc,CmMalloc,GetPrivateProfileStringW,CmRealloc,GetPrivateProfileStringW,GetPrivateProfileStringW,WritePrivateProfileStringW,lstrlenW,lstrlenW,WritePrivateProfileStringW,CmFree,CmFree,RegCloseKey,RegCreateKeyW,lstrlenW,RegSetValueExW,LoadStringW,MessageBoxW,RegCloseKey,RegCloseKey,memset,memset,CopyFileW,LoadStringW,MessageBoxW,memset,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,CmMalloc,GetOSVersion,GetOSMajorVersion,CreateFileW,CloseHandle,GetOSVersion,GetOSMajorVersion,GetOSVersion,GetOSMajorVersion,lstrlenW,CmMalloc,lstrlenW,CmFree,CmFree,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,LoadStringW,MessageBoxExW,ReleaseMutex,CloseHandle,CmMalloc,memset,CmFree,CmMalloc,memset,ShellExecuteExW,GetLastError,SHGetMalloc,CoUninitialize,LoadStringW,MessageBoxW,CmFree,CmFree,	27_2_00007FF768F87480
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F8AAD4 memset,memset,memset,memset,LoadStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,RegCreateKeyExW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,lstrlenW,RegSetValueExW,RegCloseKey,lstrlenW,memset,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,CmMalloc,CreateFileW,CloseHandle,CmFree,memset,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,CmMalloc,GetOSVersion,GetOSMajorVersion,CreateFileW,CloseHandle,GetOSVersion,GetOSMajorVersion,CmFree,GetPrivateProfileIntW,SetFileAttributesW,memset,SHFileOperationW,RegCloseKey,RegCloseKey,	27_2_00007FF768F8AAD4
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F81000 GetPrivateProfileStringW,GetModuleHandleA,GetProcAddress,GetCurrentProcess,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,LoadLibraryExW,GetProcAddress,GetProcAddress,FreeLibrary,	27_2_00007FF768F81000
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F89E10 RegOpenKeyExW,GetPrivateProfileIntW,GetSystemDirectoryW,memset,GetPrivateProfileStringW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,memset,RegEnumValueW,RegCloseKey,	27_2_00007FF768F89E10

Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE

Code function: 30_2_00007FF7EAE9E55C OpenSCManagerW,OpenServiceW,StartServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,RtlInitUnicodeString,

30_2_00007FF7EAE9E55C

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\GsjW\sppsvc.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\loaddll64.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-66733

Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	API coverage: 2.0 %
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	API coverage: 2.0 %
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	API coverage: 6.5 %
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	API coverage: 0.4 %

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFC682ECC90 GetSystemInfo,

0_2_00007FFC682ECC90

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC682EDBE0 FindFirstFileExW,	0_2_00007FFC682EDBE0
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FFC67E3DBE0 FindFirstFileExW,	15_2_00007FFC67E3DBE0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F871E0 memset,GetPrivateProfileStringW,FindFirstFileW,wcscmp,memset,FindNextFileW,	27_2_00007FF768F871E0
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F84008 memset,memset,memset,SHGetFolderPathW,memset,SHGetFolderPathW,lstrlenW,CmMalloc,CmFree,CmFree,memset,FindFirstFileW,GetLastError,memset,memset,FindNextFileW,FindClose,	27_2_00007FF768F84008
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FFC6E2EDBE0 FindFirstFileExW,	27_2_00007FFC6E2EDBE0

Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE

Code function: 30_2_00007FF7EAE96678 memset,StrStrIW,GetLogicalDriveStringsW,QueryDosDeviceW,StrStrIW,

30_2_00007FF7EAE96678

Source: explorer.exe, 00000005.00000000.300736348.000000000EE50000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.300001860.0000000008957000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.312524507.00000000086C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.299785013.0000000008778000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 00000005.00000000.309086880.00000000067C2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.312524507.00000000086C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 00000005.00000000.309086880.00000000067C2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: explorer.exe, 00000005.00000000.312524507.00000000086C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe

Code function: 13_2_00007FF679F95014 IsDebuggerPresent,

13_2_00007FF679F95014

Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe

Code function: 15_2_00007FF67A422940 _cwprintf_s_l,OutputDebugStringW,GetLastError,CurrentIP,WdsSetupLogMessageW,

15_2_00007FF67A422940

Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe

Code function: 13_2_00007FF679F97944 GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

13_2_00007FF679F97944

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFC682D7EA0 LdrLoadDll,FindClose,

0_2_00007FFC682D7EA0

Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F94940 SetUnhandledExceptionFilter,	13_2_00007FF679F94940
Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: 13_2_00007FF679F94630 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FF679F94630
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FF67A423C80 SetUnhandledExceptionFilter,	15_2_00007FF67A423C80
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Code function: 15_2_00007FF67A423F04 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00007FF67A423F04
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D124940 SetUnhandledExceptionFilter,	23_2_00007FF60D124940
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: 23_2_00007FF60D124630 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_00007FF60D124630
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F8EC00 SetUnhandledExceptionFilter,	27_2_00007FF768F8EC00
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Code function: 27_2_00007FF768F8E910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	27_2_00007FF768F8E910
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAEA4060 SetUnhandledExceptionFilter,	30_2_00007FF7EAEA4060
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Code function: 30_2_00007FF7EAEA466C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	30_2_00007FF7EAEA466C

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: XmlLite.dll.5.dr

Jump to dropped file

Changes memory attributes in foreign processes to executable or writable

Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFC8DD4EFE0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFC8DD4E000 protect: page execute read	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFC8BAD2A20 protect: page execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\System32\rundll32.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE

Code function: 30_2_00007FF7EAE91568 memset,GetProcessId,GetLastError,VirtualAlloc,GetCurrentProcess,DuplicateHandle,CreateEventW,NtQuerySystemInformation,GetThreadId,VirtualAllocEx,WriteProcessMemory,RtlDetermineDosPathNameType_U,RtlGetNtSystemRoot,DbgPrintEx,DbgPrintEx,RtlGetCurrentTransaction,RtlSetCurrentTransaction,NtQueryInformationProcess,DbgPrintEx,DbgPrintEx,DbgPrintEx,InitializeProcThreadAttributeList,GetLastError,GetLastError,VirtualAlloc,InitializeProcThreadAttributeList,GetLastError,UpdateProcThreadAttribute,GetLastError,CreateProcessW,GetLastError,NtWaitForMultipleObjects,VirtualFreeEx,CloseHandle,CloseHandle,CloseHandle,CloseHandle,DeleteProcThreadAttributeList,VirtualFree,RtlSetCurrentTransaction,CloseHandle,VirtualFree,

30_2_00007FF7EAE91568

Uses Atom Bombing / ProGate to inject into other processes

Source: C:\Windows\System32\rundll32.exe

Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h

Jump to behavior

Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe

Code function: 13_2_00007FF679F9A808 memset,RtlAdjustPrivilege,LsaRegisterLogonProcess,NtAllocateLocallyUniqueId,RegGetValueW,LsaLogonUser,LsaLogonUser,RtlNtStatusToDosError,NtClose,LsaFreeReturnBuffer,LsaDeregisterLogonProcess,

13_2_00007FF679F9A808

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dry.dll",#1

Jump to behavior

Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe

Code function: 27_2_00007FF768F845D0 AllocateAndInitializeSid,GetModuleHandleA,LoadLibraryExA,GetProcAddress,FreeSid,FreeLibrary,

27_2_00007FF768F845D0

Source: explorer.exe, 00000005.00000000.291491116.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.305437816.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.335801965.00000000011E0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.291163470.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.335495634.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.305244854.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman\Pr
Source: explorer.exe, 00000005.00000000.291491116.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.295269189.0000000005E10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.305437816.00000000011E0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.291491116.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.305437816.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.335801965.00000000011E0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: SndVol.exe, 00000025.00000000.519784312.00007FF7A30D2000.00000002.00000001.01000000.00000011.sdmp, SndVol.exe.5.dr	Binary or memory string: Software\Microsoft\Multimedia\Audio\SndVolSndVolPreferencesMaskSndVolSelectedDevicesShell_TrayWnd
Source: explorer.exe, 00000005.00000000.291491116.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.305437816.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.335801965.00000000011E0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.312590871.0000000008778000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.329692189.0000000008778000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.299785013.0000000008778000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\GsjW\sppsvc.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\GsjW\sppsvc.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\0rPbJb\SndVol.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\0rPbJb\SndVol.exe	Queries volume information: unknown VolumeInformation

Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe	Code function: _wtoi,GetLocaleInfoW,CoTaskMemAlloc,GetLocaleInfoW,CoTaskMemFree,CoTaskMemAlloc,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,		13_2_00007FF679F9C0CC
Source: C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	Code function: _wtoi,GetLocaleInfoW,CoTaskMemAlloc,GetLocaleInfoW,CoTaskMemFree,CoTaskMemAlloc,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,		23_2_00007FF60D12C0CC

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe

Code function: 13_2_00007FF679F94AD0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

13_2_00007FF679F94AD0

Source: C:\Users\user\AppData\Local\y1c6p\cmstp.exe

Code function: 27_2_00007FF768F8CB20 memset,GetSystemInfo,GetVersionExW,

27_2_00007FF768F8CB20

Source: C:\Users\user\AppData\Local\DLKXiO\consent.exe

Code function: 13_2_00007FF679F93940 LocalAlloc,ImpersonateLoggedOnUser,GetLastError,GetUserNameExW,GetLastError,RevertToSelf,wcschr,LoadUserProfileW,GetLastError,ConvertStringSecurityDescriptorToSecurityDescriptorW,CreateEventW,LocalFree,ConvertStringSecurityDescriptorToSecurityDescriptorW,CreateEventW,LocalFree,ConvertStringSecurityDescriptorToSecurityDescriptorW,CreateEventW,LocalFree,ConvertStringSecurityDescriptorToSecurityDescriptorW,CreateEventW,LocalFree,SetEvent,SetEvent,CloseHandle,CloseHandle,memset,ImpersonateLoggedOnUser,GetLastError,CreateFileW,GetLastError,wcsrchr,RevertToSelf,CloseHandle,CloseHandle,ConvertStringSecurityDescriptorToSecurityDescriptorW,CreateEventW,LocalFree,ConvertStringSecurityDescriptorToSecurityDescriptorW,CreateEventW,LocalFree,SetEvent,SetEvent,CloseHandle,CloseHandle,UnloadUserProfile,LocalFree,CloseHandle,

13_2_00007FF679F93940

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Valid Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Service Execution	1 Windows Service	11 Access Token Manipulation	1 Valid Accounts	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Native API	Logon Script (Windows)	1 Windows Service	11 Access Token Manipulation	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Exploitation for Client Execution	Logon Script (Mac)	412 Process Injection	412 Process Injection	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	3 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rundll32	DCSync	35 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Timestomp	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
dry.dll	71%	Virustotal		Browse
dry.dll	56%	Metadefender		Browse
dry.dll	82%	ReversingLabs	Win64.Infostealer.Dridex
dry.dll	100%	Avira	TR/Crypt.XPACK.Gen7
dry.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\oudoiG\VERSION.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\oudoiG\VERSION.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\0rPbJb\UxTheme.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\dfAZPUGwQ\WINSTA.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\s8hTTPzEx\DUI70.dll	100%	Avira	TR/Crypt.XPACK.Gen4
C:\Users\user\AppData\Local\GsjW\XmlLite.dll	100%	Avira	TR/Crypt.XPACK.Gen7
C:\Users\user\AppData\Local\DLKXiO\WMsgAPI.dll	100%	Avira	TR/Crypt.XPACK.Gen7
C:\Users\user\AppData\Local\oudoiG\VERSION.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\oudoiG\VERSION.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\0rPbJb\UxTheme.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\dfAZPUGwQ\WINSTA.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\s8hTTPzEx\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\GsjW\XmlLite.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\DLKXiO\WMsgAPI.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\0rPbJb\SndVol.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\0rPbJb\SndVol.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\0rPbJb\SndVol.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\DLKXiO\consent.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\DLKXiO\consent.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\GsjW\sppsvc.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\GsjW\sppsvc.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
27.2.cmstp.exe.7ffc6e290000.3.unpack	100%	Avira	HEUR/AGEN.1138339	Download File
8.2.rundll32.exe.7ffc68290000.2.unpack	100%	Avira	HEUR/AGEN.1138339	Download File
0.2.loaddll64.exe.1d745960000.0.unpack	100%	Avira	HEUR/AGEN.1202768	Download File
8.2.rundll32.exe.1bde0fe0000.1.unpack	100%	Avira	HEUR/AGEN.1202768	Download File
4.2.rundll32.exe.7ffc68290000.2.unpack	100%	Avira	HEUR/AGEN.1138339	Download File
3.2.rundll32.exe.7ffc68290000.2.unpack	100%	Avira	HEUR/AGEN.1138339	Download File
4.2.rundll32.exe.18772c80000.1.unpack	100%	Avira	HEUR/AGEN.1202768	Download File
27.2.cmstp.exe.16fcb7b0000.0.unpack	100%	Avira	HEUR/AGEN.1202768	Download File
6.2.rundll32.exe.14c9a260000.1.unpack	100%	Avira	HEUR/AGEN.1202768	Download File
35.2.sppsvc.exe.7ffc6e290000.3.unpack	100%	Avira	HEUR/AGEN.1138339	Download File
0.2.loaddll64.exe.7ffc68290000.2.unpack	100%	Avira	HEUR/AGEN.1138339	Download File
6.2.rundll32.exe.7ffc68290000.2.unpack	100%	Avira	HEUR/AGEN.1138339	Download File
15.2.SysResetErr.exe.7ffc67de0000.3.unpack	100%	Avira	HEUR/AGEN.1138339	Download File
3.2.rundll32.exe.267f4940000.1.unpack	100%	Avira	HEUR/AGEN.1202768	Download File
30.2.DWWIN.EXE.7ffc6e290000.3.unpack	100%	Avira	HEUR/AGEN.1138339	Download File
30.2.DWWIN.EXE.25593050000.0.unpack	100%	Avira	HEUR/AGEN.1202768	Download File
35.2.sppsvc.exe.2955f650000.0.unpack	100%	Avira	HEUR/AGEN.1202768	Download File
15.2.SysResetErr.exe.204e44f0000.0.unpack	100%	Avira	HEUR/AGEN.1202768	Download File

Name	IP	Active	Malicious	Antivirus Detection	Reputation
canonicalizer.ucsuri.tcs	unknown	unknown	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	575240
Start date:	20.02.2022
Start time:	08:19:09
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	dry.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@45/15@5/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 26.3% (good quality ratio 21.1%) Quality average: 55.4% Quality standard deviation: 35.4%
HCA Information:	Successful, ratio: 98% Number of executed functions: 41 Number of non-executed functions: 158
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll

Warnings

Connection to analysis system has been lost, crash info: Unknown
Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, login.live.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\0rPbJb\SndVol.exe	AkpjUKjiAM.dll	Get hash	malicious	Browse
	CSSmwdf3UF.dll	Get hash	malicious	Browse
	24ac5jNpCI.dll	Get hash	malicious	Browse
	lyQcmMduLy.dll	Get hash	malicious	Browse
	msHfoFVqcF.dll	Get hash	malicious	Browse
	7zwj6oFA8Q.dll	Get hash	malicious	Browse
	wXUkNWM7P0.dll	Get hash	malicious	Browse
	EcPDKIddT5.dll	Get hash	malicious	Browse
	B9lqvI6lNP.dll	Get hash	malicious	Browse
	qFWVUQUdX0.dll	Get hash	malicious	Browse
	N34jiNSWAx.dll	Get hash	malicious	Browse
	tTu83mphhX.dll	Get hash	malicious	Browse
	ZZpllNXa3O.dll	Get hash	malicious	Browse
	zB14GfXeGv.dll	Get hash	malicious	Browse
	6GhwZJ6uY0.dll	Get hash	malicious	Browse
	Y4Gd7K2a8m.dll	Get hash	malicious	Browse
	N4sGYY5pSn.dll	Get hash	malicious	Browse
	4aD3lTQ3ku.dll	Get hash	malicious	Browse
	vVPS3LRIrm.dll	Get hash	malicious	Browse
	C3AGWzJKYE.dll	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\0rPbJb\SndVol.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	259904
Entropy (8bit):	5.955701055747905
Encrypted:	false
SSDEEP:	3072:UfYIZJbRydnidilSnGvLqeD358rwW39nuyHjVozZcxSHfcBL1ljbEyB7HbIa+:Uf9JonidFnqLV358rNnJqcRcy10/
MD5:	CDD7C7DF2D0859AC3F4088423D11BD08
SHA1:	128789A2EA904F684B5DF2384BA6EEF4EB60FB8E
SHA-256:	D98DB8339EB1B93A7345EECAC2B7290FA7156E3E12B7632D876BD0FD1F31EC66
SHA-512:	A093BF3C40C880A80164F2CAA87DF76DCD854375C5216D761E60F3770DFA04F4B02EC0CA6313C32413AC99A3EBDC081CF915A7B468EE3CED80F9B1ECF4B49804
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: AkpjUKjiAM.dll, Detection: malicious, Browse Filename: CSSmwdf3UF.dll, Detection: malicious, Browse Filename: 24ac5jNpCI.dll, Detection: malicious, Browse Filename: lyQcmMduLy.dll, Detection: malicious, Browse Filename: msHfoFVqcF.dll, Detection: malicious, Browse Filename: 7zwj6oFA8Q.dll, Detection: malicious, Browse Filename: wXUkNWM7P0.dll, Detection: malicious, Browse Filename: EcPDKIddT5.dll, Detection: malicious, Browse Filename: B9lqvI6lNP.dll, Detection: malicious, Browse Filename: qFWVUQUdX0.dll, Detection: malicious, Browse Filename: N34jiNSWAx.dll, Detection: malicious, Browse Filename: tTu83mphhX.dll, Detection: malicious, Browse Filename: ZZpllNXa3O.dll, Detection: malicious, Browse Filename: zB14GfXeGv.dll, Detection: malicious, Browse Filename: 6GhwZJ6uY0.dll, Detection: malicious, Browse Filename: Y4Gd7K2a8m.dll, Detection: malicious, Browse Filename: N4sGYY5pSn.dll, Detection: malicious, Browse Filename: 4aD3lTQ3ku.dll, Detection: malicious, Browse Filename: vVPS3LRIrm.dll, Detection: malicious, Browse Filename: C3AGWzJKYE.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.BL]..L]..L]..E%...]..#9..O]..#9..U]..#9..F]..#9..W]..L]...\..#9..o]..#9k.M]..#9..M]..RichL]..........................PE..d...wJSn.........."............................@.............................@....................... .........................................p.... ..@...............@+...0.......U..T...................p&..(...p%...............&......P........................text............................... ..`.imrsiv..................................rdata....... ......................@..@.data...............................@....pdata..............................@..@.didat..............................@....rsrc...@.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\0rPbJb\UxTheme.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1376256
Entropy (8bit):	5.014670719687533
Encrypted:	false
SSDEEP:	12288:slORVEAueQmTmQKO2nMlqVaSEwzH7YxiCyJ86azEZy1f11pNx:gORVEVNmaDznMlqVNE27dJ8J2inNx
MD5:	119D43AEE03F7225BC2DCB9758976345
SHA1:	D319D9BF1C114A6B348E524FE493D629051EA78B
SHA-256:	B75A0694F4450FB2669A15039537A666D40FD592D75C0300F0A4262D86A86D8B
SHA-512:	C1A72C43D0866B8508AE5D0F3ECDF5DFF184A6862BC93E8BCDD569A650086051C7918186CEFF816503EE2566BE336793F7190C9D698FB543CC04307B4068F39A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d...z.v^.........." ..... ....................@..........................................`.................................................x...x....................................0..8............................................0...............................text............ .................. ..`.rdata..._...0...`...0..............@..@.data...........0..................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B.cwkw...............................@..@.pbpwn..tQ.......`..................@..@.pem....

C:\Users\user\AppData\Local\DLKXiO\WMsgAPI.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1372160
Entropy (8bit):	5.013506443062603
Encrypted:	false
SSDEEP:	12288:alORVEAueQmTmQKO2nMlqVaSEwzH7YxiCyJ86azEZy1f11pNx:OORVEVNmaDznMlqVNE27dJ8J2inNx
MD5:	4E74BAB6EE3BFC6FA8A83FF4932E1B0B
SHA1:	6DAEBBD85383F6ED11734BF342DE98051BC66985
SHA-256:	10108D4E0584A0F4218094210008B0802CF79BF4325983A16E1E31CEA14A76AC
SHA-512:	BFA2EDB51E5CE6A59FBD7BA2C55E6985F77B3A63DC00ABA2436F689F934CD571E17A6C9A895F0CEAB0C96ED379151605D98A6D9D21B0ED545F38A5685B83E248
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d...z.v^.........." ..... ....................@..........................................`................................................x...x....................................0..8............................................0...............................text............ .................. ..`.rdata..._...0...`...0..............@..@.data...........0..................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B.cwkw...............................@..@.pbpwn..tQ.......`..................@..@.pem....

C:\Users\user\AppData\Local\DLKXiO\consent.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157080
Entropy (8bit):	5.924344092826888
Encrypted:	false
SSDEEP:	3072:4eana1Hze2vHL+u5F28BrciRXBis72z5B+o:Aa1TfD+u5F2wrTio2z2o
MD5:	74D31E4F51873160D91B1F80E0C472D0
SHA1:	35DEC0D1A12C6F1F7A460E3AE75E4D74D5BD815A
SHA-256:	113813A699063EBF391D436A4EFE0B6F95F81E12AF773FABE5511B5CA08E189C
SHA-512:	F026CBBDF3792A05091B3CC0A97F825D353BC5FF9AB7248F4544B81BA2F86FD28CEB04468D755715BB3BD220BB72781DC079423D912A56E3793AC1687AEE7E05
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y_GE.>)..>)..>)..F..Y>).rZ*..>).rZ-..>).rZ,..>).rZ(..>)..>(.9?).rZ'..>).rZ...>).rZ+..>).Rich.>).................PE..d...i.7.........."..........H.......C.........@..................................................... ......................................PP..\...............h....D...!..........0%..T...........................................(...(...HL.......................text............................... ..`.rdata...c.......d..................@..@.data...l............h..............@....pdata..h............j..............@..@.didat...............x..............@...consent.b............z..............@....rsrc................\|..............@..@.reloc...............B..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\GsjW\XmlLite.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1376256
Entropy (8bit):	5.00173504502067
Encrypted:	false
SSDEEP:	12288:4lORVEAueQmTmQKO2nMlqVaSEwzH7YxiCyJ86azEZy1f11pNx:8ORVEVNmaDznMlqVNE27dJ8J2inNx
MD5:	AF59F0A6E12F5BAED3D43F9834F4D94B
SHA1:	815BBF09917B4BBF81E82184227B5ECD0B8146BB
SHA-256:	F4A6912D5E559E145C0DC0E33079F856886AD1165BD7773DA037E9E760202232
SHA-512:	DDA08D082DF135515642046CCC337140AC9672296AE8882497E05C29481D41422DA46DA8513B8675320AF91AB33E46B4AAFC02B53EA60FD34A847130AEAFE6B8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d...z.v^.........." ..... ....................@..........................................`.................................................x...x....................................0..8............................................0...............................text............ .................. ..`.rdata..._...0...`...0..............@..@.data...........0..................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B.cwkw...............................@..@.pbpwn..tQ.......`..................@..@.pem....

C:\Users\user\AppData\Local\GsjW\sppsvc.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4527680
Entropy (8bit):	7.180545050051135
Encrypted:	false
SSDEEP:	49152:hzB335WOshFXigiF5l5mpb0+bOnBmB8XEsDfA+uLCKls0did8Pf6ZJ6t3Ovenev1:8X5iFrEpdAkZ6W3xYBP149K
MD5:	FEEC8055C5986182C717DD888000AEF6
SHA1:	7749D1C531D85C69047576B3BB3525E0B01A2942
SHA-256:	E09B7B1DE43A226842A4B8C591D712E51585BC7E8A39CFB8852CBF16D234C3A6
SHA-512:	822869C750682453770C66D7C6665CECCCB0BB27ECEB8E0A9202FE5C194249235928005734504AED79D80583CED2A2F203D4133A11E7F4A8D6160F21F7F3919F
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-..C..C..C...@..C.......C...G...C...F..C...B...C..B...C...J...C...@..C.....C...A..C.Rich.C.........PE..d...A.Lc..........".......8.........P..........@................CS P..........D.....4.E.....................................................\|.A.......D..+....B.4\|...ZD.@....@D..n....?.T....................i:.(....h:.............8i:..............................text...L.7.......7................. ..`?g_Encry.-....7.......7............. ..`?g_Encry\|-... 8.......8............. ..`?g_Encry.....P8..0...<8............. ..`?g_Encry.-....8......l8............. ..`.rdata........8.......8.............@..@.data.........A.......A.............@....pdata..4\|....B..~...BB.............@..@.rsrc....+....D..,....C.............@..@.reloc...n...@D..n....C.............@..B................................................................................................

C:\Users\user\AppData\Local\dfAZPUGwQ\WINSTA.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1380352
Entropy (8bit):	5.021595856508205
Encrypted:	false
SSDEEP:	12288:plORVEAueQmTmQKO2nMlqVaSEwzH7YxiCyJ86azEZy1f11pNx:vORVEVNmaDznMlqVNE27dJ8J2inNx
MD5:	1367EA1D2FB80856D934FC85D5BC1CA3
SHA1:	D32840D9585DC3912CBCDA2ED5B2CD1749EA6F90
SHA-256:	978D7EF5411593FD8A52C4E7139E13BB6F514AFE59D1CE3A51067E8D65959FB4
SHA-512:	B366F6120651CBC4E0F3AC585825D74710C01D3D7EE58F641201383DC2CA6FB6C68B9D06A3880F2FBF2170DD0B07CA8BFF860FC8283629A7B329DC077F2B2F1C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d...z.v^.........." ..... ....................@..........................................`.............................................m...x...x....................................0..8............................................0...............................text............ .................. ..`.rdata..._...0...`...0..............@..@.data...........0..................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B.cwkw...............................@..@.pbpwn..tQ.......`..................@..@.pem....

C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157080
Entropy (8bit):	5.924344092826888
Encrypted:	false
SSDEEP:	3072:4eana1Hze2vHL+u5F28BrciRXBis72z5B+o:Aa1TfD+u5F2wrTio2z2o
MD5:	74D31E4F51873160D91B1F80E0C472D0
SHA1:	35DEC0D1A12C6F1F7A460E3AE75E4D74D5BD815A
SHA-256:	113813A699063EBF391D436A4EFE0B6F95F81E12AF773FABE5511B5CA08E189C
SHA-512:	F026CBBDF3792A05091B3CC0A97F825D353BC5FF9AB7248F4544B81BA2F86FD28CEB04468D755715BB3BD220BB72781DC079423D912A56E3793AC1687AEE7E05
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y_GE.>)..>)..>)..F..Y>).rZ*..>).rZ-..>).rZ,..>).rZ(..>)..>(.9?).rZ'..>).rZ...>).rZ+..>).Rich.>).................PE..d...i.7.........."..........H.......C.........@..................................................... ......................................PP..\...............h....D...!..........0%..T...........................................(...(...HL.......................text............................... ..`.rdata...c.......d..................@..@.data...l............h..............@....pdata..h............j..............@..@.didat...............x..............@...consent.b............z..............@....rsrc................\|..............@..@.reloc...............B..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	210944
Entropy (8bit):	6.120150246944804
Encrypted:	false
SSDEEP:	6144:JXatPVkbIwsNIUwrMWzp3jRiVbsBwnNCm:KacJNmYWzri9I8Y
MD5:	3C21F944D5FF44E45BC753919F6AE445
SHA1:	47D86DB63905203837FEDFF006C20E0717716160
SHA-256:	2952F67C8882C9B1FAF0425C2047613EA147EBE6BE610B174A627B760B5C59F3
SHA-512:	03965F1952AC90D43E579A9ACEC01290134949438C1525B3A3170DC998336C7F20F5650AE27BB428E6ED77810756438CB35D9CDD6B4FB4AF26A332EB8DC23972
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I.%.(.v.(.v.(.v.PDv.(.v.L.w.(.v.L.w.(.v.(.v.).v.L.w.(.v.L.w.(.v.L.w.(.v.L(v.(.v.L.w.(.vRich.(.v........PE..d... -.=.........."......F...........@.........@.....................................R....`.......... ...............................................p.......@..................(...0...T...................Ph..(...Pg..............xh..`...D........................text....E.......F.................. ..`.rdata.......`.......J..............@..@.data........ ......................@....pdata.......@......................@..@.didat..@....`.......&..............@....rsrc........p.......(..............@..@.reloc..(............4..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\oudoiG\VERSION.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1376256
Entropy (8bit):	5.002940406932
Encrypted:	false
SSDEEP:	12288:+lORVEAueQmTmQKO2nMlqVaSEwzH7YxiCyJ86azEZy1f11pNx:CORVEVNmaDznMlqVNE27dJ8J2inNx
MD5:	6A433E0692F93D6EA886128CA048DC76
SHA1:	C2583C249530B63023F3BFD1014B2E21FBFD210B
SHA-256:	7071CEB809E1259B9B7A9EE26059CFFB695597C2554A933DFF933571331CF22E
SHA-512:	520B41951D6E2459B34D69C1C81CFE420EF0D856A34A83573CE54C9F3F208D9AC9D941719C6DD1825E558601FFB8E497B532C79FFB37B118689C34AEC5D4C90F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d...z.v^.........." ..... ....................@..........................................`.............................................+...x...x....................................0..8............................................0...............................text............ .................. ..`.rdata..._...0...`...0..............@..@.data...........0..................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B.cwkw...............................@..@.pbpwn..tQ.......`..................@..@.pem....

C:\Users\user\AppData\Local\s8hTTPzEx\DUI70.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1658880
Entropy (8bit):	5.4487843616720495
Encrypted:	false
SSDEEP:	12288:llORVEAueQmTmQKO2nMlqVaSEwzH7YxiCyJ86azEZy1f11pNx7BK:bORVEVNmaDznMlqVNE27dJ8J2inNx7
MD5:	90CAFAE897080913A8CC42EDD70F1EDD
SHA1:	2CB8E96190567E28223890A7D64D00CEE9DCC202
SHA-256:	3050C8CB5530EF03B66A8D89CC9BE9B83060290FC7B1ADC266AA38E036C566EC
SHA-512:	3665BCE424F86F8CC3AB7E8E1C07A8CC65F5C78C445BB0CB89997A2C3B9190F57CD1489679EDCB312CF992D847D01E0208587A15E1DF9278EFA8E22B82677F96
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d...z.v^.........." ..... ... ................@.............................P............`.............................................dQ..x...x....................................0..8............................................0...............................text............ .................. ..`.rdata..._...0...`...0..............@..@.data...........0..................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B.cwkw...............................@..@.pbpwn..tQ.......`..................@..@.pem....

C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42392
Entropy (8bit):	5.943178981884173
Encrypted:	false
SSDEEP:	768:zYVfzVTBuXwMHhrdXbsxoXF8Q0no8pV1Pxo:CfuXXrdrXXD0no8xPxo
MD5:	6A3F2F3C36FE45A87E3BFA80B6D92E07
SHA1:	8C211767AD8393F9F184FC926FE3B8913F414289
SHA-256:	069608FF0FF5918681A80CF7603275DC6CD7D416A73D033D19962B0F0F1E1EAC
SHA-512:	A75669E0481901FC7CFCA55FBC7BD7FC0E8636767537017A41B1C720F34B5AD45AC75555D0AD246AC0DF670FDC31CBA1BEFD21D63E112AD427472DE3EA59CAA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%7..aV..aV..aV..h.S.cV...2..cV...2..vV...2..kV...2..tV..aV...V...2..oV...2?.`V...2..`V..RichaV..................PE..d...v.+J.........."......6...X.......9.........@.....................................l............... ...................................................................!......,...0t..T...................`d..(...`c...............d..`............................text...{4.......6.................. ..`.imrsiv......P...........................rdata.......`...0...:..............@..@.data...h............j..............@....pdata...............n..............@..@.rsrc................t..............@..@.reloc..,...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\y1c6p\VERSION.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1376256
Entropy (8bit):	5.00289604284856
Encrypted:	false
SSDEEP:	12288:glORVEAueQmTmQKO2nMlqVaSEwzH7YxiCyJ86azEZy1f11pNx:UORVEVNmaDznMlqVNE27dJ8J2inNx
MD5:	9491BB6F5E9F7443CD95617BA713E9AF
SHA1:	E322CBCD1F7789DFF816E1398FCE97925AF34937
SHA-256:	23FA64118E9250A0F0D225A813E5895D0A2260B0D0E8188A54F0EC487BA28C9F
SHA-512:	9DB6159FF7F4834570F7E6CB5F5F25150C3C1834C859220C9ABA13D53499EDFEA9593DF0EAFA9C2D72D56EB24F62AFB4584F8491D2E1A5ECA654C103070CDEC2
Malicious:	false
Preview:	MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d...z.v^.........." ..... ....................@..........................................`.............................................+...x...x....................................0..8............................................0...............................text............ .................. ..`.rdata..._...0...`...0..............@..@.data...........0..................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B.cwkw...............................@..@.pbpwn..tQ.......`..................@..@.pem....

C:\Users\user\AppData\Local\y1c6p\cmstp.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	5.749238064237604
Encrypted:	false
SSDEEP:	1536:7oIXq0f2yF9sDb/RjxgnvkmVUqAVnKUMjbWg+I/87BM/Z4j8Qi1Yv9V:0Izw/RooolWIk7BM/ZNQi1EV
MD5:	2A9828E0C405422D166E0141054A04B3
SHA1:	84AA48946D4F9A9DFE4C1AF6F96C44B643229A73
SHA-256:	94152FB98573FE31C0CE49D260D760DD173741D663414DE718A37AAC7E8EF11F
SHA-512:	B9B0472706C11D3AECDAB055D4CF319EDD50E8C97B7099D1DC7B768812E804975392E327A1E62301077AB92C1CA97E706628B07172892AB09753FBDD9A07277D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l....X...X...X...Y...X...Y...X...Y...X...Y...X...XQ..X...Y...X...X...X...Y...XRich...X................PE..d....mg..........."............................@..........................................`.......... .......................................M...............p..................X....B..T...............................................H............................text............................... ..`.rdata.."l.......n..................@..@.data........`.......R..............@....pdata.......p.......T..............@..@.rsrc................Z..............@..@.reloc..X............h..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	1450
Entropy (8bit):	7.3483724297376805
Encrypted:	false
SSDEEP:	24:U+zDBW7TtU5LZ0Ezzo0VOb2T82x+wgNK5tb9H9aV4++kKI77oZBZtxUxsw:UADgTtU70E7L82xZHH2z+kKI7qUxN
MD5:	86C68B8FD1449527DE2236FF9203D1A8
SHA1:	5678A470E16DE0815D29B463CD32B31FEEB97013
SHA-256:	A6F04F4EEFBE8055640DF7FD0EFCA410663F76AA9D746EC32A9BAF1A24F76BC0
SHA-512:	97DCBAA0FFF2F31CC55095891F6B02FDA48E2F8E50B4BFD79E0F60715BD6689F45AC48025BA4512F396ECBD4E3D816169C07E8E9364158135D17548E0BDB938B
Malicious:	false
Preview:	........................................user.....................RSA1................m.......#....x.<K.6..Wt.KJ...{@{\.!....?...#..(Z.`.OPD":.A.`%./I....QI.p....?.\|<A"$F8....v~.B.A....f.q....1...8..,K6..(O.......................z..O.............C.^.........,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ...da...\|.y....[..nh.R...8.... E............... ...w.tC..()........'x..>... ........^..F.....\.E.Q.g......"..m.B.q.<\|...p..<..9....2X.j.u.0i...y.r.../...?O....J...w....p-P{.Y.au...`..._-f...d.n3BY...TS^....g.1.....N...c....W........'......B...g...IS......9F........O...z.m....(;^...\|....U.....;."..)..r%..".i....V...._.p.........=e..._.b.H.W.VN..D.9....S.....n.......=O}.N..).S..6.Wj.U..d.0...T^ fGy....n..R........Z....z.Y$....Y(X..\|.>..+dK,F.k..%4..@...E.~....(....v.A...9.......a..[...{Y...&.....:...wH._.3.3.3$YR-n.$aA.3............G;..uT",d.........z...7mz............ru.y...>....X.K..y.R.^...>....u\|&~Y8..*.x..bP......I...........5.'.

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	5.013513255725167
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	dry.dll
File size:	1372160
MD5:	4bec705de3584b911018c84f31659a17
SHA1:	b29ff37578ef950b702ec5db59161294c2e1a7b3
SHA256:	13aa6bed5b3a656b9c86cc2d397f765779f4a7dff49f73d58bd97e11423e0635
SHA512:	5841f5d288fa4496391fa008326d15ac9abc644c07bf970b20fd1ed2719d5ce01c457d84d17fc8025ff801d7aaec371ee2b6504cabab853d02fb6c1ad49ec423
SSDEEP:	12288:6lORVEAueQmTmQKO2nMlqVaSEwzH7YxiCyJ86azEZy1f11pNx:uORVEVNmaDznMlqVNE27dJ8J2inNx
File Content Preview:	MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb......qb.;...{qb......qb

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x140042ad0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5E76817A [Sat Mar 21 21:04:58 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	a272733471032e2064bf69c66a9c775a

Entrypoint Preview

Instruction
dec eax
mov dword ptr [0006E699h], ecx
dec eax
lea ecx, dword ptr [FFFFEA62h]
dec esp
mov dword ptr [0006E6ABh], eax
dec esp
mov dword ptr [0006E6B4h], edi
dec esp
mov eax, esi
dec eax
mov dword ptr [0006E6B2h], eax
dec eax
mov eax, 00001204h
dec eax
add ecx, eax
dec esp
mov dword ptr [0006E6B1h], esp
dec eax
sub ecx, 00001204h
dec eax
mov dword ptr [0006E6ABh], esi
dec eax
test eax, eax
je 00007F28489BF6D0h
dec eax
mov eax, ecx
dec eax
mov dword ptr [0006E664h], esp
dec eax
mov dword ptr [0006E655h], ebp
dec eax
mov dword ptr [0006E69Eh], ebx
dec eax
mov dword ptr [0006E68Fh], edi
dec eax
test eax, eax
je 00007F28489BF6ACh
dec esp
mov dword ptr [0006E653h], ecx
dec esp
mov dword ptr [0006E664h], ebp
dec eax
mov dword ptr [0006E625h], edx
jmp eax
dec eax
add edi, ecx
retn 0008h
ud2
int3
int3
int3
push esi
dec eax
sub esp, 70h
dec eax
lea eax, dword ptr [FFFF9F34h]
dec eax
mov edx, dword ptr [esp+60h]
dec ecx
mov eax, edx
dec ecx
and eax, 7C240CB9h
dec esp
mov dword ptr [esp+60h], eax
dec eax
mov dword ptr [esp+50h], 0B39C477h
dec ecx
mov eax, edx
dec ecx
xor eax, FFFFFFFFh
dec esp
mov dword ptr [esp+60h], eax
mov word ptr [eax+eax+00h], 0000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xa8dd7	0x12e	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa8578	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbd000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1000	0x0	.text
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbe000	0xdfc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x430b0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x43000	0xa8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x41ebf	0x42000	False	0.781523733428	data	7.76153125253	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x43000	0x65f05	0x66000	False	0.697476256127	data	7.85586414334	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa9000	0x12a18	0x13000	False	0.0770841899671	data	2.46325796792	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0xbc000	0x144	0x1000	False	0.062744140625	data	0.615463451963	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xbd000	0x7af	0x1000	False	0.117919921875	data	1.08794585954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbe000	0xdfc	0x1000	False	0.39990234375	data	5.20528905542	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.cwkw	0xbf000	0xbf6	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pbpwn	0xc0000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pem	0x106000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vpd	0x107000	0x1278	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ianurq	0x109000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xbd0a0	0x2dc	data	English	United States
RT_MANIFEST	0xbd380	0x56	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
SHLWAPI.dll	ChrCmpIW, UrlIsOpaqueW
GDI32.dll	GetPolyFillMode, CreateBitmapIndirect
USER32.dll	WaitForInputIdle, GetFocus, GetParent, LookupIconIdFromDirectoryEx
ADVAPI32.dll	GetServiceDisplayNameW
KERNEL32.dll	HeapUnlock, TerminateJobObject, DeleteTimerQueue, GetNamedPipeServerProcessId, GetConsoleFontSize, GetFileInformationByHandle, GetThreadLocale

Exports

Name	Ordinal	Address
CreateXmlReader	1	0x140034b28
CreateXmlReaderInputWithEncodingCodePage	2	0x140005f28
CreateXmlReaderInputWithEncodingName	3	0x1400203d0
CreateXmlWriter	4	0x140037b74
CreateXmlWriterOutputWithEncodingCodePage	5	0x140015b64
CreateXmlWriterOutputWithEncodingName	6	0x14001f778

Version Infos

Description	Data
LegalCopyright	Copyright 2005-2007 Mark Russinovich
InternalName	streams
FileVersion	1.56
CompanyName	Sysinternals
ProductName	Sysinternals Streams
ProductVersion	1.56
FileDescription	streams
OriginalFilename	streams.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
02/20/22-08:22:03.280642	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.1	192.168.2.3

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 20, 2022 08:22:56.190840960 CET	56176	53	192.168.2.3	8.8.8.8
Feb 20, 2022 08:22:57.182591915 CET	56176	53	192.168.2.3	8.8.8.8
Feb 20, 2022 08:22:58.182760000 CET	56176	53	192.168.2.3	8.8.8.8
Feb 20, 2022 08:23:00.198551893 CET	56176	53	192.168.2.3	8.8.8.8
Feb 20, 2022 08:23:04.214570999 CET	56176	53	192.168.2.3	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 20, 2022 08:22:56.190840960 CET	192.168.2.3	8.8.8.8	0x95f5	Standard query (0)	canonicalizer.ucsuri.tcs	A (IP address)	IN (0x0001)
Feb 20, 2022 08:22:57.182591915 CET	192.168.2.3	8.8.8.8	0x95f5	Standard query (0)	canonicalizer.ucsuri.tcs	A (IP address)	IN (0x0001)
Feb 20, 2022 08:22:58.182760000 CET	192.168.2.3	8.8.8.8	0x95f5	Standard query (0)	canonicalizer.ucsuri.tcs	A (IP address)	IN (0x0001)
Feb 20, 2022 08:23:00.198551893 CET	192.168.2.3	8.8.8.8	0x95f5	Standard query (0)	canonicalizer.ucsuri.tcs	A (IP address)	IN (0x0001)
Feb 20, 2022 08:23:04.214570999 CET	192.168.2.3	8.8.8.8	0x95f5	Standard query (0)	canonicalizer.ucsuri.tcs	A (IP address)	IN (0x0001)

Target ID:	0
Start time:	08:20:05
Start date:	20/02/2022
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\dry.dll"
Imagebase:	0x7ff7d9bf0000
File size:	140288 bytes
MD5 hash:	4E8A40CAD6CCC047914E3A7830A2D8AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: crime_win64_dridex_bot_hook, Description: Detects latest Dridex bot hook, Source: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Author: @VK_Intel
Reputation:	moderate

Show Windows behavior

Target ID:	1
Start time:	08:20:05
Start date:	20/02/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dry.dll",#1
Imagebase:	0x7ff6b94e0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	08:20:05
Start date:	20/02/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReader
Imagebase:	0x7ff694030000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000003.00000002.366937086.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: crime_win64_dridex_bot_hook, Description: Detects latest Dridex bot hook, Source: 00000003.00000002.366937086.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Author: @VK_Intel
Reputation:	high

Show Windows behavior

Target ID:	4
Start time:	08:20:06
Start date:	20/02/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\dry.dll",#1
Imagebase:	0x7ff694030000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.289927845.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: crime_win64_dridex_bot_hook, Description: Detects latest Dridex bot hook, Source: 00000004.00000002.289927845.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Author: @VK_Intel
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	08:20:07
Start date:	20/02/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	08:20:09
Start date:	20/02/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReaderInputWithEncodingCodePage
Imagebase:	0x7ff694030000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000006.00000002.296790826.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: crime_win64_dridex_bot_hook, Description: Detects latest Dridex bot hook, Source: 00000006.00000002.296790826.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Author: @VK_Intel
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	08:20:12
Start date:	20/02/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\dry.dll,CreateXmlReaderInputWithEncodingName
Imagebase:	0x7ff694030000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000008.00000002.305054509.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: crime_win64_dridex_bot_hook, Description: Detects latest Dridex bot hook, Source: 00000008.00000002.305054509.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Author: @VK_Intel
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	08:20:45
Start date:	20/02/2022
Path:	C:\Windows\System32\consent.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\consent.exe
Imagebase:	0x7ff6b4af0000
File size:	157080 bytes
MD5 hash:	74D31E4F51873160D91B1F80E0C472D0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	13
Start time:	08:20:46
Start date:	20/02/2022
Path:	C:\Users\user\AppData\Local\DLKXiO\consent.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\DLKXiO\consent.exe
Imagebase:	0x7ff679f90000
File size:	157080 bytes
MD5 hash:	74D31E4F51873160D91B1F80E0C472D0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Target ID:	14
Start time:	08:20:47
Start date:	20/02/2022
Path:	C:\Windows\System32\SysResetErr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SysResetErr.exe
Imagebase:	0x7ff67d350000
File size:	42392 bytes
MD5 hash:	6A3F2F3C36FE45A87E3BFA80B6D92E07
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	15
Start time:	08:20:52
Start date:	20/02/2022
Path:	C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe
Imagebase:	0x7ff67a420000
File size:	42392 bytes
MD5 hash:	6A3F2F3C36FE45A87E3BFA80B6D92E07
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000000F.00000002.410915340.00007FFC67DE1000.00000020.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: crime_win64_dridex_bot_hook, Description: Detects latest Dridex bot hook, Source: 0000000F.00000002.410915340.00007FFC67DE1000.00000020.00000001.01000000.00000009.sdmp, Author: @VK_Intel
Reputation:	moderate

Show Windows behavior

Target ID:	19
Start time:	08:21:04
Start date:	20/02/2022
Path:	C:\Windows\System32\consent.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\consent.exe
Imagebase:	0x7ff6b4af0000
File size:	157080 bytes
MD5 hash:	74D31E4F51873160D91B1F80E0C472D0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	23
Start time:	08:21:06
Start date:	20/02/2022
Path:	C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe
Imagebase:	0x7ff60d120000
File size:	157080 bytes
MD5 hash:	74D31E4F51873160D91B1F80E0C472D0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Target ID:	24
Start time:	08:21:07
Start date:	20/02/2022
Path:	C:\Windows\System32\rdpshell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rdpshell.exe
Imagebase:	0x7ff7f9220000
File size:	463872 bytes
MD5 hash:	4994A0ADA359924026FE631E54FC7A5D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	25
Start time:	08:21:07
Start date:	20/02/2022
Path:	C:\Windows\System32\cmstp.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmstp.exe
Imagebase:	0x7ff67f360000
File size:	92672 bytes
MD5 hash:	2A9828E0C405422D166E0141054A04B3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	27
Start time:	08:21:10
Start date:	20/02/2022
Path:	C:\Users\user\AppData\Local\y1c6p\cmstp.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\y1c6p\cmstp.exe
Imagebase:	0x7ff768f80000
File size:	92672 bytes
MD5 hash:	2A9828E0C405422D166E0141054A04B3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001B.00000002.448574954.00007FFC6E291000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: crime_win64_dridex_bot_hook, Description: Detects latest Dridex bot hook, Source: 0000001B.00000002.448574954.00007FFC6E291000.00000020.00000001.01000000.0000000C.sdmp, Author: @VK_Intel

Show Windows behavior

Target ID:	28
Start time:	08:21:21
Start date:	20/02/2022
Path:	C:\Windows\System32\SystemPropertiesComputerName.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SystemPropertiesComputerName.exe
Imagebase:	0x7ff649f80000
File size:	83968 bytes
MD5 hash:	BEE134E1F23AFD3AE58191D265BB9070
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	29
Start time:	08:21:22
Start date:	20/02/2022
Path:	C:\Windows\System32\DWWIN.EXE
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DWWIN.EXE
Imagebase:	0x7ff7bd670000
File size:	210944 bytes
MD5 hash:	3C21F944D5FF44E45BC753919F6AE445
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	30
Start time:	08:21:23
Start date:	20/02/2022
Path:	C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE
Imagebase:	0x7ff7eae80000
File size:	210944 bytes
MD5 hash:	3C21F944D5FF44E45BC753919F6AE445
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001E.00000002.477365919.00007FFC6E291000.00000020.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: crime_win64_dridex_bot_hook, Description: Detects latest Dridex bot hook, Source: 0000001E.00000002.477365919.00007FFC6E291000.00000020.00000001.01000000.0000000E.sdmp, Author: @VK_Intel

Show Windows behavior

Target ID:	32
Start time:	08:21:35
Start date:	20/02/2022
Path:	C:\Windows\System32\SystemPropertiesDataExecutionPrevention.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
Imagebase:	0x7ff74d1b0000
File size:	83968 bytes
MD5 hash:	1A34577AEDE83993615D7F2E37024D4D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	33
Start time:	08:21:36
Start date:	20/02/2022
Path:	C:\Windows\System32\sppsvc.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\sppsvc.exe
Imagebase:
File size:	4527680 bytes
MD5 hash:	FEEC8055C5986182C717DD888000AEF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	35
Start time:	08:21:39
Start date:	20/02/2022
Path:	C:\Users\user\AppData\Local\GsjW\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\GsjW\sppsvc.exe
Imagebase:	0x7ff6a21c0000
File size:	4527680 bytes
MD5 hash:	FEEC8055C5986182C717DD888000AEF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000023.00000002.514434351.00007FFC6E291000.00000020.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: crime_win64_dridex_bot_hook, Description: Detects latest Dridex bot hook, Source: 00000023.00000002.514434351.00007FFC6E291000.00000020.00000001.01000000.00000010.sdmp, Author: @VK_Intel
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Show Windows behavior

Target ID:	36
Start time:	08:21:52
Start date:	20/02/2022
Path:	C:\Windows\System32\SndVol.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\SndVol.exe
Imagebase:
File size:	259904 bytes
MD5 hash:	CDD7C7DF2D0859AC3F4088423D11BD08
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	37
Start time:	08:21:53
Start date:	20/02/2022
Path:	C:\Users\user\AppData\Local\0rPbJb\SndVol.exe
Wow64 process (32bit):
Commandline:	C:\Users\user\AppData\Local\0rPbJb\SndVol.exe
Imagebase:
File size:	259904 bytes
MD5 hash:	CDD7C7DF2D0859AC3F4088423D11BD08
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, Virustotal, Browse Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Show Windows behavior

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	41.8%
Total number of Nodes:	419
Total number of Limit Nodes:	46

Executed Functions

Function 00007FFC682E1FE0 Relevance: 7.1, Strings: 5, Instructions: 815COMMON

Download Yara Rule

Strings

f+/), xrefs: 00007FFC682E29A9
f+/), xrefs: 00007FFC682E27CE
f+/), xrefs: 00007FFC682E29F0
f+/), xrefs: 00007FFC682E26F0
f+/), xrefs: 00007FFC682E298F

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: f+/)$f+/)$f+/)$f+/)$f+/)
API String ID: 0-3376796891
Opcode ID: 480604aad73d94ddbaf7b6e5243b48039f0893af9bdccec418bdc49616eae952
Instruction ID: 319897a27af10340b8f527979a0e2fbfe070a4edcdc3fe7e04e6451d3175f51e
Opcode Fuzzy Hash: 480604aad73d94ddbaf7b6e5243b48039f0893af9bdccec418bdc49616eae952
Instruction Fuzzy Hash: AF72D0A2A0C7AAC5EA248B15D4483B927A1FF89F88F455035DA0E077D5DF3CD942C3B8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682D8990 Relevance: 5.0, APIs: 2, Instructions: 2011COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394ae3f47238bbd20f0c386901f1ae5cf8dae6134b138aadd1da20cdb9795a07
Instruction ID: 2ed130d357c7128fb3654e54f8a1c63a69bfc5a5f84e48e31e48acfb7d4ff161
Opcode Fuzzy Hash: 394ae3f47238bbd20f0c386901f1ae5cf8dae6134b138aadd1da20cdb9795a07
Instruction Fuzzy Hash: 1903C126A0C7A9C6EB649B1594502BA3BE1FF85B8CF884031DA0E077D6DF3CE555C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682EDBE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileExW.KERNELBASE ref: 00007FFC682EDC3D

Strings

., xrefs: 00007FFC682EDCBA

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: af602f8658dc6b56f451c485c3cbb8058e6669dd281f78fd19427731c48b0698
Instruction ID: 6d083f9d7ad469d3e25b8e9080bbf16e6145d5ec835b330c61a6c91035fcd670
Opcode Fuzzy Hash: af602f8658dc6b56f451c485c3cbb8058e6669dd281f78fd19427731c48b0698
Instruction Fuzzy Hash: F4416021A0C25A81FB145A28D10437963A19F84BECF585631CE6D072D9DFBCE882C778

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B6190 Relevance: 2.9, Strings: 2, Instructions: 383
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)8GV, xrefs: 00007FFC682B664D
)8GV, xrefs: 00007FFC682B6569

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV
API String ID: 0-993736920
Opcode ID: f05420cdb7c5b4e0dafb6db1fd65c81427849b2ccb0d5e4a363e901e39f8afe4
Instruction ID: abe3d8384e219c83e2ac80c80700b84b615d678836f63b47c393522f999891aa
Opcode Fuzzy Hash: f05420cdb7c5b4e0dafb6db1fd65c81427849b2ccb0d5e4a363e901e39f8afe4
Instruction Fuzzy Hash: 99F18062B1C96AD4EB50EB61D8912FD2760EF9478CF800432EA4E879DAEF3CD545C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682ECC90 Relevance: 2.4, APIs: 1, Instructions: 886COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 00007FFC682EDA51

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 23153f63af2b86541570a38ac166eb529bc1bd4c00964222bdc21895722ba318
Instruction ID: 2a7ad0a268f2e6d96cfddc5ed2403025e6025293fd5dd26e87bb31c4dc348e8f
Opcode Fuzzy Hash: 23153f63af2b86541570a38ac166eb529bc1bd4c00964222bdc21895722ba318
Instruction Fuzzy Hash: DA82BD62A0C7A9C6EB608B19D4542B977E1FF85B88F884431CA4D077D6DF3CE942C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682DB120 Relevance: 2.3, APIs: 1, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c35e989a891b50527dcb3e3c96e6aa52ff6585637435a49d30dc3fcc12fc07c
Instruction ID: 3e5ebca03cbcc09de3f7694710b618f1ee01f3b02ae55bdb0c0c1fb0e76d3aef
Opcode Fuzzy Hash: 3c35e989a891b50527dcb3e3c96e6aa52ff6585637435a49d30dc3fcc12fc07c
Instruction Fuzzy Hash: 9972AD22A0C7A9C6EB658B1594643B93BE1FF85B88F884035CA4D077D6DF3CE945C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682FBF20 Relevance: 1.7, APIs: 1, Instructions: 237
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007FFC682FBFC0

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 8fbe0ac22dc4177ed469b18557b505728d9322c9645c83309d9e86941306a441
Instruction ID: 9acb5aa2884e2cb8d98654685e1a67a0fe5f6f1a61a2f6a84d51f11e64193911
Opcode Fuzzy Hash: 8fbe0ac22dc4177ed469b18557b505728d9322c9645c83309d9e86941306a441
Instruction Fuzzy Hash: ADB18B36A4866ADAE750EB25D1402BE37A0FF48B8CF404435EA4E47BD5DF38E424C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C4310 Relevance: 1.7, APIs: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFC682D6070: NtClose.NTDLL ref: 00007FFC682D6099

ExitProcess.KERNEL32 ref: 00007FFC682C45B1

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: CloseExitProcess
String ID:
API String ID: 3487036407-0
Opcode ID: 3fc01bab2dafcec1388d4a1be2fb1d8df57dcc2a7c6cc0993522a4f14ea4eead
Instruction ID: 62315ca023885488dcd32d6fff280f35cec8fd68566902d05205b9980741b596
Opcode Fuzzy Hash: 3fc01bab2dafcec1388d4a1be2fb1d8df57dcc2a7c6cc0993522a4f14ea4eead
Instruction Fuzzy Hash: 64811D22F1CA66D5FB60EBA1D4512FE23A5AF9435CF814031EE0D979CADF28E505C3A4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682D7EA0 Relevance: 1.7, APIs: 1, Instructions: 185
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 00007FFC682D80BE

Part of subcall function 00007FFC682EDB40: FindNextFileW.KERNELBASE(?,?,D7C34164,00007FFC682D7FDE), ref: 00007FFC682EDB6B

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: FileFindLoadNext
String ID:
API String ID: 50669962-0
Opcode ID: e5d8b990709b64687c2823f54e2e9fe3c05d54d7ad96fe5c4900ad0bee84abfd
Instruction ID: e20c19ff0dc92c6aaa21565bc3642fbb9481e46a2ac1549614fafc37aaa8b56f
Opcode Fuzzy Hash: e5d8b990709b64687c2823f54e2e9fe3c05d54d7ad96fe5c4900ad0bee84abfd
Instruction Fuzzy Hash: 79819022A2C5AAD1FB50EB20D4512BE67A5FF8434CF805131EA4D479CAEE7CD509C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682D6070 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMONLIBRARYCODE

Download Yara Rule

APIs

NtClose.NTDLL ref: 00007FFC682D6099

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 3109ecfdde74783f49d8cca167d899ddf147d6577d1b25538b452d016e429314
Instruction ID: 33284e7cda2196c6f517e40e0bee2605e53be23a0621686006428c2b06f1c7f0
Opcode Fuzzy Hash: 3109ecfdde74783f49d8cca167d899ddf147d6577d1b25538b452d016e429314
Instruction Fuzzy Hash: EED02B60E1DA05C1FF102771A44137423C1DFA8349F080030CA0C0B3C2DE3DA4468334

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F6610 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a1dfa248ccb54f18a45c945ff9312bd4c08851b9d9ada40c1ba5a4a16e371c
Instruction ID: fc7991813fb5005006f18e85cb0c9105f572d34accc9304b39f48138a51d7eff
Opcode Fuzzy Hash: a6a1dfa248ccb54f18a45c945ff9312bd4c08851b9d9ada40c1ba5a4a16e371c
Instruction Fuzzy Hash: AA61E420A1C65AD1FAA4A722956057A5791EFC43A8F984334EF2D43BC6FF3CE805C634

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C3940 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 717d4ec3b735092e53a72d35c3ed561355d52b27779c6b4bb118a1ea043fe421
Instruction ID: 4e7035f33e74af5a8f70a9a8be1039200212be35d4b67b0b9fec905ba147ad20
Opcode Fuzzy Hash: 717d4ec3b735092e53a72d35c3ed561355d52b27779c6b4bb118a1ea043fe421
Instruction Fuzzy Hash: 82718E22B1C66AC5FB50EB60E4842FE6BA1BF8434CF840435DA4D43ADADF78E445C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F1D40 Relevance: 6.3, APIs: 4, Instructions: 289
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00007FFC682F1E39
RegEnumKeyW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00007FFC682F1E94
RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00007FFC682F1F19
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002,?), ref: 00007FFC682F2044

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: Close$EnumOpen
String ID:
API String ID: 138425441-0
Opcode ID: df4a5dbd81014694497352d8d20fa832390753a08ed0c24c30b36aa7ede405c4
Instruction ID: 26402f22c94ff9fbb596e0b32ea0960430b2a378100fc3498dc99de9d41bca5d
Opcode Fuzzy Hash: df4a5dbd81014694497352d8d20fa832390753a08ed0c24c30b36aa7ede405c4
Instruction Fuzzy Hash: 02C12862A0C3AAC2EE609B15E45037A6790EFC57A4F844231EA6D437C6EF3CE845C724

Uniqueness

Uniqueness Score: -1.00%

Function 000001D745962254 Relevance: 6.2, APIs: 4, Instructions: 230
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001D7459623B2
VirtualProtect.KERNELBASE ref: 000001D745962476
RtlAvlRemoveNode.NTDLL ref: 000001D7459625B8
VirtualProtect.KERNELBASE ref: 000001D74596267E

Memory Dump Source

Source File: 00000000.00000002.310933520.000001D745960000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001D745960000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d745960000_loaddll64.jbxd

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 5be500564576e27efb21694368d3cfa9554e3f10a740d94740bbe2c04abcc7cb
Instruction ID: 0d0592a4fd77b06a4ea283a60010271c8402074ee16cbe54f2549851f6a9e447
Opcode Fuzzy Hash: 5be500564576e27efb21694368d3cfa9554e3f10a740d94740bbe2c04abcc7cb
Instruction Fuzzy Hash: 7AB15376618BC586DB70CB1AE440BDEB7A1F7C9B80F108126EE8957F98DB79C8458F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C6000 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFC682C612F

Strings

d, xrefs: 00007FFC682C6116
)8GV, xrefs: 00007FFC682C60EC

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: ConsoleFree
String ID: )8GV$d
API String ID: 771614528-3589632123
Opcode ID: ca8963787b58e29caee6cf2aba5209661e7e797118522b132cce36d1b824dca3
Instruction ID: 33a771fb74d114fb32bcc40daf45d77be100c6603fa4017bf146bd02fdfde2dd
Opcode Fuzzy Hash: ca8963787b58e29caee6cf2aba5209661e7e797118522b132cce36d1b824dca3
Instruction Fuzzy Hash: B091F121B1C61AC2EA80AB60E0911BE6391FFC8758F944135EB5D877DADE7CE805C3B4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682D6340 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32 ref: 00007FFC682D63BE

Strings

th4K, xrefs: 00007FFC682D6380
19, xrefs: 00007FFC682D64C1

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID: th4K$19
API String ID: 3545744682-895195625
Opcode ID: 9d49f1fbe01acc43c6f690d39a16111ac260606b07324e3bc5968d82625daf26
Instruction ID: 6893e6d4c16e4d430f5966f002cd959fb07ba107afd00faa13da35de7a91d2ba
Opcode Fuzzy Hash: 9d49f1fbe01acc43c6f690d39a16111ac260606b07324e3bc5968d82625daf26
Instruction Fuzzy Hash: 9AA1A162B1CA5AD9EB10EB70C0912FD2761BF8474CF801531EE0D57ADAEE78E509C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682EE420 Relevance: 3.1, APIs: 2, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2794dbadae1738f632839e7e25b10b57cc5617e6805f9af43153bbc1487dd3
Instruction ID: e17f40c17f7d6d8607a7a4e7423fe2a9d19289c605d1e3f998b8e383f32d1b35
Opcode Fuzzy Hash: ea2794dbadae1738f632839e7e25b10b57cc5617e6805f9af43153bbc1487dd3
Instruction Fuzzy Hash: 76510125B0C66BC2FA609B61A4443BA6791BF8478CF944435DA4D07BC1EE3DE806C37C

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682EE670 Relevance: 3.1, APIs: 2, Instructions: 115
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE ref: 00007FFC682EE736
ReadFile.KERNELBASE ref: 00007FFC682EE7A4

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 965852992de9e6e3044a28c083680b4a7b138a7b4c24391a0fca253c9c8c351e
Instruction ID: 311b7eb41d3686738596bd6c14f8aa6e233cdc7988e184c37b6a6e1b6fffeabc
Opcode Fuzzy Hash: 965852992de9e6e3044a28c083680b4a7b138a7b4c24391a0fca253c9c8c351e
Instruction Fuzzy Hash: 3141DD29E1C6AAD2EA40EB25A04017E63D5EF84788F940135EA4E477D9DF3CE403CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F16F0 Relevance: 3.1, APIs: 2, Instructions: 76
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFC682D7CED), ref: 00007FFC682F1765
RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFC682D7CED), ref: 00007FFC682F17C8

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 16b26d6c896f6fa4616d6a71bfc56c354d89df3ff3d6af8eb17e2b444903a025
Instruction ID: 98ab85384a96b7255deed75dc7a30dc04072422bc8d4040e69a5019a83308824
Opcode Fuzzy Hash: 16b26d6c896f6fa4616d6a71bfc56c354d89df3ff3d6af8eb17e2b444903a025
Instruction Fuzzy Hash: 1321E462B5D69582EE55CB51E40013AA790EFC57E4F884231EE4C07BD8EF3CD482CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F0730 Relevance: 1.6, APIs: 1, Instructions: 144
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE ref: 00007FFC682F088E

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 9538289f8185c155a084e6590f3687c4e82028a9d15f68e794a6645c430656ab
Instruction ID: faf751508cc7db4a1ff454fdaa1a9492237a4d9be532fcf4ed91e07267762fdd
Opcode Fuzzy Hash: 9538289f8185c155a084e6590f3687c4e82028a9d15f68e794a6645c430656ab
Instruction Fuzzy Hash: 1551B832B4C62ACAFB54AB6194112BD67D1AF88B48F580435DE4D477C6EF38E801C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F0370 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FFC682F03CB

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 862668677c52d1f3e921be35dc8d126f82c753b8d30067e3a20c2e66dcebf74c
Instruction ID: 0643168d98e4ba76c2b854e83ac65e195dd5e94b19a6144204fec1ec249f288a
Opcode Fuzzy Hash: 862668677c52d1f3e921be35dc8d126f82c753b8d30067e3a20c2e66dcebf74c
Instruction Fuzzy Hash: 2D218E3260CB5AD2EA10EF65E1500AA77A0FF88788F944535DB8C07B85EF7CE525C798

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682EE4F9 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC682EE8B1), ref: 00007FFC682EE59C

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 43c89e2823faadb45905163f39a662362428de14ecf5d1551f9feaedd7c39631
Instruction ID: 9a98527c68702a62d0f3aeb107aed7b3c9d5faab198414509ca84a688d9ff172
Opcode Fuzzy Hash: 43c89e2823faadb45905163f39a662362428de14ecf5d1551f9feaedd7c39631
Instruction Fuzzy Hash: A611B2A6A0C65EC6EA709B11A0453BA6391BF84788F940535DA5E077C1EF3CE406C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682EDB40 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,D7C34164,00007FFC682D7FDE), ref: 00007FFC682EDB6B

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: fdce1fadeb3f45b2cde08bed8a1d21414a5687aa25c80ef2bc3efa72baa5b526
Instruction ID: 7534670fa6fc365896ff5a3e104c8e951de466782a4194cea1111b6e57aeabad
Opcode Fuzzy Hash: fdce1fadeb3f45b2cde08bed8a1d21414a5687aa25c80ef2bc3efa72baa5b526
Instruction Fuzzy Hash: 5B1130A1E1C25A82FF649B2991552B913E2AF9478CF441038DE4C472C5EF6CE896C77C

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682EE512 Relevance: 1.6, APIs: 1, Instructions: 51filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC682EE8B1), ref: 00007FFC682EE59C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC682EE8B1), ref: 00007FFC682EE62A

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 3304dbe52edba5308dda95b44dbd259358377a73301d273e701d5f6ab0c2530a
Instruction ID: 05fe5cd70006ad0ccbe5e2705587d44b5e277a64122a34ad05408955eea999f4
Opcode Fuzzy Hash: 3304dbe52edba5308dda95b44dbd259358377a73301d273e701d5f6ab0c2530a
Instruction Fuzzy Hash: 2F11C6A6A0C65EC6E6609B11A0453BA63D1BF84788F580135DB8E077C1EF3CE406C77C

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682EE528 Relevance: 1.6, APIs: 1, Instructions: 50filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC682EE8B1), ref: 00007FFC682EE59C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC682EE8B1), ref: 00007FFC682EE62A

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: ca5d1eb978d7ec9a7d954c8b95fba2893bd821786bb6015228d7770952683646
Instruction ID: ea3f4942e4d9e5cc49b641f92c5346c6b4ee86134dc615e4e03f8ef088af2e37
Opcode Fuzzy Hash: ca5d1eb978d7ec9a7d954c8b95fba2893bd821786bb6015228d7770952683646
Instruction Fuzzy Hash: 2211A0A6A0C66EC6E6709B1160457BA6391BF84788F581135DB8E037C1EF3CE406C2B8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682EE538 Relevance: 1.5, APIs: 1, Instructions: 47filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC682EE8B1), ref: 00007FFC682EE59C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC682EE8B1), ref: 00007FFC682EE62A

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 55f9995db818072b88c6077fddabbc06cfbed2c75455add3a066083054c07255
Instruction ID: 3d643651b9425fdacd5708d5d490b73bbcf928756ab191a90cf6f3eda1fefc0a
Opcode Fuzzy Hash: 55f9995db818072b88c6077fddabbc06cfbed2c75455add3a066083054c07255
Instruction Fuzzy Hash: C2018EA6A1C65EC5EA609B11B0147BA6391BF84788F981135DB8E077C1EF3CE446C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F1580 Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32 ref: 00007FFC682F15F6

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 9a5348946385674cb3b67b767ff83c8b37964fcb986c50957ca30d2b47ffed43
Instruction ID: b5af4fa519b190cb5362a68cab6c529995850423a022b4c2c9142227c6411843
Opcode Fuzzy Hash: 9a5348946385674cb3b67b767ff83c8b37964fcb986c50957ca30d2b47ffed43
Instruction Fuzzy Hash: 94115172608B85C6D7208F02F40059AB7A4FB88B84FA84135EF8D03B48DF39E991CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682D59F0 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlCreateHeap.NTDLL ref: 00007FFC682D5A3D

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 28e091359616bcc0756b8dbb98851b7a34b4384a0fe2660f877d6e9e217fdbd6
Instruction ID: c604e15b7c9fcdae1d1bbee666bc9d2c2fced1049a88c16effb5c4e3f6c361ba
Opcode Fuzzy Hash: 28e091359616bcc0756b8dbb98851b7a34b4384a0fe2660f877d6e9e217fdbd6
Instruction Fuzzy Hash: A101F731A1CA65C2E6618750F9512357795EF883C4F588234DE4C077D9DE3CD416CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682D5A90 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

RtlDeleteBoundaryDescriptor.NTDLL ref: 00007FFC682D5AEC

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: BoundaryDeleteDescriptor
String ID:
API String ID: 3203483114-0
Opcode ID: ce8d07d80f22f244616ce11df2c88dd4e268c15b1145ceb92eaa2a040a8f6ce2
Instruction ID: f6ab0f017c17b1d62eee6877320db8fd58c9452aa1aa9dd072090dd701be10fb
Opcode Fuzzy Hash: ce8d07d80f22f244616ce11df2c88dd4e268c15b1145ceb92eaa2a040a8f6ce2
Instruction Fuzzy Hash: 9BF05E00F5D22BC1FE6553A269A12320BC29FC5388E4D5534CC0C4A3D9ED6CE902C238

Uniqueness

Uniqueness Score: -1.00%

Function 000001D74596205A Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001D7459629A5), ref: 000001D7459620AA

Memory Dump Source

Source File: 00000000.00000002.310933520.000001D745960000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001D745960000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d745960000_loaddll64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 011c6879bde9f1e75c40580259034cfef7b37f76bdcbeed9748d12d6c56c4f62
Instruction ID: 9774237890375b4316b6cc467e354e32a2bbe8e0014f9ba24536b586d8f65619
Opcode Fuzzy Hash: 011c6879bde9f1e75c40580259034cfef7b37f76bdcbeed9748d12d6c56c4f62
Instruction Fuzzy Hash: FF314B72615B8086D790DF1AE45479A7BB0F389BD4F209126EF8E97B58DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFC682BA960 Relevance: 8.3, Strings: 6, Instructions: 762COMMON

Download Yara Rule

Strings

3050, xrefs: 00007FFC682BAE02
3050, xrefs: 00007FFC682BAC58
0020, xrefs: 00007FFC682BAE09
0020, xrefs: 00007FFC682BAC51
GNOP, xrefs: 00007FFC682BAC91
4040, xrefs: 00007FFC682BAE2A

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 0020$0020$3050$3050$4040$GNOP
API String ID: 0-829999343
Opcode ID: d0bc01684baad9dc0070a379f341f88ebea3c880daaef9d8074e94af0fa9d77a
Instruction ID: 460e80ab9cb99cd80af5b7cbe11eac69a8d0d69788d9eacb918e08ca8697f6f0
Opcode Fuzzy Hash: d0bc01684baad9dc0070a379f341f88ebea3c880daaef9d8074e94af0fa9d77a
Instruction Fuzzy Hash: 4D729066A1C5AAD5EB60EB20C4912FD2761FF9478CF804031EA4E879DAEF3CD645C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682AC700 Relevance: 8.0, Strings: 6, Instructions: 505COMMON

Download Yara Rule

Strings

SaK, xrefs: 00007FFC682ACC08
SaK, xrefs: 00007FFC682ACD5A
SaK, xrefs: 00007FFC682ACC64
SaK, xrefs: 00007FFC682ACDE5
SaK, xrefs: 00007FFC682ACE63
SaK, xrefs: 00007FFC682ACB9D

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: SaK$SaK$SaK$SaK$SaK$SaK
API String ID: 0-493789
Opcode ID: 38c3a94b9ab4f0c0e515bbc182763a0e6f3354787696474a66077581bd0ec7cb
Instruction ID: 27d6005c1cc3122ee4deec746ab5364b840c3fca128b31f7b42055638e2ec5d4
Opcode Fuzzy Hash: 38c3a94b9ab4f0c0e515bbc182763a0e6f3354787696474a66077581bd0ec7cb
Instruction Fuzzy Hash: 3232A922B18AAAC5EB50DF61D8412FE63A1FF84B88F448035EA4E47BD9DF78D544C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC683036C0 Relevance: 5.7, Strings: 4, Instructions: 682COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00007FFC683037ED
VUUU, xrefs: 00007FFC68303A94
VUUU, xrefs: 00007FFC68303A1B
VUUU, xrefs: 00007FFC68303A3B

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU
API String ID: 0-2165971703
Opcode ID: 672c78143494dd39daea629657bbfe3320cb3f680577399df9aa3ec95ddd6509
Instruction ID: 73d07e8c4698b7171b1958c9ba2444b10b85496b275babe66bd2f279a3762897
Opcode Fuzzy Hash: 672c78143494dd39daea629657bbfe3320cb3f680577399df9aa3ec95ddd6509
Instruction Fuzzy Hash: 2352A372A0CAAACAEB648F64D4407BD7BA1FF84748F184135DA4E57AC8DB7CE940C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B58F0 Relevance: 4.3, Strings: 3, Instructions: 509COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFC682B5FFD
)8GV, xrefs: 00007FFC682B5D8C
)8GV, xrefs: 00007FFC682B5F0D

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV$@
API String ID: 0-2802744955
Opcode ID: 8e5bb4a2171993d98cef1fad2204f817f166dab43f89da08c3bbdd28530923d8
Instruction ID: bab46c87ca963f7de48750501ed18ed73a262966869a1715eb2ef450e4d64a2f
Opcode Fuzzy Hash: 8e5bb4a2171993d98cef1fad2204f817f166dab43f89da08c3bbdd28530923d8
Instruction Fuzzy Hash: 33326F62B1D6AAD5EB50EB61D8512FD2360EF8478CF840431EA0E476DAEF3CE505C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC68296790 Relevance: 4.2, Strings: 3, Instructions: 406COMMON

Download Yara Rule

Strings

GET, xrefs: 00007FFC6829686D, 00007FFC6829687B
POST, xrefs: 00007FFC68296CD6
*/*, xrefs: 00007FFC68296CE2

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: */*$GET$POST
API String ID: 0-3233530491
Opcode ID: 61d561b99f8d481ae0cd7e11a1c284686ab0945e28463c0840ea7e72ed9f4625
Instruction ID: c3bffe8a2121e16e1e410f754ad64ee6bcdda26d7cbada236989635fea55e3d7
Opcode Fuzzy Hash: 61d561b99f8d481ae0cd7e11a1c284686ab0945e28463c0840ea7e72ed9f4625
Instruction Fuzzy Hash: 32126E32A0CA9AD5EB50DB61E8902EE77A1FF8439CF804031EA4D47ADADF78D149C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F9580 Relevance: 2.7, Strings: 2, Instructions: 174COMMON

Download Yara Rule

Strings

f+/), xrefs: 00007FFC682F971A
f+/), xrefs: 00007FFC682F96B8

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: f+/)$f+/)
API String ID: 0-981509904
Opcode ID: 571aaf60be34797cc83d25ae5771d88604a7ee07681c47c9117cbab8caea9741
Instruction ID: f9c18ac88388fa61ec92a8db0241e6f42695f64342c4f0b4c1f809ccbe0a5daa
Opcode Fuzzy Hash: 571aaf60be34797cc83d25ae5771d88604a7ee07681c47c9117cbab8caea9741
Instruction Fuzzy Hash: 50716B66B0CA2AD6EB10DF79D0602BD27A1EF88B48F544432DE0D477D5DE38E50AC724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C45F0 Relevance: 2.6, Strings: 2, Instructions: 117COMMON

Download Yara Rule

Strings

}LH1, xrefs: 00007FFC682C4692
2"M1, xrefs: 00007FFC682C46B8

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 2"M1$}LH1
API String ID: 0-177019254
Opcode ID: fd8166394a68ae6cb04bebbe41f95fd9f6410a78deff93f1d7542d7f2f3f8aaa
Instruction ID: 602555f6f80a0cca422e09bb5124f52ec9caec5f34ff1952e8e1591599044961
Opcode Fuzzy Hash: fd8166394a68ae6cb04bebbe41f95fd9f6410a78deff93f1d7542d7f2f3f8aaa
Instruction Fuzzy Hash: 3851BF72719A55CAEB649F30A4803AE37A2EF89348F545539E64E0BBC8DF3CD406C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C82B0 Relevance: 2.1, Strings: 1, Instructions: 866COMMON

Download Yara Rule

Strings

D, xrefs: 00007FFC682C8C9B

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 5dc9d16ba2194fec26aebdddd9b581b711ea68098e1161d901ff98bec3de5d67
Instruction ID: 46aacc11014c63c8c46076af722a06384c0ff52868256fa492c2376adf3825a2
Opcode Fuzzy Hash: 5dc9d16ba2194fec26aebdddd9b581b711ea68098e1161d901ff98bec3de5d67
Instruction Fuzzy Hash: 5682D276A2C69AC5EB90EB20D4915FD6761FF84398F804531EA5E83ACAEF3CD504C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC6829C5A0 Relevance: 2.1, Strings: 1, Instructions: 865COMMON

Download Yara Rule

Strings

GET, xrefs: 00007FFC6829C5B5

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: GET
API String ID: 0-1805413626
Opcode ID: 78d64084ef3653309f57744ebfb6c12b6495a33e9b5b91d2ff311640bbd03caa
Instruction ID: efe82dfe1e6f72889a440773e469a8a30290ccab01d743f56856f6098ad659a8
Opcode Fuzzy Hash: 78d64084ef3653309f57744ebfb6c12b6495a33e9b5b91d2ff311640bbd03caa
Instruction Fuzzy Hash: 9C827B62E1C6AAD1EF50DB26D0953BE6760EF85B4CF801032EA4E476C6DE7CE445C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682A3D60 Relevance: 1.8, Strings: 1, Instructions: 572COMMON

Download Yara Rule

Strings

x, xrefs: 00007FFC682A45BE

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID: x
API String ID: 1964310414-2363233923
Opcode ID: 82f737a9c5b47702e318baeb9a7d5f2343c9576457ae7c7613f04ff19e50a328
Instruction ID: 2b53e4897ca7494500520f34326b5d60b154d6833b201f4bfb2804d0407282ed
Opcode Fuzzy Hash: 82f737a9c5b47702e318baeb9a7d5f2343c9576457ae7c7613f04ff19e50a328
Instruction Fuzzy Hash: AB525832B18AA5E6E748EB70C5912EDA369FF84748F804032DB1D436C6DF78E125C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C2C80 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

U, xrefs: 00007FFC682C31F7

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 05ed2c5eb56b4a8982275aacafe35b4fa60914c3f87683d0f5662c9b8ece639f
Instruction ID: 2f680e6df566d189a04fb8b1cc2fce690e4f0e7d995edf6a6c8adf7f6450d2cc
Opcode Fuzzy Hash: 05ed2c5eb56b4a8982275aacafe35b4fa60914c3f87683d0f5662c9b8ece639f
Instruction Fuzzy Hash: D2227E62A1C5AAD5FB90EB60D4553FD27A1EF8034CF804031EA4E87ADADF6CE505C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B2A50 Relevance: 1.7, Strings: 1, Instructions: 430COMMON

Download Yara Rule

Strings

Content-Type, xrefs: 00007FFC682B2D7F

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Content-Type
API String ID: 0-2058190213
Opcode ID: 67e7f7f3dfcaa937f0d0aa19b98904e0d32e95ce08c5db8fed52942231ac4b1e
Instruction ID: c7896d3f3d7c72ff181972774be1df42d187c2ac837d4597aab6aceea3783f59
Opcode Fuzzy Hash: 67e7f7f3dfcaa937f0d0aa19b98904e0d32e95ce08c5db8fed52942231ac4b1e
Instruction Fuzzy Hash: 1B12A362A1D66BC6EB64DB60D0952FD63A4EF48B4CF804431DA4E476C6EF3CE509C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682FA0E0 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

f+/), xrefs: 00007FFC682FA6B9

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: f+/)
API String ID: 0-1539276483
Opcode ID: efcc0a7ca3692f434700fc3a4aa4321648ded9d4bc9a5aa5564d7bf2c512520b
Instruction ID: 46f61260660e5b38ef5955b0af2ee27def84049059b74bb9a5e1945fc9dfdd4e
Opcode Fuzzy Hash: efcc0a7ca3692f434700fc3a4aa4321648ded9d4bc9a5aa5564d7bf2c512520b
Instruction Fuzzy Hash: 5B12C022B2CA6AD5EB40EB61C4911FD27A5FF9478CF804031EA0E57ADAEF78D504C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B52D0 Relevance: 1.7, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFC682B5512

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebd5c323d760599bf8076e359c2b47c9c5a19224874a9db36b8889597ec1c031
Instruction ID: 3f2036782f17035b4c0ef0cbcb4814c59893a3d9c3b8e01eede40e64e9baff04
Opcode Fuzzy Hash: ebd5c323d760599bf8076e359c2b47c9c5a19224874a9db36b8889597ec1c031
Instruction Fuzzy Hash: F6F1D022B0DB6AC2EB509B21E9502BA67A1FF84B8CF544035EA4D4BBD9DF3CD441C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C7B10 Relevance: 1.6, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFC682C7BB6

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: cdad4d127e5bf589c56a1c9c99302703fa87f2071cb4479af92bb59231720b0d
Instruction ID: 757fa9c01d0ec01575a1c7c13ce113fffc485506b5b94cea17f23e3152a0f28f
Opcode Fuzzy Hash: cdad4d127e5bf589c56a1c9c99302703fa87f2071cb4479af92bb59231720b0d
Instruction Fuzzy Hash: C3D19021B1CA6AC5EB50EB61D4912FE67A5AF84388F804431EA4D87ADAEF3CD505C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682AFAB0 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

, xrefs: 00007FFC682AFBAB

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b6f5e0980019810108aa0e85357ee965d256238aca77ddfde0ce7f3a4d6e401c
Instruction ID: 5abb359f932451372d266e47021cebc002e3dd1640aed19ebb520e32de9837c2
Opcode Fuzzy Hash: b6f5e0980019810108aa0e85357ee965d256238aca77ddfde0ce7f3a4d6e401c
Instruction Fuzzy Hash: 91B1AD61B1C66A95EB54EB61C0112FE2761AF8874CF804435EE0D4BBCAEE7CE506C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682BDFE0 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

, xrefs: 00007FFC682BE15E

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 52df6e19e7cae1431068b8d62d79e6cb7b810852275933e53e5f465ebbe4b69d
Instruction ID: 4fabb92c7b0428bd965aadc6e1c51e6bdab1694049fef099bf45726b3d136a5f
Opcode Fuzzy Hash: 52df6e19e7cae1431068b8d62d79e6cb7b810852275933e53e5f465ebbe4b69d
Instruction Fuzzy Hash: 9A81F525B2E6ABC2E954A762A41027E67C1AFC9B8CF844834DD0D477C6EE3CE805C775

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC68309E70 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00007FFC68309EBF

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ERCP
API String ID: 0-1384759551
Opcode ID: 5c0459b61386457cc212822abbe1eb74425903cd16e4a0cba1d06804f81f7a37
Instruction ID: cbb69098a7825083dcb68ac542ffebd4f82c6f5a1050bfe3274d0d4bbc4bd15f
Opcode Fuzzy Hash: 5c0459b61386457cc212822abbe1eb74425903cd16e4a0cba1d06804f81f7a37
Instruction Fuzzy Hash: 8341D367B244568BE3189E2598212BA2791F7E87817008838FBC7C3B89ED7CDE51C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682DED20 Relevance: .9, Instructions: 873COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6705ea4ac6d937d5fca6e16973586edd9b7d2b0c7410800d1f4efa84ce198d70
Instruction ID: 31c167726817e4457d5597503ee2ef4c3dc83d3c040c78fd4414cc9b27ed3266
Opcode Fuzzy Hash: 6705ea4ac6d937d5fca6e16973586edd9b7d2b0c7410800d1f4efa84ce198d70
Instruction Fuzzy Hash: ED82B022A0C7A9C6FA618B15D4403BA6BE1FF88B88F894032DA4D477D5DF7CD945C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682E3A50 Relevance: .8, Instructions: 808COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6fe547d0c6f062210ff932aa52a53fc7b9c6d506ca11c60dde234e47b562c94
Instruction ID: 5a85b16045d9aa0fad3a0d99cfbf2d0fcd6f0c9095cb74b20de0f3b430193b07
Opcode Fuzzy Hash: c6fe547d0c6f062210ff932aa52a53fc7b9c6d506ca11c60dde234e47b562c94
Instruction Fuzzy Hash: DA72F221A0CBAAC1EA658F15D4582B967E1FF85B88F894032CA4D477D5DF3CE942C378

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682E46D0 Relevance: .8, Instructions: 797COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92821b4b18829550fa617425749079edd389337da919e038fed9fc772702193b
Instruction ID: f7ea6a0bc828ab0663282c7708e2f01390686cc6530b7bdd0dd2fd238d959d56
Opcode Fuzzy Hash: 92821b4b18829550fa617425749079edd389337da919e038fed9fc772702193b
Instruction Fuzzy Hash: 7572D221A0CBA9C6EA618B15E4582B967D1FF85B88F894036CA4D077D5DF3CE942C37C

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682A74A0 Relevance: .7, Instructions: 747COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 7cf683b3b019cad2e535638ec3e080818eed914acf8215f36eb962fc6082708e
Instruction ID: beb3292b0bc1daeff7b73e626e7696515b4d9c8d0d6d028c7d3cce2c03fbb5c2
Opcode Fuzzy Hash: 7cf683b3b019cad2e535638ec3e080818eed914acf8215f36eb962fc6082708e
Instruction Fuzzy Hash: 89725F66B2CA5AD4EB40EB30D4921FD6765EF94388FC04431E64E879DAEF2CD609C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682DDF40 Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a71512511f15b4ad09e3f91569836df7a5c6ed4ba26708585b9ff0adab5981
Instruction ID: 1c97c5ef783b394a95142b25653f98264022745465bc7b52b9b098c89c0e8628
Opcode Fuzzy Hash: a0a71512511f15b4ad09e3f91569836df7a5c6ed4ba26708585b9ff0adab5981
Instruction Fuzzy Hash: CF52BE66A0DBAAC1EB649B15D4543B9ABE1FF84B88F895031CA4D077D5DF3CE840C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682A54B0 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: f03383b55ebd8909f4e176ee8f4819d6ac8b7b0b73b3ea6719d69f8eacb4b44f
Instruction ID: ecca811bc5e7ad4ea99661681cc443da0c2a712b9f09477ac2dbbf868bb53e06
Opcode Fuzzy Hash: f03383b55ebd8909f4e176ee8f4819d6ac8b7b0b73b3ea6719d69f8eacb4b44f
Instruction Fuzzy Hash: C9626D62B1C66AD5FB50EB70D4911FE27A1AF8434CF804431EA0E47ADAEE7CE505C768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC6830D650 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ea70c433d6e077cc155179e021f7d1f5e268d1d1e17f800cf3cd0a254cb069
Instruction ID: 2dbc47cc604f3168286032427f9c566c1a1715a28213d741a1247a8470143a84
Opcode Fuzzy Hash: 53ea70c433d6e077cc155179e021f7d1f5e268d1d1e17f800cf3cd0a254cb069
Instruction Fuzzy Hash: 73625E76A18B69CBD7648F25C08052C37B1FB98F58B295236CF0D47789CB38E891CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC68296E90 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b49250fb8378f6fdf4c9df4d9cfc3dc556a3be00db62fe77831ae0fcf7a2b0d
Instruction ID: 28a2bb53ddc1bea55b051ea484d8a73d8ae9c6e0e9d458c49d1231cbb2096527
Opcode Fuzzy Hash: 6b49250fb8378f6fdf4c9df4d9cfc3dc556a3be00db62fe77831ae0fcf7a2b0d
Instruction Fuzzy Hash: C252D022A2C66AD5FE50EB61E4511FE67A5FF84788F804032EA4E476D6DF3CE405C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682CA400 Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e314e53dab64861600fc064069ee9026523d66f9b4773eb6d5cda00390b528d4
Instruction ID: e0cf7963f6261f481bd0b82ef459e87f884c54e25fe07e37600dba226110964f
Opcode Fuzzy Hash: e314e53dab64861600fc064069ee9026523d66f9b4773eb6d5cda00390b528d4
Instruction Fuzzy Hash: C342F561B1CA6AC1FB90D761D8512BE6791AF843ACF404631E91E97BCAEF3CD506C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B3960 Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65cfbd9806a3a936966669ad939b25ac256810bd9db693759b3f062a8cf604ce
Instruction ID: e71216ded49b8995030483ed0ad9241a0c9285aa702991b52acdf6efb3a05230
Opcode Fuzzy Hash: 65cfbd9806a3a936966669ad939b25ac256810bd9db693759b3f062a8cf604ce
Instruction Fuzzy Hash: 0A428032A0D59BC2EA64EB20D0952FE67A0FF9474CF804032D69E822D6DF7CE549C765

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682A8700 Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a85a2c87978537ef9631fc355dddc4c36f3fffba29f94c6d668061522aee41f3
Instruction ID: 15efc63929dcf06f01fa223c9460110802b22b4ec641d48a53f54e7b11446d74
Opcode Fuzzy Hash: a85a2c87978537ef9631fc355dddc4c36f3fffba29f94c6d668061522aee41f3
Instruction Fuzzy Hash: FB42AF62A1C6AAD5EB50EB70C4922FD2765EF8435CF804431EA0D87ADAEF7CE505C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B3110 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ae456bcd06b3f425d5c91ff8de33501f7f45515cded1faa7343b05604a98e0
Instruction ID: bc03b747bbd3826dcf7fb04bde40d0aa5b87f244be4e64ea07675afa81ab2a62
Opcode Fuzzy Hash: f1ae456bcd06b3f425d5c91ff8de33501f7f45515cded1faa7343b05604a98e0
Instruction Fuzzy Hash: B632CC66B18666C5EB50EB31C4522FD2BA1EF88B9CF441035EE0E877CAEE78D141C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682A23B0 Relevance: .5, Instructions: 542COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb6f5f461b1d4ca306bb4234fb9d7b2676992c0438ec6e2da5c2cd87f9ed5ae
Instruction ID: 6924717b5b9c99be4528f6d136c9ffa84a82a0ad8e4080bba290b17d4143b6c8
Opcode Fuzzy Hash: 8cb6f5f461b1d4ca306bb4234fb9d7b2676992c0438ec6e2da5c2cd87f9ed5ae
Instruction Fuzzy Hash: 0332A062A1C56AD5EB50EB21D4911FD27A1FF8438CF804131EA4E87ADAEF7CE205C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC6829B100 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8862e0fed2ff57bd489ba815e8bcc4f237e38119388730476f0b0a0724343e22
Instruction ID: 887066411124e3f900065c4563f5cf3363c642f7fc47e87796b687371fd1d434
Opcode Fuzzy Hash: 8862e0fed2ff57bd489ba815e8bcc4f237e38119388730476f0b0a0724343e22
Instruction Fuzzy Hash: 1E42A162A1CA6AD5FB40EB21C4956FE6764FF8434CF804032EA0D876DADF78E549C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C7310 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a138ed060d7680e7d78a18bda9a5c5d47bf234489dcc847df638679577738155
Instruction ID: 525044ef64ecc56e5e86e25eddc5cfaca71d62e5bf6639b2f02f24c59966ea41
Opcode Fuzzy Hash: a138ed060d7680e7d78a18bda9a5c5d47bf234489dcc847df638679577738155
Instruction Fuzzy Hash: F022F265B0C65AC6EA90EB25C4922BD27A5FF847C8F804535EA0E877C6FE3CE505C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C9390 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312f6ea925f60dbbaa3643ba3de431dac70b511dbb8f3fb241a0123b0b17fd16
Instruction ID: 31cd45583726166b1de72a775c46f7ea4a03add3dc64cec7c897ec03ca9469c6
Opcode Fuzzy Hash: 312f6ea925f60dbbaa3643ba3de431dac70b511dbb8f3fb241a0123b0b17fd16
Instruction Fuzzy Hash: D922D366B1C55AC2EA60EB21D4922BD6391FF8478CF504535DA0E87BD6FE3CE506C328

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B8C40 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: CloseEnumValue
String ID:
API String ID: 858281747-0
Opcode ID: a5e2da7d6f9400e07925bd5b9f8f65ab9e4ae4340de07049174a6041d880ddeb
Instruction ID: c1a09a9f33f3eb3571bc7e5b6e676ab3d11fc764d72cdc79bab83d9e4f30f079
Opcode Fuzzy Hash: a5e2da7d6f9400e07925bd5b9f8f65ab9e4ae4340de07049174a6041d880ddeb
Instruction Fuzzy Hash: 9E22CD22F1D5ABD5EA60EB60D0912FD2761AF9478CF804531EA0E476DAEE3CE505C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682FCE00 Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20197787250662c09fe8e9e97e9303525dcf2ffb8622c72aab126edc68b70b0
Instruction ID: 536aa1e97940c682008cab388e94f7233ac84687075cb46fa466b90d6cf5b1f0
Opcode Fuzzy Hash: f20197787250662c09fe8e9e97e9303525dcf2ffb8622c72aab126edc68b70b0
Instruction Fuzzy Hash: 4F02346298C2BAC5F7758B24814037A7BE1EF1270CF554136DA8E422E6CB3CE945DB38

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC6829DDE0 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d9a74a2a40b33baac804c102d1d40859fb7644379661121cf789c5970111cb
Instruction ID: aa6c19d0947af18c7d692762c650591bde5572d19519496a0e6caaac1c47eee5
Opcode Fuzzy Hash: 54d9a74a2a40b33baac804c102d1d40859fb7644379661121cf789c5970111cb
Instruction Fuzzy Hash: D8227D65B1CA9AD1EB50EB21C0921FD6765FF84788F804431EA4E87ADAEF7CD205C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC68295C20 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6337d68db6f9604866de643f3ee19e0e114db88cdf9cc99c76e459ba937c797f
Instruction ID: 067bbc6b852e0c3959a4f3167e8a720ef7ff301d0c114f259015ad8d5db1d6e9
Opcode Fuzzy Hash: 6337d68db6f9604866de643f3ee19e0e114db88cdf9cc99c76e459ba937c797f
Instruction Fuzzy Hash: 3B229122A1CA6AD1EB50EB21D4551FE27A4FF9578CF804032EA4D476DAEF3CD509C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F7260 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c554c9cbf76f6bd5e517f645ce28a9c31c71997994adb23cbf64d0c8de72ad7
Instruction ID: 724cd85c4bace2f8272d68cbb452b32db532f1397c777830a2d7c4cec29e7d84
Opcode Fuzzy Hash: 8c554c9cbf76f6bd5e517f645ce28a9c31c71997994adb23cbf64d0c8de72ad7
Instruction Fuzzy Hash: 34028B21B4C65ADAFB60AB61D4512F927E1AF8438CF844535EA0D87BCAFE38E505C374

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F84D0 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0996fc87cfd22f885cce3042e7289c7cd874aa05387ff9fe1a4aceec301b4dd
Instruction ID: 68f3702d8665af4c7f3091e0585d3ad3db097ebd1396c2acf90dcbee50aec0f4
Opcode Fuzzy Hash: b0996fc87cfd22f885cce3042e7289c7cd874aa05387ff9fe1a4aceec301b4dd
Instruction Fuzzy Hash: 94029E76B4C66ACAEB50DB22C0911BE73A1FF84788F504035DA0E877C6EE38E805C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC6829BB20 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0afb76e5d8deec59172f91c3b6509fd61606e4818d5eeeea13430d5a2128ed
Instruction ID: 86e5992fc8cae5b68f0768b1c0a06794ab72eddce65c3da3fc227f20a8552102
Opcode Fuzzy Hash: ce0afb76e5d8deec59172f91c3b6509fd61606e4818d5eeeea13430d5a2128ed
Instruction Fuzzy Hash: 3D12A322A1CAAAD5EF50EB21D4912FE6765FF8474CF800032EA4D87ADADE7CD505C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682AD780 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 5f5938f53c5b3538d7588dc6a118b8cfa6568dd1af582bfee192ebca1636af31
Instruction ID: d490836060e3b82b1e4fdecf7e4ec0b3649815e668e3ccb3a80b3b22529964ce
Opcode Fuzzy Hash: 5f5938f53c5b3538d7588dc6a118b8cfa6568dd1af582bfee192ebca1636af31
Instruction Fuzzy Hash: 5C024E66B1C96AD2EB80EB61D4911FE67A1FF94348F804032EA0D47ADADF7CE505C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682BEFD0 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a54140925e95c7cfaf995847638abe2d2e059218b81c089810baa6ae90814d
Instruction ID: 335261ecd2f0efc408e1a38a934fea1e0e16ed91f3a5be51ba49b4c84eeb6550
Opcode Fuzzy Hash: d9a54140925e95c7cfaf995847638abe2d2e059218b81c089810baa6ae90814d
Instruction Fuzzy Hash: 16028266A2CA6AD5EB40EB20D4911FD6764FF8478CF804432EA4D83ADAEF3CD505C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC68292980 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6a6b2bb90f26008fbc8736e614b521e3107096103992de97bbdc7ea8701d34
Instruction ID: 50c0ac61df76e1e1f6d0edb11795e9ccfc111aeaacbef9d75a5990fc708f74eb
Opcode Fuzzy Hash: fb6a6b2bb90f26008fbc8736e614b521e3107096103992de97bbdc7ea8701d34
Instruction Fuzzy Hash: F2026F62A2C9AAD5EB50EB21C4512FE2765EF9434CFC04031EA4D87ADADF78E509C734

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C9B70 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 3721fcf454b37b8eaafbc8b45fe43ec95c40d2506e45688a6a4d8302cc7d535a
Instruction ID: 1be55b9a83d5a929ca18e148cf10936286b1565f34b39f2d2db889564473a00d
Opcode Fuzzy Hash: 3721fcf454b37b8eaafbc8b45fe43ec95c40d2506e45688a6a4d8302cc7d535a
Instruction Fuzzy Hash: 28F16062B1C956D5FB90EB70D4911FD23A5AF9438CF804431EA0E97ADAEE3CD509C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682A0870 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151b17eb124ab8ee78c36bdae5a0f3e1e8f49f4c48ca1d345b58e20fdeb6ba74
Instruction ID: d70f85f45acfb839d666ab51aef10d828e4e8ad4ba143aff04091c60b9df5fad
Opcode Fuzzy Hash: 151b17eb124ab8ee78c36bdae5a0f3e1e8f49f4c48ca1d345b58e20fdeb6ba74
Instruction Fuzzy Hash: 76025D66B18A6AD9EB00DF31C0512FD2725FF5074CF804475EE0E97ACAEE69E609C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682A9050 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdfb081fa59f2d5c7030995037a18f51135a41c5da658dd92cbc0c6c38a2482d
Instruction ID: f1aa53f2e343fd59baa9cada32aca0973a3099267b6b15f3dadda629d4189dcd
Opcode Fuzzy Hash: bdfb081fa59f2d5c7030995037a18f51135a41c5da658dd92cbc0c6c38a2482d
Instruction Fuzzy Hash: A2F1BF22A1C66AC5FB50EB71D8512FD2764EF8434CF800531EA1E87ADAEE7DE504C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682ACF30 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c01e724edb53882ca99af93fddb11d90eaf6570b67cfbaaa3c25d323057a62
Instruction ID: c1fb4bd1c2f169b679bb578c44b25e93cd7163799c83d9c3b08eb7e71c190eaa
Opcode Fuzzy Hash: 65c01e724edb53882ca99af93fddb11d90eaf6570b67cfbaaa3c25d323057a62
Instruction Fuzzy Hash: 07027122B1C966D5FB50EB60D4512FD27A4EF9478CF804032EA0D87ADAEF6CD509C768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C2610 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fae273b66de7f5f80531fc293775c5f56af709758f9e335efb0c9d9ae13d318
Instruction ID: 25e414fd44c378634e9881b2f52af1a83fb223f735bd409da98d206686719db9
Opcode Fuzzy Hash: 0fae273b66de7f5f80531fc293775c5f56af709758f9e335efb0c9d9ae13d318
Instruction Fuzzy Hash: 4F02C062A1CAAAD5EB90EB20D4911FD6765FF8434CF804032E64E87ADADF7CE505C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682FB180 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f661e04366838e4ce4ba5aebd1dc93168e9e41b499943add9dd9d6d7fef4196
Instruction ID: abeae86862815fe6f720396f0fd3713958ed00faa34efd2976b25654394d02de
Opcode Fuzzy Hash: 8f661e04366838e4ce4ba5aebd1dc93168e9e41b499943add9dd9d6d7fef4196
Instruction Fuzzy Hash: 1DF17022A2C99AD5FB50EB31D8951FE2765EF9434CF804031EA0E879DAEF78D509C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682A9660 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c85cb65d38bad6ee87958564d5bb6e54eddf6d496b0914b1e63d609f926690
Instruction ID: 4a05ee1b3b7e587f865a5a8a806dfdebd397cf111a4704e8732c7accca93eb11
Opcode Fuzzy Hash: 90c85cb65d38bad6ee87958564d5bb6e54eddf6d496b0914b1e63d609f926690
Instruction Fuzzy Hash: 84E18D22B1C6AAD5FB50EB61D4512FD27A4EF8434CF804031EA1E47ADAEE7CE505C768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682BBE80 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4793626beca4eb920313b5b4abf8812a4177065f169b5b16d98632f4f1ce2078
Instruction ID: 2051dc04fc267f4b2cefd98efe002066261e2708c3dafbcd46f9aa7d73a4cd9a
Opcode Fuzzy Hash: 4793626beca4eb920313b5b4abf8812a4177065f169b5b16d98632f4f1ce2078
Instruction Fuzzy Hash: B6E19366B1CA6AD4EA40EB61D4520FE6764FF8478CF800431EA4E87ADAEF3CD505C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682918D0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfcd8345e0527295787ed532cf0b76d993265f1e625a5e117e0a9f941a2b0157
Instruction ID: 6f419a925896466921abed722d73456f70787792f5bb7d4e8d7e29decce17f52
Opcode Fuzzy Hash: bfcd8345e0527295787ed532cf0b76d993265f1e625a5e117e0a9f941a2b0157
Instruction Fuzzy Hash: 60F16022A2C9AAD5EB50EB61C8911FD2769FF9034CF804032E64D479DAEF2CE605C774

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F4B10 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1ec2f76909503f5e5f280d8b1d36be997d868925ad19848859c1f5d0e5c577
Instruction ID: 7432ceb2062e6dc73d567c21989c3ab5ddd47c7eedac634c93d98e852c98d426
Opcode Fuzzy Hash: 7a1ec2f76909503f5e5f280d8b1d36be997d868925ad19848859c1f5d0e5c577
Instruction Fuzzy Hash: 1BC13A1352C1E08BD7658B36A0512BEAF90EF953CCF580675EECD96ADBD62CC214CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682BC3D0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d555b941f5300850b9518b7182a859395d49d98e2d5b539dc6be0b4fcff300a
Instruction ID: 292d8531a7729097c4ae5ca93aea38b9c53df9dec2f2a01974ad22adff8a3fbd
Opcode Fuzzy Hash: 2d555b941f5300850b9518b7182a859395d49d98e2d5b539dc6be0b4fcff300a
Instruction Fuzzy Hash: 07D1BF66B1C956D1EB40EB70D4921FE6765FF84388F800432EA4D83ADAEE3CD505C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682BF640 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea235d4e0d1414fab4af90868f9b86f5d171ea6d1b4f832b5d38792101ff4594
Instruction ID: d57f8da125fd208013d7b3ebe04defb79b82d1f45190ef2433870d224835c7b5
Opcode Fuzzy Hash: ea235d4e0d1414fab4af90868f9b86f5d171ea6d1b4f832b5d38792101ff4594
Instruction Fuzzy Hash: 43C1A22AF0DA6AD9FB10EB75D0502BE27A1AF8474CF844431DE0D976DADE78E505C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B95B0 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: a47b1571769b71061f7386e70a296463ad06a0d77e6d86b84660bcac130057ab
Instruction ID: aaa3ee9a17416024b224f099fd1dff868af0e81204f5ee19397697de12035c91
Opcode Fuzzy Hash: a47b1571769b71061f7386e70a296463ad06a0d77e6d86b84660bcac130057ab
Instruction Fuzzy Hash: 79D1B322A1CAA6D5EB40EB20D4512FE2764FF9474CF804031EA4D876CAEF7CE515C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682EF650 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a78213419fa403d19e8ba573a5bb0c82199ede7bbd4b0919e3d741805d4ca7da
Instruction ID: 4b524c4df6ec562bbee7cecacd2698e9e7d92756f9e40100da37a3c598597673
Opcode Fuzzy Hash: a78213419fa403d19e8ba573a5bb0c82199ede7bbd4b0919e3d741805d4ca7da
Instruction Fuzzy Hash: 03C1B122B0CA5AD5FB50EBA1D0592FE27A1AF5438CF804071DE0D876D6EE78E506C378

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B2210 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70620dd640cb9417e6f539abca38ce7f2bd38855fbbf3272b3bde5521d98ab9
Instruction ID: cff832d84889d55e8f3bb527924351f69b5394d2b1942aa9d96b4c57bce724df
Opcode Fuzzy Hash: c70620dd640cb9417e6f539abca38ce7f2bd38855fbbf3272b3bde5521d98ab9
Instruction Fuzzy Hash: D5B15D26F1863AD4EA40EBA1D4551FE2765AF89B8CF805031EE0D47BDADE7CD405C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682EFE10 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888eea97ffef24a192abb0a354466538007223d93a06cbaa9e987cb9b68a8cc4
Instruction ID: 73c98db3da05509066c484ced505022a45b0404427d59ba539f2bc8bc3f9d197
Opcode Fuzzy Hash: 888eea97ffef24a192abb0a354466538007223d93a06cbaa9e987cb9b68a8cc4
Instruction Fuzzy Hash: 7FC1D122B0C65AD6EB60DB71D4402BD37A0AF9536CF480235EE1D4BAD6DF78E519C328

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C0650 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8efb57f33e91665b454b318c20399fb8b75e3b0d5c8074a2f1ede7ff882a8e07
Instruction ID: 2ec50c4099efc4aa3980ec47c59817151dc9a3a899c99cc9b86a96dd20a0d9e0
Opcode Fuzzy Hash: 8efb57f33e91665b454b318c20399fb8b75e3b0d5c8074a2f1ede7ff882a8e07
Instruction Fuzzy Hash: BAC18062F0C95AD9FB90EBA1D0512FD27A5AF9434CF804531DE0DA7ACADE38D509C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F3270 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1346c67a4001e8ec71b2ecf12ee69e9ccdcfdb209907d1eb0c7892ed0958e83
Instruction ID: 1cf0659086a0b103468d034449751fa8a4d3974cd38f440282582e6b439ab5fa
Opcode Fuzzy Hash: e1346c67a4001e8ec71b2ecf12ee69e9ccdcfdb209907d1eb0c7892ed0958e83
Instruction Fuzzy Hash: ECA12422A5C6ABC1FB61CB2594283BE6791BFC838CF545435ED0D866C8EE3CE905C365

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C0EE0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0bfd8c7c0170523a9bada214f78ba6b12f0df9ce1156bc7c150526159cc8e3
Instruction ID: 84bcc9fe024ab7d50bb341a01aa18090ae87fc19c4339995932365fe3c4d0c94
Opcode Fuzzy Hash: 3d0bfd8c7c0170523a9bada214f78ba6b12f0df9ce1156bc7c150526159cc8e3
Instruction Fuzzy Hash: 92B1C366B1C5AAD2EA54EB21D4512FE63A1FF9478CF844031EA4D837CAEE7CD504C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682FCE8B Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: babea76ce2edd719bef7d57a5204983a6c99abdbdd04f4edc2f976bcb4b82cce
Instruction ID: e58d59ac6aa18286910a557d230fb2549a5c4bd0a528d1969211150394addd17
Opcode Fuzzy Hash: babea76ce2edd719bef7d57a5204983a6c99abdbdd04f4edc2f976bcb4b82cce
Instruction Fuzzy Hash: C4A1346388C2BAC5F7758A25814037A7FF1EF1170DF454136EA8E425E6CA2CE941DB38

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC68297A40 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69aaede3648a4eed74b6a8f3897f7f82868b66c790a08888e25870a1acf979ee
Instruction ID: 57a4a3281b7fab60532e0885e14a802cdf257ef12a498929d60f7ee542c706ee
Opcode Fuzzy Hash: 69aaede3648a4eed74b6a8f3897f7f82868b66c790a08888e25870a1acf979ee
Instruction Fuzzy Hash: 21B1C421B2C69AD5EB50EB21E4551FE6761FF84788F805031EA4E47ADAEF3CE109C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F6AB0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd6df93af20696ce61b65c84b114c71a244eb935c631d72c6eb88f0af816f05
Instruction ID: 9e097af1d299485b1e4b1474ccb86b59f4a420c272e0a04cc96aefc8dbcc3edb
Opcode Fuzzy Hash: 7bd6df93af20696ce61b65c84b114c71a244eb935c631d72c6eb88f0af816f05
Instruction Fuzzy Hash: C7A1C022B0C65AC5EB50DB61D4916BE27E5EF88788F840535DE4C83BC6EF38D906C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682FCEAD Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction ID: 2f24db24ae3f69403fbb317dcbf8d543571bf802a74a59d6ed8d0aa2d1b4bc20
Opcode Fuzzy Hash: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction Fuzzy Hash: BDA1546389C2BAC5FB758A25814037A7FF1EF1170CF054136EA8E425E6CA2CE941DB38

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682FCEB6 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction ID: 1babe033792c23c09acd584b48840fa0f5636aa22349613c0c4f221e6e2361b1
Opcode Fuzzy Hash: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction Fuzzy Hash: 02A1556389C2BAC5FB758A25814037A7FF1EF1170CF054032EA8E425E6CA2CE945DB38

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682FCEA6 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction ID: 5c137365242597c12f31d88fee2a5c2e9be045b9ce1adf456656e2d9aa27fa09
Opcode Fuzzy Hash: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction Fuzzy Hash: 08A1436389C2BAC5FB758A25814137A7FF1EF1170DF054136EA8E425E6CA2CE941DB38

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682FCE9D Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction ID: f8e6a137fe847a0e6fb4012585285ccfddcbede5635fed4178a91c8546bb7c69
Opcode Fuzzy Hash: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction Fuzzy Hash: CAA1446389C2BAC5FB758A25814137A7FF1EF1170DF054136EA8E425E6CA2CE941DB38

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682FCE94 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction ID: 93a2353b9a9cb40824d09027c6b4e3641964624b62f7a64357f251f195307321
Opcode Fuzzy Hash: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction Fuzzy Hash: 83A1446389C2BAC5FB758A25814137A7FF1EF1170DF054136EA8E425E6CA2CE941DB38

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC68291010 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24255c3cc6885df0694e04e102483c5fb854aa2d24f2341e9b609023f1e4310b
Instruction ID: f338af3bf9ef6b14acec8b0b4a6439f02828e2053d9984f18b074aaea6bedf42
Opcode Fuzzy Hash: 24255c3cc6885df0694e04e102483c5fb854aa2d24f2341e9b609023f1e4310b
Instruction Fuzzy Hash: EE919236B0D66AC5EB50EB62D4916BD23A5EF84788F844431DA0E87BC5FE3CE445C328

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682BDB20 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41037363fcbf5a997614a73f458997344bb30861732d6414f9575e8062d31a91
Instruction ID: b993e55ef628828ff5ea7da6ee9cb2fc0a99d2c15641e0b615f94c487ca3e681
Opcode Fuzzy Hash: 41037363fcbf5a997614a73f458997344bb30861732d6414f9575e8062d31a91
Instruction Fuzzy Hash: C9A19022B1CA6AD5FA50EB21D4511FE27A4EF9478CF840431EA4D47ADAEF3CE505C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682A6670 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3bbe2ee97f1875a8f5854ab4fdaf395d8735d8f6ea0ad60b3098026786c1b63
Instruction ID: cf17c7f1b5cb079be8c992eaaaaf6df5b5f53f8f88ffae88fdd7363e38333ea7
Opcode Fuzzy Hash: f3bbe2ee97f1875a8f5854ab4fdaf395d8735d8f6ea0ad60b3098026786c1b63
Instruction Fuzzy Hash: 5BA13B62F1C96AD9FB50EB70D4911FD27A5AF9434CF804431EA0D96ACAEF78D504C3A8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682A83D0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b0937c46eee77e6e065513f5f3c5f2d3aa468551e1e3886b16cfce749ea75f
Instruction ID: 919a190f9e786e03dc019581aa9daa774176bc8761e5e80157e4733171b54c7d
Opcode Fuzzy Hash: 63b0937c46eee77e6e065513f5f3c5f2d3aa468551e1e3886b16cfce749ea75f
Instruction Fuzzy Hash: A7913D62F1C96AD9EB50EB70D4921FD2365AF9478CF804431DA0E97ACAEE7CD509C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682BD2D0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 342651f7941b53e1c2daeed97fc389139813d0af81c11ef1969de60611c4736f
Instruction ID: aeab0bc86354a36d73f221fc8b6db2d36273cd0677a386add02922b33f7b3300
Opcode Fuzzy Hash: 342651f7941b53e1c2daeed97fc389139813d0af81c11ef1969de60611c4736f
Instruction Fuzzy Hash: 0D91B222B2C566D2EB50EB61D4556FE67A4FF94788F800031EA4D83ADADF7CD504CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682CE190 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56bd161f2c2f46643537efbbd3efd349dfb352c8731bf43f555d6b82eaabe288
Instruction ID: 93e1092ba49f51e9f7cce90515763d77c96cf10521e4ce9693b3adc42c22fb44
Opcode Fuzzy Hash: 56bd161f2c2f46643537efbbd3efd349dfb352c8731bf43f555d6b82eaabe288
Instruction Fuzzy Hash: BF81B966A0C6AAC6EBB49B2AD44117D6B61FF84B94F184132CE8E477D1CE3CE441C325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B6BF0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 148b29d79c79a4020d320550dce8c4bc94dfc8ebf88defd29fe7c0d8df34dd18
Instruction ID: 905e9ce36708f41283eea4b2fa9bf7807e0be00806c85ad3b7d06fe19ca55fb7
Opcode Fuzzy Hash: 148b29d79c79a4020d320550dce8c4bc94dfc8ebf88defd29fe7c0d8df34dd18
Instruction Fuzzy Hash: E4916D22B0D96AC6FB60EB61D4916FE23A1AF84B4CF844431DA0E876D6DF78E404C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682BEC30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933fc6c7d7f9af988b328be651fb1545f49bdab96ec60eabe5f34ecb71447f27
Instruction ID: c00f84761435f758826d8e9f20eeaccd68d4d944ff18ea96721b85663ade5939
Opcode Fuzzy Hash: 933fc6c7d7f9af988b328be651fb1545f49bdab96ec60eabe5f34ecb71447f27
Instruction Fuzzy Hash: 08914866B0C96AD6FB50EB70C5512FD2761AF9075CF800132EA1E979CAEF38E509C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B2650 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bac69f9b4a5db7cc8872f01b7a06f0e4e3f1a225578c742b96f8c99616c9fdd
Instruction ID: c8b82d03fb887e6605537d90a582fc40ccae1acc1cd11f730dcea605fd334aae
Opcode Fuzzy Hash: 6bac69f9b4a5db7cc8872f01b7a06f0e4e3f1a225578c742b96f8c99616c9fdd
Instruction Fuzzy Hash: 8E915D22F0CA6AD5FB50EB61D0952FE2761EF98B4CF804032DA0D576DADE78E505C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F5910 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d170de1884a79715357f5e29a2da4e7c92a17acbf3f6d3a9ae9f5afda9183d4c
Instruction ID: 4d339c006e7b1b143ffb011285c15e7181a53f75617d73ac328c7faef9ec7939
Opcode Fuzzy Hash: d170de1884a79715357f5e29a2da4e7c92a17acbf3f6d3a9ae9f5afda9183d4c
Instruction Fuzzy Hash: 0581B366B1C65AD4FB40EF71D4A10FC23A5AF8838CB844531EA0D87ACAEF38D505C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C1730 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d6b6570887948d2036593c4fa2e517d7a349a684e81613430d1f86f35ae348
Instruction ID: 4129d698cd2dded33f9c63ae88cf4d5869e0da41311981da5d82292bbe789eac
Opcode Fuzzy Hash: 12d6b6570887948d2036593c4fa2e517d7a349a684e81613430d1f86f35ae348
Instruction Fuzzy Hash: CC71C121B0D65AC5FB94AB61D4113BD27D19F8478CF444435DA0D47BCAEE3CE905C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F6E80 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a73122aa90b1427d502a98990fdf7291d62d4851d7f0b35ec174ae5dd513cd
Instruction ID: 7fda5bfbbd307056ed22ee4f7a888860a5bc717862ddadb0d33cb8f37a91fb5b
Opcode Fuzzy Hash: 48a73122aa90b1427d502a98990fdf7291d62d4851d7f0b35ec174ae5dd513cd
Instruction Fuzzy Hash: DF611111B0C6AAC5FA90E722D4615BA57E1AFC57D8F844235EA5D837C6FE2CE401C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682EE190 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2caf3cc3d18f3bdde1b2a88a9497d69fa6785ba81ed1363ac3444b02ccccdd39
Instruction ID: b345a5d196be8c70cf85985ed81227d405d5c6189d3a561bcccc20942e08f136
Opcode Fuzzy Hash: 2caf3cc3d18f3bdde1b2a88a9497d69fa6785ba81ed1363ac3444b02ccccdd39
Instruction Fuzzy Hash: 9A619426B1C66AD6FB50EB61C0542FE23A5AF8874CF805431DE0D57ACAEE38D506C379

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC68291620 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39bc435c6f424e6a24847b32e2f34c7ff3f0e5b6e360ef9859df5e86b155e70
Instruction ID: 4cdfb0f29afe17f70d19c9d02e2e2ce22f00fd3c4c9e3a863cebf517c44e019b
Opcode Fuzzy Hash: b39bc435c6f424e6a24847b32e2f34c7ff3f0e5b6e360ef9859df5e86b155e70
Instruction Fuzzy Hash: 1E619622A2C66AC1FF50DB16D0546BE63A4FFC5788F805131EA5D47ADADE7CD401C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C0AF0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: b0fc26077fb7dfd3e82a944be5800063d8e62ea182c57efd39adfe47ebf91e96
Instruction ID: b1d7c8dcc3aa4fcb2a8b32d97ac8cb9b1e11d2e044d838ee728367a60b18bbf0
Opcode Fuzzy Hash: b0fc26077fb7dfd3e82a944be5800063d8e62ea182c57efd39adfe47ebf91e96
Instruction Fuzzy Hash: BF71BB72A1C699D9EB50DB60D4512ED7BA1FF8434CF844031EA4D47ACADF78E508CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F9970 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 997cc84da153571a6576113b1e96a68aba698dd2523c5cf0efd3b4fb32e9bf93
Instruction ID: 99499c3fc7b293cc9c572fbc4a052d4b62843b1566cc53fc2b8f1b1f39db000a
Opcode Fuzzy Hash: 997cc84da153571a6576113b1e96a68aba698dd2523c5cf0efd3b4fb32e9bf93
Instruction Fuzzy Hash: E7518E62B1C66AD1FB50EB61E4552FE67A1EF94348F800031EA4D47ADADE7CE508CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B1C40 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0769d196557d1790af2a64eafcf6092895f85137ff93f9c94ae419b301080d1a
Instruction ID: e97a3bd20e5792ba58e7eec93cdb72737d6cdf12cc72c2d2a7eeed5af0aaddb2
Opcode Fuzzy Hash: 0769d196557d1790af2a64eafcf6092895f85137ff93f9c94ae419b301080d1a
Instruction Fuzzy Hash: A3613632908B8684E750DF31A491AED33E9FB49B4CF984138DE9D4B39ADF398051D328

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F9360 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc44db5f28221e0cf0ae5d1237f1819069b5c3e9a7d73ddd68a7a4c7c8699da6
Instruction ID: 0e5fab37ed84017ec4e146d92db87ddee7fdfc4e4119d516f2ab3e93f4e5ea42
Opcode Fuzzy Hash: cc44db5f28221e0cf0ae5d1237f1819069b5c3e9a7d73ddd68a7a4c7c8699da6
Instruction Fuzzy Hash: 3951A422B2C5A6D2EB50EB22D4556AE6394FF94BC8F805031EE4D43BD6DE7CD404CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682C0450 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83469a3fea14c8a22ad37a3829d82cc6925ef5e6a2115f87bce9c10ebfc10028
Instruction ID: de21317c0d78f3c3caf22707cb3705c732c3911520199e0e2d9a1226b5a45eec
Opcode Fuzzy Hash: 83469a3fea14c8a22ad37a3829d82cc6925ef5e6a2115f87bce9c10ebfc10028
Instruction Fuzzy Hash: 08517C22B0C95AD9FB50EB71D4516FD2361AF8878CF844031DE0D96ACADE78D505C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682BD0E0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b4b7b2f185c89bde099cd347935f2a4d5f558a15fc4162d7e759108ac842e55
Instruction ID: 12446e7f679ac0769e3dd6a60abb6a781cab4db0f255d8bbaf2c7c8b4c46a695
Opcode Fuzzy Hash: 1b4b7b2f185c89bde099cd347935f2a4d5f558a15fc4162d7e759108ac842e55
Instruction Fuzzy Hash: 61519E22B1C66AD5FB50EBA1D4513FE67A1AF9434CF840032EA4D479DADE7CE508CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682BE950 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e62cb177f987f71f3cf0e5803517de4d5bb4f146f42e0200321c919a982c235
Instruction ID: a4ff7e218b36a0d2f960c892166d34739a81c1f154eeecdb1133d80a6fbc3716
Opcode Fuzzy Hash: 5e62cb177f987f71f3cf0e5803517de4d5bb4f146f42e0200321c919a982c235
Instruction Fuzzy Hash: BC51077660C66AD2EA10EB21C4915BE6364FFC8798F804132EB0D836D2EF3CE155C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F19C0 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91ef941d1737411508bb001385e86c9cefe93bfa811a3ff23d670bc1e9ed299
Instruction ID: c3bf6bfe9351ce08763e6d8b2f1afa34e28dd1896720c5f91f51a79ed79d2677
Opcode Fuzzy Hash: c91ef941d1737411508bb001385e86c9cefe93bfa811a3ff23d670bc1e9ed299
Instruction Fuzzy Hash: EC418F51F2C67AC4FB41E771D8511BE23A1AF88788F844031E90E97ACAEE7CD502C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F1B80 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70eb0f53ad0297bd1b17417027bd2304b513837b3d44cc32065bd6379c9883c7
Instruction ID: 1238f1914e490962665fc4537b15dc34359d5ba18980e6b6c7745a039a5a868a
Opcode Fuzzy Hash: 70eb0f53ad0297bd1b17417027bd2304b513837b3d44cc32065bd6379c9883c7
Instruction Fuzzy Hash: 44416C56F2C63AC5FB41E762D8510FD63A5AF8878CF944031DA0E97ACAEE2CD541C228

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B1F10 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c6acce53346106deabb2adb0fa8056310d1eb2e8744015d017380b53eaf195
Instruction ID: e302b5aeb35ff4e2d8be1d7794791fe35b6bfff6cd85ee7b8cd0c21351a073ec
Opcode Fuzzy Hash: 69c6acce53346106deabb2adb0fa8056310d1eb2e8744015d017380b53eaf195
Instruction Fuzzy Hash: 24510732A18BA5C5E780DF35E4412ED33A8FB48F88F58413AEA8D4B799DF349152C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B7BE0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 832d85bf6204d5e14a830096db010d01002ddb84c0e9e4655a34d62ba22b0e7e
Instruction ID: de617392280cd0895dd23285a8cae6dbf79e02b99b899a43e3e7d6276b38b63b
Opcode Fuzzy Hash: 832d85bf6204d5e14a830096db010d01002ddb84c0e9e4655a34d62ba22b0e7e
Instruction Fuzzy Hash: 1C515632718B96E2E748DB21D5913E9B368FF88708F908425DB9C13695CF38E1B6C718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682B1850 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a884cfd8c748b068734e59e7f29a5d89b8f1b299cd0f2b200a9d6468436a8a8c
Instruction ID: 945af226602f71d8743a7418ed58e98dcae7c292b82828e382d8621b6430b1ff
Opcode Fuzzy Hash: a884cfd8c748b068734e59e7f29a5d89b8f1b299cd0f2b200a9d6468436a8a8c
Instruction Fuzzy Hash: 88511972518BA5C5E784CF35E4813ED33A8FB48F88F58413AEA8D8B699DF348152C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC682F4640 Relevance: .1, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbfa565b830cccb199c4bdaf821914782019420120f90f5eec39ee9b891f0b9
Instruction ID: e09c257d95993e481bb3e2f9c3626868487af192547b9b171ca9e7b403a387d8
Opcode Fuzzy Hash: 2dbfa565b830cccb199c4bdaf821914782019420120f90f5eec39ee9b891f0b9
Instruction Fuzzy Hash: 91315B62A4CA6AC2F6748B15A51037977C1EFC5349F588235DB9D433C4DEECE802C768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC68295350 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2435ecfe8df9d379fe949f65769208f67807e14af0845d1006c8829ca2cc55e0
Instruction ID: 7ec69f81561fb915bf362deca5a4f4a0f804f626fc0d2c7a48575a3ee33c0f4d
Opcode Fuzzy Hash: 2435ecfe8df9d379fe949f65769208f67807e14af0845d1006c8829ca2cc55e0
Instruction Fuzzy Hash: A7314B32624BA495E788DB35D8812ED73A9FB88B48FA48036E78D476D5CF76D163C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC68297E80 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.311387870.00007FFC68291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC68290000, based on PE: true

Associated: 00000000.00000002.311330619.00007FFC68290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312032725.00007FFC68311000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312125637.00007FFC68324000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.312143807.00007FFC68326000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffc68290000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7785df124227ca2189d2f1e5e9692317ca2612ea228bf4003116393ecc44e874
Instruction ID: 54403f9b688084dd1c91bd88c15697574edbe4363d1529286e606e8d0b19b065
Opcode Fuzzy Hash: 7785df124227ca2189d2f1e5e9692317ca2612ea228bf4003116393ecc44e874
Instruction Fuzzy Hash: 2231FA32604B4484E784DB35D9812F9B3E9FFA8B4CFA88436964D4A5E9DF76C157C320

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 5792, Parent PID: 6572COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000267F4942254 Relevance: 6.2, APIs: 4, Instructions: 230
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00000267F49423B2
VirtualProtect.KERNELBASE ref: 00000267F4942476
RtlAvlRemoveNode.NTDLL ref: 00000267F49425B8
VirtualProtect.KERNELBASE ref: 00000267F494267E

Memory Dump Source

Source File: 00000003.00000002.366848785.00000267F4940000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000267F4940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_267f4940000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 5be500564576e27efb21694368d3cfa9554e3f10a740d94740bbe2c04abcc7cb
Instruction ID: f16ddecbb27faf05100b04cb2f0039bb68eb624e2d53b0b7d3f774d13ade35dc
Opcode Fuzzy Hash: 5be500564576e27efb21694368d3cfa9554e3f10a740d94740bbe2c04abcc7cb
Instruction Fuzzy Hash: 61B13076618BC586D770CB1AF440B9AB7A1F7C9B84F108026EE8957B69DF7EC8418F40

Uniqueness

Uniqueness Score: -1.00%

Function 00000267F494205A Relevance: 1.3, APIs: 1, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,00000267F49429A5), ref: 00000267F49420AA

Memory Dump Source

Source File: 00000003.00000002.366848785.00000267F4940000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000267F4940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_267f4940000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 011c6879bde9f1e75c40580259034cfef7b37f76bdcbeed9748d12d6c56c4f62
Instruction ID: ceb594ec032d438669cadf9a7a9dd15f7195d11963bb7548d142ac146708a4e4
Opcode Fuzzy Hash: 011c6879bde9f1e75c40580259034cfef7b37f76bdcbeed9748d12d6c56c4f62
Instruction Fuzzy Hash: 3D314D72719B8086D790CF1AF45575A7BA0F389BD4F109026EF4D97B28DF3AC4428B00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 4484, Parent PID: 6612COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000018772C82254 Relevance: 6.2, APIs: 4, Instructions: 230
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 0000018772C823B2
VirtualProtect.KERNELBASE ref: 0000018772C82476
RtlAvlRemoveNode.NTDLL ref: 0000018772C825B8
VirtualProtect.KERNELBASE ref: 0000018772C8267E

Memory Dump Source

Source File: 00000004.00000002.289788927.0000018772C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018772C80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_18772c80000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 5be500564576e27efb21694368d3cfa9554e3f10a740d94740bbe2c04abcc7cb
Instruction ID: f9279df6191c4f9da5b4ac982a9937711ea3d8874a1c2d7c4eb769384b886f68
Opcode Fuzzy Hash: 5be500564576e27efb21694368d3cfa9554e3f10a740d94740bbe2c04abcc7cb
Instruction Fuzzy Hash: 6CB14176618BC58AD770CB1AE4407DAB7A1F7D9B80F208026EE8957B98DF79C941CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0000018772C8205A Relevance: 1.3, APIs: 1, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000018772C829A5), ref: 0000018772C820AA

Memory Dump Source

Source File: 00000004.00000002.289788927.0000018772C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018772C80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_18772c80000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 011c6879bde9f1e75c40580259034cfef7b37f76bdcbeed9748d12d6c56c4f62
Instruction ID: c4c6de22a482e1088448bb0d36f80a90b362e94d499e7816dd3bd02489a8d8d3
Opcode Fuzzy Hash: 011c6879bde9f1e75c40580259034cfef7b37f76bdcbeed9748d12d6c56c4f62
Instruction Fuzzy Hash: E7316B72615B8086D790CF1AE45479A7BB0F389BD4F209026EF8E97B58DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 568, Parent PID: 6572COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000014C9A262254 Relevance: 6.2, APIs: 4, Instructions: 230
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 0000014C9A2623B2
VirtualProtect.KERNELBASE ref: 0000014C9A262476
RtlAvlRemoveNode.NTDLL ref: 0000014C9A2625B8
VirtualProtect.KERNELBASE ref: 0000014C9A26267E

Memory Dump Source

Source File: 00000006.00000002.296690512.0000014C9A260000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014C9A260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c9a260000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 5be500564576e27efb21694368d3cfa9554e3f10a740d94740bbe2c04abcc7cb
Instruction ID: af97b28288f58b5eeeb18cfbf6ccbbfb238e8d217911e00166fd847ec75bc9cc
Opcode Fuzzy Hash: 5be500564576e27efb21694368d3cfa9554e3f10a740d94740bbe2c04abcc7cb
Instruction Fuzzy Hash: 02B16776619BC486DB70CB1AE4407EEB7A1F7C9B84F108026DE8D53B69DB79C8518F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000014C9A26205A Relevance: 1.3, APIs: 1, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000014C9A2629A5), ref: 0000014C9A2620AA

Memory Dump Source

Source File: 00000006.00000002.296690512.0000014C9A260000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014C9A260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c9a260000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 011c6879bde9f1e75c40580259034cfef7b37f76bdcbeed9748d12d6c56c4f62
Instruction ID: 6c36949723612317465e262174faaf6ceb6d2d4b17694aa5b7769b02fef073ab
Opcode Fuzzy Hash: 011c6879bde9f1e75c40580259034cfef7b37f76bdcbeed9748d12d6c56c4f62
Instruction Fuzzy Hash: 9D312D72715B8086D790DF1AE45479E7BA0F389BD4F109026EF4D97B68DF3AC4468B40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 5456, Parent PID: 6572COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000001BDE0FE2254 Relevance: 6.2, APIs: 4, Instructions: 230
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001BDE0FE23B2
VirtualProtect.KERNELBASE ref: 000001BDE0FE2476
RtlAvlRemoveNode.NTDLL ref: 000001BDE0FE25B8
VirtualProtect.KERNELBASE ref: 000001BDE0FE267E

Memory Dump Source

Source File: 00000008.00000002.304967424.000001BDE0FE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BDE0FE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1bde0fe0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 5be500564576e27efb21694368d3cfa9554e3f10a740d94740bbe2c04abcc7cb
Instruction ID: 6f998248978026aa06c4af0abb896f2583eb63b2552d4504158ff8968f8b053a
Opcode Fuzzy Hash: 5be500564576e27efb21694368d3cfa9554e3f10a740d94740bbe2c04abcc7cb
Instruction Fuzzy Hash: C5B15576619BC486D7708B1AF440BDEB7A1F799B90F108026EF8957B58DB39C852CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000001BDE0FE205A Relevance: 1.3, APIs: 1, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001BDE0FE29A5), ref: 000001BDE0FE20AA

Memory Dump Source

Source File: 00000008.00000002.304967424.000001BDE0FE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BDE0FE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1bde0fe0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 011c6879bde9f1e75c40580259034cfef7b37f76bdcbeed9748d12d6c56c4f62
Instruction ID: ac2e20b523d49d14b2b481edac808aa149e377609385777ff651f253e3b51759
Opcode Fuzzy Hash: 011c6879bde9f1e75c40580259034cfef7b37f76bdcbeed9748d12d6c56c4f62
Instruction Fuzzy Hash: 3E312C72615A9086D790DF1AE45579E7BA0F389BD4F209026EF4D9BB18DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: consent.exePID: 3576, Parent PID: 3352COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.3%
Total number of Nodes:	1721
Total number of Limit Nodes:	3

Executed Functions

Function 00007FF679F910D0 Relevance: 216.5, APIs: 115, Strings: 8, Instructions: 1299nativememoryfileCOMMON

Download Yara Rule

APIs

EtwRegisterTraceGuidsW.NTDLL ref: 00007FF679F911EA
HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F91203
EventRegister.API-MS-WIN-EVENTING-PROVIDER-L1-1-0 ref: 00007FF679F9121C
RtlInitString.NTDLL ref: 00007FF679F9125A
LsaRegisterLogonProcess.SSPICLI ref: 00007FF679F9126D
RtlInitString.NTDLL ref: 00007FF679F91288
LsaLookupAuthenticationPackage.SSPICLI ref: 00007FF679F9129B
LsaCallAuthenticationPackage.SSPICLI ref: 00007FF679F912F5
LsaDeregisterLogonProcess.SSPICLI ref: 00007FF679F91310
memset.MSVCRT ref: 00007FF679F9132D
WinStationQueryInformationW.WINSTA ref: 00007FF679F91358
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF679F91378
swscanf_s.MSVCRT ref: 00007FF679F913B2
swscanf_s.MSVCRT ref: 00007FF679F913DA
swscanf_s.MSVCRT ref: 00007FF679F913F8
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9140B
NtOpenProcess.NTDLL ref: 00007FF679F9145E
ImpersonateLoggedOnUser.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F91490
GetUserPreferredUILanguages.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF679F914B8
RevertToSelf.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F914C0
SetProcessPreferredUILanguages.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF679F914DB
CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F91503
ConvertStringSecurityDescriptorToSecurityDescriptorW.API-MS-WIN-SECURITY-SDDL-L1-1-0 ref: 00007FF679F9152B
MakeAbsoluteSD.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F91597
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9159D
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F915B4
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F915C7
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F915D8
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F915E6
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F915F4
MakeAbsoluteSD.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F91670
CoInitializeSecurity.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F916AA
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F916BD
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F916C6
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F916CF
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F916D8
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F916E2
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F916F8
memset.MSVCRT ref: 00007FF679F91728
GetSidLengthRequired.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F917B8
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F917C9
InitializeSid.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F917EC
GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F9180D
GetSidSubAuthority.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F91820
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9183B
EtwEventWrite.NTDLL ref: 00007FF679F9189E
EtwEventWrite.NTDLL ref: 00007FF679F918F4
NtQueryVolumeInformationFile.NTDLL ref: 00007FF679F91928
EtwEventWrite.NTDLL ref: 00007FF679F91988
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F919C3
EtwSendNotification.NTDLL ref: 00007FF679F91A02
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F91A0B

Part of subcall function 00007FF679F91F60: NtDuplicateToken.NTDLL ref: 00007FF679F91FEF
Part of subcall function 00007FF679F91F60: RtlNtStatusToDosErrorNoTeb.NTDLL ref: 00007FF679F91FF7

NtQueryInformationToken.NTDLL ref: 00007FF679F91A80
NtQueryInformationToken.NTDLL ref: 00007FF679F91AAD
NtClose.NTDLL ref: 00007FF679F91ABF
EtwEventWrite.NTDLL ref: 00007FF679F91AE9
EtwEventWrite.NTDLL ref: 00007FF679F91B11
NtDuplicateObject.NTDLL ref: 00007FF679F91B6B
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F91B77
NtWriteVirtualMemory.NTDLL ref: 00007FF679F91BA6
RtlInitString.NTDLL ref: 00007FF679F91BCD
LsaRegisterLogonProcess.SSPICLI ref: 00007FF679F91BE0
RtlInitString.NTDLL ref: 00007FF679F91BF5
LsaLookupAuthenticationPackage.SSPICLI ref: 00007FF679F91C08
LsaCallAuthenticationPackage.SSPICLI ref: 00007FF679F91C5F
LsaDeregisterLogonProcess.SSPICLI ref: 00007FF679F91C6E
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F91C82
EtwSendNotification.NTDLL ref: 00007FF679F91CC3
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F91CCC
NtClose.NTDLL ref: 00007FF679F91CE8
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F91D04
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F91D17
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F91D26
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F91D35
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F91D3E
NtClose.NTDLL ref: 00007FF679F91D68
NtClose.NTDLL ref: 00007FF679F91D7B
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F91D88
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F91DB7
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F91DC5
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F91DD3
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F91DE6
CertFreeCertificateContext.CRYPT32 ref: 00007FF679F91DF4
memset.MSVCRT ref: 00007FF679F91E0B
EventUnregister.API-MS-WIN-EVENTING-PROVIDER-L1-1-0 ref: 00007FF679F91EA0
CoUninitialize.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F91EAD
EtwUnregisterTraceGuids.NTDLL ref: 00007FF679F91ECD
DestroyIcon.USER32 ref: 00007FF679F91F4E
RtlNtStatusToDosError.NTDLL ref: 00007FF679F9597A
RtlNtStatusToDosError.NTDLL ref: 00007FF679F959D4

Part of subcall function 00007FF679F93380: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F933D2
Part of subcall function 00007FF679F93380: NtReadVirtualMemory.NTDLL ref: 00007FF679F93401
Part of subcall function 00007FF679F93380: NtDuplicateObject.NTDLL ref: 00007FF679F93435
Part of subcall function 00007FF679F93380: NtDuplicateObject.NTDLL ref: 00007FF679F9346E
Part of subcall function 00007FF679F93380: EtwEventWrite.NTDLL ref: 00007FF679F934B4
Part of subcall function 00007FF679F93380: NtDuplicateObject.NTDLL ref: 00007FF679F93500

RtlNtStatusToDosError.NTDLL ref: 00007FF679F95A06
RtlNtStatusToDosErrorNoTeb.NTDLL ref: 00007FF679F95E54
NtClose.NTDLL ref: 00007FF679F95E71

Strings

O:BAG:BAD:(A;;0x3;;;IU)(A;;0x3;;;SY)S:(ML;;NX;;;HI), xrefs: 00007FF679F91524
TRUE, xrefs: 00007FF679F95B95
Microsoft Windows (c) 2009 Microsoft Corporation, xrefs: 00007FF679F91222
ConsentUI, xrefs: 00007FF679F91243, 00007FF679F91BB6
Software\Microsoft\MediaCenterPeripheral, xrefs: 00007FF679F95928
FALSE, xrefs: 00007FF679F95B8A
BlockConsentUI, xrefs: 00007FF679F9590F
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0, xrefs: 00007FF679F9127D, 00007FF679F91BEA

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Local$Free$AllocClose$Event$Write$ErrorInformationProcess$DuplicateObjectStatusString$AuthenticationHandleInitLogonPackageQueryRegisterTaskToken$InitializeSecuritymemsetswscanf_s$AbsoluteCallDeregisterDescriptorGuidsHeapLanguagesLookupMakeMemoryNotificationPreferredSendTraceUnregisterUserVirtual$AuthorityCertCertificateCommandContextConvertDestroyFileGlobalIconImpersonateLastLengthLineLoggedOpenReadRequiredRevertSelfSingleStationUninitializeVolumeWait
String ID: BlockConsentUI$ConsentUI$FALSE$MICROSOFT_AUTHENTICATION_PACKAGE_V1_0$Microsoft Windows (c) 2009 Microsoft Corporation$O:BAG:BAD:(A;;0x3;;;IU)(A;;0x3;;;SY)S:(ML;;NX;;;HI)$Software\Microsoft\MediaCenterPeripheral$TRUE
API String ID: 1314931228-3125038416
Opcode ID: 940eee0e2c10b54a07ea211019aecd208bef5496832005ffeacbc3a4ba17b35b
Instruction ID: 0bef805b0e717847e6cebbecdeb9ac7037000767bea91c61b045c3b638d10cdb
Opcode Fuzzy Hash: 940eee0e2c10b54a07ea211019aecd208bef5496832005ffeacbc3a4ba17b35b
Instruction Fuzzy Hash: 40E23837B28AC38AEB20CF65E8442A927E0FB85768F544135DA4EC7AA4DF7CE545C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F94940 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF679F9494B

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0c08039c36c4a98cffeaa35831f9db072ad85e4cb2ec66eefda2a813b58ad3b7
Instruction ID: 0cfac2c16d98b26d2e6e4eab183334dbe3f16849ec5a1c034395e9c302738553
Opcode Fuzzy Hash: 0c08039c36c4a98cffeaa35831f9db072ad85e4cb2ec66eefda2a813b58ad3b7
Instruction Fuzzy Hash: 9BB09215F76883C9D604AF22AC8906112E0BF68314FC10430C00EC2120EF1CA19A8B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F943A0 Relevance: 12.1, APIs: 8, Instructions: 137
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF679F94AD0: GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B01
Part of subcall function 00007FF679F94AD0: GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B0F
Part of subcall function 00007FF679F94AD0: GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B1B
Part of subcall function 00007FF679F94AD0: GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B27
Part of subcall function 00007FF679F94AD0: GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B37
Part of subcall function 00007FF679F94AD0: QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B52

GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF679F943D1
_amsg_exit.MSVCRT ref: 00007FF679F9440C
Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF679F94418
_initterm.MSVCRT ref: 00007FF679F944A6
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF679F944D3
exit.KERNELBASE ref: 00007FF679F94564
_cexit.MSVCRT ref: 00007FF679F94573
_ismbblead.MSVCRT ref: 00007FF679F94596

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: 63c3275b775b2315c0d68cec4c0e8ce81620dc47f8642194da29ff36ff41ba60
Instruction ID: be988d523ec07165df9b9c6dc70a2dd043c33759233b56503a6e4b6d33aa6ac4
Opcode Fuzzy Hash: 63c3275b775b2315c0d68cec4c0e8ce81620dc47f8642194da29ff36ff41ba60
Instruction Fuzzy Hash: 8C512433E28A9786F760EF15E85037A22E0FF697A8F590035D95DC76A4DF7CE8458A00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF679F93940 Relevance: 71.0, APIs: 47, Instructions: 490memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F939EC
ImpersonateLoggedOnUser.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F93A05
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F93A0F
GetUserNameExW.SSPICLI ref: 00007FF679F93A2B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F93A35
RevertToSelf.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F94055
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F94070
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F94089
ConvertStringSecurityDescriptorToSecurityDescriptorW.API-MS-WIN-SECURITY-SDDL-L1-1-0 ref: 00007FF679F940AE
CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F940E0
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F940F0
ConvertStringSecurityDescriptorToSecurityDescriptorW.API-MS-WIN-SECURITY-SDDL-L1-1-0 ref: 00007FF679F94109
CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F9413B
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F94149
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F9415C
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F94169
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F94172
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F94180
UnloadUserProfile.USERENV ref: 00007FF679F941B1
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F941BA
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F941D9

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: CloseHandle$DescriptorEventLocalSecurity$FreeUser$ConvertCreateErrorLastString$AllocImpersonateLoggedNameProfileRevertSelfUnload
String ID:
API String ID: 3490941813-0
Opcode ID: 3d21345d0a2389a2903e0e4cc1b664589a5cc136661fbb59c8dda6ff7e2a718a
Instruction ID: 13d338a81fb4bef41b706f95e14fa6b9756a0efdae30168db8c65aab7e6e10df
Opcode Fuzzy Hash: 3d21345d0a2389a2903e0e4cc1b664589a5cc136661fbb59c8dda6ff7e2a718a
Instruction Fuzzy Hash: C3227B37B28BD385FB649F65A88827923E0EF45BA8F154135DA1DC37A4DF7DA8488301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F959B4 Relevance: 51.0, APIs: 27, Strings: 2, Instructions: 201
nativememoryencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF679F9A238: EtwTraceMessage.NTDLL ref: 00007FF679F9A261

RtlInitString.NTDLL ref: 00007FF679F91BCD
LsaRegisterLogonProcess.SSPICLI ref: 00007FF679F91BE0
RtlInitString.NTDLL ref: 00007FF679F91BF5
LsaLookupAuthenticationPackage.SSPICLI ref: 00007FF679F91C08
LsaCallAuthenticationPackage.SSPICLI ref: 00007FF679F91C5F
LsaDeregisterLogonProcess.SSPICLI ref: 00007FF679F91C6E
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F91C82
EtwSendNotification.NTDLL ref: 00007FF679F91CC3
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F91CCC
NtClose.NTDLL ref: 00007FF679F91CE8
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F91D04
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F91D17
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F91D26
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F91D35
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F91D3E
NtClose.NTDLL ref: 00007FF679F91D68
NtClose.NTDLL ref: 00007FF679F91D7B
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F91D88
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F91DB7
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F91DC5
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F91DD3
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F91DE6
CertFreeCertificateContext.CRYPT32 ref: 00007FF679F91DF4
memset.MSVCRT ref: 00007FF679F91E0B
EventUnregister.API-MS-WIN-EVENTING-PROVIDER-L1-1-0 ref: 00007FF679F91EA0
CoUninitialize.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F91EAD
EtwUnregisterTraceGuids.NTDLL ref: 00007FF679F91ECD

Strings

ConsentUI, xrefs: 00007FF679F91BB6
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0, xrefs: 00007FF679F91BEA

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Free$Close$LocalTask$Handle$AuthenticationInitLogonPackageProcessStringTraceUnregister$AllocCallCertCertificateContextDeregisterEventGuidsLookupMessageNotificationObjectRegisterSendSingleUninitializeWaitmemset
String ID: ConsentUI$MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
API String ID: 2158492339-2701293193
Opcode ID: 8840379615fe0c9efddfa03aeee61ce24276b724681c730d928d2ade057b4e79
Instruction ID: c67c3c6ef4ea814a725cf3e8b6a180d81b2d170d456f5fdf45fbb606e6453908
Opcode Fuzzy Hash: 8840379615fe0c9efddfa03aeee61ce24276b724681c730d928d2ade057b4e79
Instruction Fuzzy Hash: 26A10826B29FC38AEB65CF61E8542A827E4FB85B98F054135DA4E87A54DF3CE548C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9AAB0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 235
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9AB35
memset.MSVCRT ref: 00007FF679F9AB53
memcpy.MSVCRT ref: 00007FF679F9AB76
SeciAllocateAndSetCallFlags.SSPICLI ref: 00007FF679F9ABF6
RtlInitString.NTDLL ref: 00007FF679F9AC07
LsaRegisterLogonProcess.SSPICLI ref: 00007FF679F9AC19
RtlNtStatusToDosError.NTDLL ref: 00007FF679F9AC25
LsaFreeReturnBuffer.SSPICLI ref: 00007FF679F9ADD3
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F9ADE2
LsaDeregisterLogonProcess.SSPICLI ref: 00007FF679F9ADF1
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F9AE0B
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9AE14

Strings

Winlogon, xrefs: 00007FF679F9ABFC

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Free$LocalLogonProcess$AllocAllocateBufferCallCloseDeregisterErrorFlagsHandleInitRegisterReturnSeciStatusStringTaskmemcpymemset
String ID: Winlogon
API String ID: 1693999484-744610081
Opcode ID: ada491b27562d3412a9634d2f259be747cdf0da85b494c8f7eece2d79c689b54
Instruction ID: 0b0602f641e629c3a69d7a7f70e7355d617bfd35a44479420f2dba5d88e7d6a1
Opcode Fuzzy Hash: ada491b27562d3412a9634d2f259be747cdf0da85b494c8f7eece2d79c689b54
Instruction Fuzzy Hash: BEB11436A29B828AEB10CF65E4806AD37F4FB48B58B514136DE8D93B64DF3CE555CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9D574 Relevance: 28.8, APIs: 19, Instructions: 303
memorythreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF679F9D5AA
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9D5D4
CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F9D62A
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9D660

Part of subcall function 00007FF679F9A238: EtwTraceMessage.NTDLL ref: 00007FF679F9A261

CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF679F9D6B5
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9D6DC
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9D6FE
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F9D86A
EtwEventWrite.NTDLL ref: 00007FF679F9D91B
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF679F9D921
WmsgSendMessage.WMSGAPI ref: 00007FF679F9D942
RtlNtStatusToDosError.NTDLL ref: 00007FF679F9D984
EtwEventWrite.NTDLL ref: 00007FF679F9D9C7
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF679F9D9D4
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F9D9EA

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ErrorEvent$CloseCountCreateHandleLastLocalMessageTickWrite$AllocCurrentFreeProcessSendStatusThreadTraceWmsg
String ID:
API String ID: 2066120322-0
Opcode ID: 0ece021af2e5bbf01638358dbbadf21677eae37f36c9973c6e1376814828987f
Instruction ID: 067a968f59a9130a3186ba86dceeabcca07217edf9f2b2d18fa052456cb09b03
Opcode Fuzzy Hash: 0ece021af2e5bbf01638358dbbadf21677eae37f36c9973c6e1376814828987f
Instruction Fuzzy Hash: E3E17D37A28AC386EB14DF15D84427927E1FB45BA8F644036DA0EC7AA5CF7DE456C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9ED30 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 124
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetShellWindow.USER32 ref: 00007FF679F9ED67
GetWindowRect.USER32 ref: 00007FF679F9ED80
CreateFileMappingW.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF679F9EDC1
SendMessageTimeoutW.USER32 ref: 00007FF679F9EDFA
CreateDIBSection.GDI32 ref: 00007FF679F9EE45
CreateCompatibleDC.GDI32 ref: 00007FF679F9EE55
SelectObject.GDI32 ref: 00007FF679F9EE69
BitBlt.GDI32 ref: 00007FF679F9EE9B
SelectObject.GDI32 ref: 00007FF679F9EEAA
DeleteDC.GDI32 ref: 00007FF679F9EEB3
DeleteObject.GDI32 ref: 00007FF679F9EEBC
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F9EEC5
PatBlt.GDI32 ref: 00007FF679F9EEF1

Strings

B, xrefs: 00007FF679F9EEE2
, xrefs: 00007FF679F9EE6F
Local\Microsoft-Windows-DesktopBackground, xrefs: 00007FF679F9ED8A

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: CreateObject$DeleteSelectWindow$CloseCompatibleFileHandleMappingMessageRectSectionSendShellTimeout
String ID: $B$Local\Microsoft-Windows-DesktopBackground
API String ID: 2267755424-2070915447
Opcode ID: 97602d448d7a0d64b356a54eebcf58ccd4d53053855e27b3c76a815c09432a48
Instruction ID: ddbe59530b342538eda2f2c91f33dad67d45f4048a31f7744760acdb1741210e
Opcode Fuzzy Hash: 97602d448d7a0d64b356a54eebcf58ccd4d53053855e27b3c76a815c09432a48
Instruction Fuzzy Hash: A1518D37B29B828AEB10DF62A80466977E5FB49B98F464239DE0D93B54DF3CD405CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9A808 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 173
nativeregistrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF679F9A889
RtlAdjustPrivilege.NTDLL ref: 00007FF679F9A89A
LsaRegisterLogonProcess.SSPICLI ref: 00007FF679F9A8B7
NtAllocateLocallyUniqueId.NTDLL ref: 00007FF679F9A8CE
RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF679F9A907
LsaLogonUser.SSPICLI ref: 00007FF679F9A97D
LsaLogonUser.SSPICLI ref: 00007FF679F9A9FC
RtlNtStatusToDosError.NTDLL ref: 00007FF679F9AA45
NtClose.NTDLL ref: 00007FF679F9AA64
LsaFreeReturnBuffer.SSPICLI ref: 00007FF679F9AA73
LsaDeregisterLogonProcess.SSPICLI ref: 00007FF679F9AA82

Strings

InteractiveLogonFirst, xrefs: 00007FF679F9A8E4
CredProvConsent, xrefs: 00007FF679F9A83B
Software\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00007FF679F9A8FB

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Logon$ProcessUser$AdjustAllocateBufferCloseDeregisterErrorFreeLocallyPrivilegeRegisterReturnStatusUniqueValuememset
String ID: CredProvConsent$InteractiveLogonFirst$Software\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 3467969132-1257621240
Opcode ID: 284e21510437373785a2d7f589c9069567d096410125ca6fbfd78e0161a84a17
Instruction ID: 3370e807633e4b7902862c4d73f78c60fc04862ea402879e8e1fb79e2067427a
Opcode Fuzzy Hash: 284e21510437373785a2d7f589c9069567d096410125ca6fbfd78e0161a84a17
Instruction Fuzzy Hash: 5081C336B19B829AEB10CFA5E4806AD73F5EB48758B400139DA8D93A58EF3CD519C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F92C60 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 482
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF679F92CA8
ImpersonateLoggedOnUser.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F92D4C
RevertToSelf.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F92DC9
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F92DD3
GetSystemMetrics.USER32 ref: 00007FF679F92E35
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F92EA1
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF679F92F22

Strings

TRUE, xrefs: 00007FF679F92CF5, 00007FF679F92DE0, 00007FF679F92F56, 00007FF679F968F4, 00007FF679F96AAE
W, xrefs: 00007FF679F96915
FALSE, xrefs: 00007FF679F92CE6, 00007FF679F92DD9, 00007FF679F92F5D, 00007FF679F968FB, 00007FF679F96AB5
W, xrefs: 00007FF679F96825

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: CreateDriveFreeImpersonateInstanceLoggedMetricsRevertSelfSystemTaskTypeUsermemset
String ID: FALSE$TRUE$W$W
API String ID: 380875043-2421341635
Opcode ID: 75b7765715b5257bd25d8d8980dc53470390ce17ef591a445d49fc56cc71da30
Instruction ID: d6e9898a1cb257a510a11c96e20993b50debd077678f866f833f7fd0688684a3
Opcode Fuzzy Hash: 75b7765715b5257bd25d8d8980dc53470390ce17ef591a445d49fc56cc71da30
Instruction Fuzzy Hash: 26224A37A28A8786EB24DF25D8446B923E5FB45BA8F014132DA4EC3BA5DF3DE545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9C0CC Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

_wtoi.MSVCRT ref: 00007FF679F9C14D
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,00000000,?,?,0000000A,00007FF679F96A42), ref: 00007FF679F9C16B
CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,00000000,?,?,0000000A,00007FF679F96A42), ref: 00007FF679F9C17E
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,00000000,?,?,0000000A,00007FF679F96A42), ref: 00007FF679F9C19A
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,00000000,?,?,0000000A,00007FF679F96A42), ref: 00007FF679F9C1A7
CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,00000000,?,?,0000000A,00007FF679F96A42), ref: 00007FF679F9C260
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,00000000,?,?,0000000A,00007FF679F96A42), ref: 00007FF679F9C3BF
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,00000000,?,?,0000000A,00007FF679F96A42), ref: 00007FF679F9C3FB
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,00000000,?,?,0000000A,00007FF679F96A42), ref: 00007FF679F9C404

Strings

%s%s%s%s%s, xrefs: 00007FF679F9C286

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Task$Free$AllocInfoLocale$_wtoi
String ID: %s%s%s%s%s
API String ID: 2618417621-2610978714
Opcode ID: faf39c8d6cd064c1003b8f0dd0420065ba799b629d017e0fef2c6435cb65d594
Instruction ID: e507aa0e52ff78f08a403b0c37de353f167b5f50d88493073e8e604f0b79d787
Opcode Fuzzy Hash: faf39c8d6cd064c1003b8f0dd0420065ba799b629d017e0fef2c6435cb65d594
Instruction Fuzzy Hash: 27A15F67B29B8382EA549F25991067922E1FF45BB8F504232DE6EC37D8DF3CE4858704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F93380 Relevance: 13.7, APIs: 9, Instructions: 199nativememoryCOMMON

Download Yara Rule

APIs

HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F933D2
NtReadVirtualMemory.NTDLL ref: 00007FF679F93401
NtDuplicateObject.NTDLL ref: 00007FF679F93435
NtDuplicateObject.NTDLL ref: 00007FF679F9346E
EtwEventWrite.NTDLL ref: 00007FF679F934B4
NtDuplicateObject.NTDLL ref: 00007FF679F93500
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F97058

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: DuplicateObject$Heap$AllocEventFreeMemoryReadVirtualWrite
String ID:
API String ID: 491614474-0
Opcode ID: 38a11174f61b7cce3158488a8d6e1456c15c9873dace2d2091946d86059b8ce9
Instruction ID: e486b06657d4b0189f7d1023803fdc84342164a6447fa8d9ce371c833bcc28f4
Opcode Fuzzy Hash: 38a11174f61b7cce3158488a8d6e1456c15c9873dace2d2091946d86059b8ce9
Instruction Fuzzy Hash: 6C916E73A28B8286DB20CF29D44422977E4FB89BA8F144235DA5DC7798EF3DE851C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9C6CC Relevance: 12.2, APIs: 8, Instructions: 187COMMON

Download Yara Rule

APIs

WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF679F9C71F
WindowsCompareStringOrdinal.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF679F9C755
RaiseException.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9C76B
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF679F9C7B4
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF679F9C817
memset.MSVCRT ref: 00007FF679F9C85D
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF679F9C869
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF679F9C958

Part of subcall function 00007FF679F9CFD4: EtwTraceMessage.NTDLL ref: 00007FF679F9D03E

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: StringWindows$Delete$BufferCompareExceptionMessageOrdinalRaiseTracememset
String ID:
API String ID: 2934883565-0
Opcode ID: 24d4e45d1c55644b09def586142ccf952e506189b5a0e11465aaed664477fb2d
Instruction ID: 732a75518a0d17c3c03aff05da3d4e6cc0718e293cae1a070df8afee4619f4e0
Opcode Fuzzy Hash: 24d4e45d1c55644b09def586142ccf952e506189b5a0e11465aaed664477fb2d
Instruction Fuzzy Hash: 83811927A28AC782EB50DF25E88026A67E0FB85BA4F045035EE9EC3765DF3DD455CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9B020 Relevance: 10.6, APIs: 7, Instructions: 83memorynativeCOMMON

Download Yara Rule

APIs

NtQueryInformationToken.NTDLL ref: 00007FF679F9B054
RtlNtStatusToDosError.NTDLL ref: 00007FF679F9B06B
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,00007FF679F96251), ref: 00007FF679F9B07E
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,00007FF679F96251), ref: 00007FF679F9B0EC
RtlSubAuthoritySid.NTDLL ref: 00007FF679F9B11F
RtlSubAuthoritySid.NTDLL ref: 00007FF679F9B134

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: AuthorityLocal$AllocErrorFreeInformationQueryStatusToken
String ID:
API String ID: 134697546-0
Opcode ID: 1d0658bbc21f42e473f616f4e368dce9115a9f3f3dccd8fbe91e7778e62f066f
Instruction ID: 879d15dbfad49bc9821e9b9230376e197995b1b486873dbd4ee789f1cb12205a
Opcode Fuzzy Hash: 1d0658bbc21f42e473f616f4e368dce9115a9f3f3dccd8fbe91e7778e62f066f
Instruction Fuzzy Hash: 18318B37B28A928BE7148F12E48462D77A0FB88B95F058039CA4D87B64DF3DE815CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F94AD0 Relevance: 9.0, APIs: 6, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B01
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B0F
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B1B
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B27
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B37
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?,?,?,00007FF679F943A9), ref: 00007FF679F94B52

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 6d0cdc2d78082eb4a7d7cdf4a4d2663ae9ea4f01ca4d92b289326d4aa200cf59
Instruction ID: ac7cc44570b6ac420eecd90be4c3862e93ad69845359b9c8bb21c8e0c2bc366c
Opcode Fuzzy Hash: 6d0cdc2d78082eb4a7d7cdf4a4d2663ae9ea4f01ca4d92b289326d4aa200cf59
Instruction Fuzzy Hash: 48110B26B14F828AEB00DF61E84416933E4FB097A8B411A35EA6D83754EF7CD5648740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F91F60 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191nativeCOMMON

Download Yara Rule

APIs

NtDuplicateToken.NTDLL ref: 00007FF679F91FEF
RtlNtStatusToDosErrorNoTeb.NTDLL ref: 00007FF679F91FF7
ImpersonateLoggedOnUser.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F96180
RevertToSelf.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F96193

Strings

0, xrefs: 00007FF679F91FCD

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: DuplicateErrorImpersonateLoggedRevertSelfStatusTokenUser
String ID: 0
API String ID: 1528932592-4108050209
Opcode ID: fbb040aaaf263dda08a827431e3444a14085b2fd2c8133341b807e734ef2c8ac
Instruction ID: f80098faba8871ab0961cd91a71144ac8b26bc9414cad06c21b8cd3ea3683c57
Opcode Fuzzy Hash: fbb040aaaf263dda08a827431e3444a14085b2fd2c8133341b807e734ef2c8ac
Instruction Fuzzy Hash: DC912A33A28AC386FB608F15E84477962E5FB85798F144035DA4DC3AA9DF7DE891CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9AFD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

NtDuplicateToken.NTDLL ref: 00007FF679F9B00B
RtlNtStatusToDosErrorNoTeb.NTDLL ref: 00007FF679F9B013

Strings

0, xrefs: 00007FF679F9AFD9

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: DuplicateErrorStatusToken
String ID: 0
API String ID: 3791273963-4108050209
Opcode ID: eaf2eb0f86443ef3fb02d1402e6392b18156d88f5e7170f0e2b0192bcf0cd68a
Instruction ID: c5b42ad864107b42e9099b70ed25b5c6255b96038edac39eb54d694fb5af8ee2
Opcode Fuzzy Hash: eaf2eb0f86443ef3fb02d1402e6392b18156d88f5e7170f0e2b0192bcf0cd68a
Instruction Fuzzy Hash: BEE03077F38B8186E310CF70A40954E72E1FB84384F514335D68843600EF7D8555CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F97944 Relevance: 5.0, APIs: 4, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF679F97616,?,?,?,00007FF679F98C26), ref: 00007FF679F97975
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF679F97616,?,?,?,00007FF679F98C26), ref: 00007FF679F97983
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF679F97616,?,?,?,00007FF679F98C26), ref: 00007FF679F979A1
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF679F97616,?,?,?,00007FF679F98C26), ref: 00007FF679F979AF

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 64c2b0fc4226b00f776ac0e9beb43cf368554fabd588ad3b1efa1f632691267f
Instruction ID: 78f6e0acd5f731c5f54bc345fdef78bef4493f9923a3c2864bc348d9ade302ba
Opcode Fuzzy Hash: 64c2b0fc4226b00f776ac0e9beb43cf368554fabd588ad3b1efa1f632691267f
Instruction Fuzzy Hash: 11016D62B18B9686EB00CF66E440059B3B4FB48F94B4C8035DB8C83B18DF3CE492C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679FA0E88 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

FindResourceExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00007FF679FA0DF2,?,?,?,?,00000000,00007FF679F9C139,?,?,?,?,00000000,?), ref: 00007FF679FA0EC1
LoadResource.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00007FF679FA0DF2,?,?,?,?,00000000,00007FF679F9C139,?,?,?,?,00000000,?), ref: 00007FF679FA0ED4
LockResource.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00007FF679FA0DF2,?,?,?,?,00000000,00007FF679F9C139,?,?,?,?,00000000,?), ref: 00007FF679FA0EE2

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Resource$FindLoadLock
String ID:
API String ID: 2752051264-0
Opcode ID: ba763983280beb37cf959841ca2f8f93c2c959291dc6a3f642176b83ea4e8cf6
Instruction ID: 8ae0eb8565dff817d5067b3b25e2ae42ec9ed75f997744fd32c2fee445e9da36
Opcode Fuzzy Hash: ba763983280beb37cf959841ca2f8f93c2c959291dc6a3f642176b83ea4e8cf6
Instruction Fuzzy Hash: 26219063B29B9386EB548F65A45023962E0EF4AF84B084035EE4DD7758DE3DE850C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F95014 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0(?,?,?,00007FF679F9873C), ref: 00007FF679F9503B

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: DebuggerPresent
String ID:
API String ID: 1347740429-0
Opcode ID: 1b6e96f42492e7d50caee4dbbbf13e9157c0cf237e83a0ed2e457a477d76dfc6
Instruction ID: 1c83fc7d31468dca6c4123900869f049d1500104e80af4caf1d7db51dc709db5
Opcode Fuzzy Hash: 1b6e96f42492e7d50caee4dbbbf13e9157c0cf237e83a0ed2e457a477d76dfc6
Instruction Fuzzy Hash: F2E08626F2A6C34AFB586F61189113523D4AF57761F08143DCC4EC72A0EE1D78AC5360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9E850 Relevance: 40.5, APIs: 21, Strings: 2, Instructions: 261
windowregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32 ref: 00007FF679F9E8C6
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E8D0
LoadLibraryW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-1 ref: 00007FF679F9E92E
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E940
LoadStringW.USER32 ref: 00007FF679F9E979
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E983
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9E9ED
LoadIconW.USER32 ref: 00007FF679F9EAAF
LoadCursorW.USER32 ref: 00007FF679F9EAC4
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF679F9EAEE
RegisterClassW.USER32 ref: 00007FF679F9EAFC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9EB08
CreateWindowExW.USER32 ref: 00007FF679F9EB80
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9EB8B
ShowWindow.USER32 ref: 00007FF679F9EBC9
GetMessageW.USER32 ref: 00007FF679F9EC0D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9EC1C
UnregisterClassW.USER32 ref: 00007FF679F9EC9C
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9ECB7

Strings

$$$Secure UAP Dummy Window Class For Interim Dialog, xrefs: 00007FF679F9E87C
imageres.dll, xrefs: 00007FF679F9E927

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ErrorLast$Load$ClassFreeLibraryLocalStringWindow$AllocCreateCursorIconMessageRegisterShowUnregister
String ID: $$$Secure UAP Dummy Window Class For Interim Dialog$imageres.dll
API String ID: 677155613-2841547504
Opcode ID: 8d7d3c35a3cced3d440a923cfbf0355decb1178b3f54aadb432bfedb8f4f2f3e
Instruction ID: 10149894cdfa3a629a472e7965037527bae6983af8fcfcedb98e4b27cd818e99
Opcode Fuzzy Hash: 8d7d3c35a3cced3d440a923cfbf0355decb1178b3f54aadb432bfedb8f4f2f3e
Instruction Fuzzy Hash: 31C14732A2CBC381E7658F15E4443A966E1FB85BA4F554135CA9EC3AA4DF7CE445C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9B4B4 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 182
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF679F9B507
memset.MSVCRT ref: 00007FF679F9B52F
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF679F9B546
LoadStringW.USER32 ref: 00007FF679F9B560
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF679F9B570
LoadStringW.USER32 ref: 00007FF679F9B588
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF679F9B5AB
LoadStringW.USER32 ref: 00007FF679F9B5C3
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF679F9B5D3
LoadStringW.USER32 ref: 00007FF679F9B5EB
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9B67D
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F9B6D8
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9B6E7

Part of subcall function 00007FF679F9A218: EtwTraceMessage.NTDLL ref: 00007FF679F9A22B

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9B78B

Strings

, xrefs: 00007FF679F9B629
H, xrefs: 00007FF679F9B65F

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: HandleLoadModuleString$Localmemset$AllocErrorFreeLastMessageObjectSingleTraceWait
String ID: $H
API String ID: 1414692188-1323546614
Opcode ID: 8c18cf2a8790c3b67d0b2f72982d3ac43231f8a9322975c054c660eee088c4f1
Instruction ID: 61a8420a7de06cff8bea7637528b1191f9d8498f3717c3ad9b7018da8e2426bb
Opcode Fuzzy Hash: 8c18cf2a8790c3b67d0b2f72982d3ac43231f8a9322975c054c660eee088c4f1
Instruction Fuzzy Hash: 7C813A32A29B8386EB64CF61E8846A933E0FB85B58F544136CA4EC7798DF7CE545C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9E090 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EtwEventWrite.NTDLL ref: 00007FF679F9E0BC
WTSQuerySessionInformationW.WTSAPI32(?,?,?,?,00000001,00007FF679F9DAB4), ref: 00007FF679F9E0DC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000001,00007FF679F9DAB4), ref: 00007FF679F9E0FF

Part of subcall function 00007FF679F9A238: EtwTraceMessage.NTDLL ref: 00007FF679F9A261

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000001,00007FF679F9DAB4), ref: 00007FF679F9E124
EtwEventWrite.NTDLL ref: 00007FF679F9E143
WTSFreeMemory.WTSAPI32(?,?,?,?,00000001,00007FF679F9DAB4), ref: 00007FF679F9E150
EtwEventWrite.NTDLL ref: 00007FF679F9E1A3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000001,00007FF679F9DAB4), ref: 00007FF679F9E1E2
EtwEventWrite.NTDLL ref: 00007FF679F9E20E
_wcsicmp.MSVCRT ref: 00007FF679F9E21E
_wcsicmp.MSVCRT ref: 00007FF679F9E267
_wcsicmp.MSVCRT ref: 00007FF679F9E2B4

Part of subcall function 00007FF679F9A218: EtwTraceMessage.NTDLL ref: 00007FF679F9A22B

Part of subcall function 00007FF679FA01E8: EtwTraceMessage.NTDLL ref: 00007FF679FA0284

LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,00000001,00007FF679F9DAB4), ref: 00007FF679F9E327

Strings

Screen-saver, xrefs: 00007FF679F9E2AA
winlogon, xrefs: 00007FF679F9E214

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: EventWrite$ErrorLastMessageTrace_wcsicmp$Free$InformationLocalMemoryQuerySession
String ID: Screen-saver$winlogon
API String ID: 1397932087-3534835409
Opcode ID: cd536bb32b12b1e2001bc9e604705d68df8889e55565778c26a46f08fdc3f712
Instruction ID: 70ec4b9462c42adbbbe54c2f0560b938bfe988b3ddaf38d0181d9baa9014699b
Opcode Fuzzy Hash: cd536bb32b12b1e2001bc9e604705d68df8889e55565778c26a46f08fdc3f712
Instruction Fuzzy Hash: C7811332A2CAC385EB148F15E8507B827E1FF86BA8F548431C94EC76A4DFADE546C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F97EAC Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 151
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF679F97F8D
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF679F98006

Strings

ReturnHr, xrefs: 00007FF679F97F4F
LogHr, xrefs: 00007FF679F97F46
%hs!%p: , xrefs: 00007FF679F97FD1
CallContext:[%hs] , xrefs: 00007FF679F98089
Msg:[%ws] , xrefs: 00007FF679F9806E
[%hs], xrefs: 00007FF679F980C9
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF679F98019
Exception, xrefs: 00007FF679F97F58
[%hs(%hs)], xrefs: 00007FF679F980B0
%hs(%d)\%hs!%p: , xrefs: 00007FF679F97FB3
FailFast, xrefs: 00007FF679F97F3D
(caller: %p) , xrefs: 00007FF679F97FF1
, xrefs: 00007FF679F98053

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%d)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-2849347638
Opcode ID: 060396ede6836cc2de2ac2224add90ac5d042a73a2d3161d2f61deef7bd0de27
Instruction ID: 70522a28b12eea3de42cf675740070bd3c0b4b1dbd1c75911f7c2aa3a1a62127
Opcode Fuzzy Hash: 060396ede6836cc2de2ac2224add90ac5d042a73a2d3161d2f61deef7bd0de27
Instruction Fuzzy Hash: 54615963A38BC381EA24DF61A4046BA63E0FF45BA8F454136DA4DD77A9DF3CE5508740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9E55C Relevance: 25.7, APIs: 17, Instructions: 165
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EtwEventWrite.NTDLL ref: 00007FF679F9E5A0
GetDC.USER32 ref: 00007FF679F9E5A9
CreateCompatibleDC.GDI32 ref: 00007FF679F9E5BA
CreateCompatibleBitmap.GDI32 ref: 00007FF679F9E5EC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E5FF
SelectObject.GDI32 ref: 00007FF679F9E63B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E646
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E782
ReleaseDC.USER32 ref: 00007FF679F9E7CA
DeleteObject.GDI32 ref: 00007FF679F9E7D8
EtwEventWrite.NTDLL ref: 00007FF679F9E7F2

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ErrorLast$CompatibleCreateEventObjectWrite$BitmapDeleteReleaseSelect
String ID:
API String ID: 3545452201-0
Opcode ID: 55b5235950708ed3279645c731c22642f46337bfe29f92419ac9fbe5417875c1
Instruction ID: 0c4bcc1bcf17a3220d4dc9d32351ae0457476b43692041cd3d7246480b1a390a
Opcode Fuzzy Hash: 55b5235950708ed3279645c731c22642f46337bfe29f92419ac9fbe5417875c1
Instruction Fuzzy Hash: 81815436B2DB8386EB548F21A85837923E0EB8AB94F144435DA5EC77A4CF7CE8018701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679FA06E0 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337
libraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF679FA074B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679FA0759
memset.MSVCRT ref: 00007FF679FA0850
CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679FA0933
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679FA0946

Part of subcall function 00007FF679FA05BC: RegOpenCurrentUser.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF679FA05E0
Part of subcall function 00007FF679FA05BC: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF679FA0678

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF679FA0AB0
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679FA0ABF
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF679FA0B08
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679FA0C28
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679FA0C36
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF679FA0C62

Strings

audioses.dll, xrefs: 00007FF679FA0744
@B^E, xrefs: 00007FF679FA07F0

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: CloseErrorLast$CreateFileHandleLibrary$CurrentEventFreeLoadOpenTypeUsermemset
String ID: @B^E$audioses.dll
API String ID: 2876429159-1282506805
Opcode ID: d0fcbaf146fbdd1769b0ddc519b10e99716f830cbac5cc7ff8217c97c7750bd5
Instruction ID: 7a8e6b59c1a3179f4f699e3fa1886c8111da537a130554e22bbda140db2bd52e
Opcode Fuzzy Hash: d0fcbaf146fbdd1769b0ddc519b10e99716f830cbac5cc7ff8217c97c7750bd5
Instruction Fuzzy Hash: 02F13923A28BC781EB10CF25E8506A967F0FB86798F548135DA4E87BA5DF7CE585C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F932B0 Relevance: 22.6, APIs: 15, Instructions: 126memorysynchronizationthreadCOMMON

Download Yara Rule

APIs

LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F932C5
CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F932E3
CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F93302
CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF679F93334
QueueUserAPC.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF679F93353
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F96E04
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F96E34
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F96E5C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F96E84
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F96EC6
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F96ED0
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F96EE1
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F96EEA
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F96EF9
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F96F02

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ErrorLast$CloseCreateEventHandle$Local$AllocFreeObjectQueueSingleThreadUserWait
String ID:
API String ID: 1429053732-0
Opcode ID: 3c482ecf7030dc25b736788c6e6c126186b5d84ab3906d5f0b598b0fdea1dfc4
Instruction ID: 2ca3be10f4de8dbbb6d4c2257df5db1ad84fdf0cc733df80f9ef832946c535ad
Opcode Fuzzy Hash: 3c482ecf7030dc25b736788c6e6c126186b5d84ab3906d5f0b598b0fdea1dfc4
Instruction Fuzzy Hash: 4B512837A29E8386FB58DF25E81427823E1EF85B98F188435C91EC36A4DF7CE8458344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F92A00 Relevance: 19.7, APIs: 13, Instructions: 235memoryinjectionsynchronizationCOMMON

Download Yara Rule

APIs

LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F92A73
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F92A8B
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F92AA3
QueueUserAPC.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF679F92AE8
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F92B02
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F92B3B
QueueUserAPC.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF679F92B6A
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F96461
CoCancelCall.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F96539
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F96562
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F965D4
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F965E3
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F965EC

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Local$Alloc$Free$ErrorLastQueueUser$CallCancelObjectSingleWait
String ID:
API String ID: 3629817563-0
Opcode ID: 1aa3ed89118671ebc43add6e750f34f09290828d18ebd8ddc84d68243b274888
Instruction ID: 63bf0ee9ed243ad536aaaced2cb02f498a7d6b31332a377b94b39c028b1d8af8
Opcode Fuzzy Hash: 1aa3ed89118671ebc43add6e750f34f09290828d18ebd8ddc84d68243b274888
Instruction Fuzzy Hash: A5B13533A29A8386EB54CF15E8447B933E0EB45B68F558431DA4EC76A4DF7CE84A8740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9AE4C Relevance: 19.6, APIs: 13, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

RtlLengthRequiredSid.NTDLL ref: 00007FF679F9AE97
RtlLengthRequiredSid.NTDLL ref: 00007FF679F9AEA2
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,00000000), ref: 00007FF679F9AEB0
RtlLengthRequiredSid.NTDLL ref: 00007FF679F9AECF
RtlInitializeSid.NTDLL ref: 00007FF679F9AEEA
RtlSubAuthoritySid.NTDLL ref: 00007FF679F9AEF5
RtlSubAuthoritySid.NTDLL ref: 00007FF679F9AF09
RtlSubAuthoritySid.NTDLL ref: 00007FF679F9AF1A
RtlInitializeSid.NTDLL ref: 00007FF679F9AF38
RtlSubAuthoritySid.NTDLL ref: 00007FF679F9AF43
SeciAllocateAndSetIPAddress.SSPICLI(?,?,?,?,00000000), ref: 00007FF679F9AF7D
SeciFreeCallContext.SSPICLI(?,?,?,?,00000000), ref: 00007FF679F9AF98
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,00000000), ref: 00007FF679F9AFA1

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Authority$LengthRequired$FreeInitializeLocalSeci$AddressAllocAllocateCallContext
String ID:
API String ID: 422712524-0
Opcode ID: 72f91d84b24b300e0affb6d17c6e23072b4a18bfd84108dcc0ddd08e7aec4a2a
Instruction ID: 2769dd9e709a1e4e4d1c1714feb3083531fec7f7409dd7b630cebbe309417469
Opcode Fuzzy Hash: 72f91d84b24b300e0affb6d17c6e23072b4a18bfd84108dcc0ddd08e7aec4a2a
Instruction Fuzzy Hash: 6341697BB14A528AF700CF62E8542AD73B1FB89B98F454435CE0A87B54EF7CA45AC700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F98418 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 88synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF679F99D37), ref: 00007FF679F9842A

Strings

wil, xrefs: 00007FF679F9843F, 00007FF679F98541

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: 2c0373b28f76578aa9df17f6d571699a82e765928cf642f925477c393d57872f
Instruction ID: 3d2f79defd7091fabba37d0b4cbee40eebdcec4cc2e8e83c9b4fbdeda4f36e87
Opcode Fuzzy Hash: 2c0373b28f76578aa9df17f6d571699a82e765928cf642f925477c393d57872f
Instruction Fuzzy Hash: D1313BA3B3C5C382F7608F25A94477A22E1EF817A5F605132D55AC7AD4DE3DE8498601

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9DD30 Relevance: 15.1, APIs: 10, Instructions: 131COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32 ref: 00007FF679F9DD6D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9DD9C

Part of subcall function 00007FF679F9A238: EtwTraceMessage.NTDLL ref: 00007FF679F9A261

memset.MSVCRT ref: 00007FF679F9DDCE
CreateDIBSection.GDI32 ref: 00007FF679F9DE10
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9DE3F
DeleteDC.GDI32 ref: 00007FF679F9DF3C

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: CreateErrorLast$CompatibleDeleteMessageSectionTracememset
String ID:
API String ID: 2042122949-0
Opcode ID: d51d535511b30bea6ace68f6dec5e42e58a9f3c929de03feb12fbc4f7c249d36
Instruction ID: cea58eb77f2af10eeeb98a6f59b2135e5af76efebfe3f6953d01857c55966440
Opcode Fuzzy Hash: d51d535511b30bea6ace68f6dec5e42e58a9f3c929de03feb12fbc4f7c249d36
Instruction Fuzzy Hash: 9C512A33A38A839AEB10CF11E8047A963E0FB86B9CF554136EA0E87664DF7CE5458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9DA40 Relevance: 15.1, APIs: 10, Instructions: 89windowsleepsynchronizationCOMMON

Download Yara Rule

APIs

EtwEventWrite.NTDLL ref: 00007FF679F9DA6C
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF679F9DA72
WmsgSendMessage.WMSGAPI ref: 00007FF679F9DA94

Part of subcall function 00007FF679F9E4D8: GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF679F9DA9F), ref: 00007FF679F9E4E4
Part of subcall function 00007FF679F9E4D8: GetThreadDesktop.USER32(?,?,00000000,00007FF679F9DA9F), ref: 00007FF679F9E4EC
Part of subcall function 00007FF679F9E4D8: CloseDesktop.USER32(?,?,00000000,00007FF679F9DA9F), ref: 00007FF679F9E508

Part of subcall function 00007FF679F9E090: EtwEventWrite.NTDLL ref: 00007FF679F9E0BC
Part of subcall function 00007FF679F9E090: WTSQuerySessionInformationW.WTSAPI32(?,?,?,?,00000001,00007FF679F9DAB4), ref: 00007FF679F9E0DC
Part of subcall function 00007FF679F9E090: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000001,00007FF679F9DAB4), ref: 00007FF679F9E0FF
Part of subcall function 00007FF679F9E090: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000001,00007FF679F9DAB4), ref: 00007FF679F9E124

Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF679F9DAC4
EtwEventWrite.NTDLL ref: 00007FF679F9DAE5
PostMessageW.USER32 ref: 00007FF679F9DB0C
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F9DB26
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9DB42
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F9DB78
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9DBA3

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ErrorEventLastWrite$CloseCurrentDesktopMessageThread$FreeHandleInformationLocalObjectPostProcessQuerySendSessionSingleSleepWaitWmsg
String ID:
API String ID: 1459231317-0
Opcode ID: 10601bb6fe27d357ab27081a837f8ed4986836c0097be689f06a8cdf717aa20c
Instruction ID: 404bcd2c2ce4f49707197a31e721d21de459bde1717218a0b89d17340273e603
Opcode Fuzzy Hash: 10601bb6fe27d357ab27081a837f8ed4986836c0097be689f06a8cdf717aa20c
Instruction Fuzzy Hash: EA412737A38A8386FA549F15E89877523E1EF86BA8F545032D90EC76A1CF7CA449C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F92FD0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 243encryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF679F9306E
memset.MSVCRT ref: 00007FF679F93082
memset.MSVCRT ref: 00007FF679F93097
CertFreeCertificateContext.CRYPT32 ref: 00007FF679F96D2E

Strings

TRUE, xrefs: 00007FF679F96C4D, 00007FF679F96C59, 00007FF679F96CEF, 00007FF679F96D9D
NULL, xrefs: 00007FF679F96C64
FALSE, xrefs: 00007FF679F930DA, 00007FF679F96CE4, 00007FF679F96D93
X, xrefs: 00007FF679F930A3

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: memset$CertCertificateContextFree
String ID: FALSE$NULL$TRUE$X
API String ID: 488843482-2970198400
Opcode ID: e0ecc7e6e3191f1e6cd953be9c89745b23701e0e794191e3838f541230b7185e
Instruction ID: 0ec1736729c30ee7ccb5ebf3cb86adf016f175c6e26dbbe1184d930222a1425b
Opcode Fuzzy Hash: e0ecc7e6e3191f1e6cd953be9c89745b23701e0e794191e3838f541230b7185e
Instruction Fuzzy Hash: 2CC15933A28BC785EB20CF11E8443A967E5FB457A8F504036DA4E97AA8DFBDE545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9EFA4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF679F9EFC1
GetDesktopWindow.USER32 ref: 00007FF679F9EFCA
GetWindowBand.USER32 ref: 00007FF679F9EFF4
GetParent.USER32 ref: 00007FF679F9F04A
GetAncestor.USER32 ref: 00007FF679F9F0F0
GetPropW.USER32 ref: 00007FF679F9F12D

Strings

AllowConsentToStealFocus, xrefs: 00007FF679F9F123

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Window$AncestorBandDesktopForegroundParentProp
String ID: AllowConsentToStealFocus
API String ID: 419753130-2125348190
Opcode ID: a2317f687a439c3ec87e68a716e9043f81bdc2e45beaa7a5433506624e6a3f2e
Instruction ID: af2603927362f1c3bb321dcf361d135e4190597cd63b13852f6b0ff7181fe604
Opcode Fuzzy Hash: a2317f687a439c3ec87e68a716e9043f81bdc2e45beaa7a5433506624e6a3f2e
Instruction Fuzzy Hash: F9515C23A296C345FB99CF05D51537423D1EF82BA8F684032CD0ED76A5DEBDE8868780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679FA003C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71windowCOMMON

Download Yara Rule

APIs

BeginPaint.USER32 ref: 00007FF679FA0068
GetWindowDC.USER32 ref: 00007FF679FA0071
GetLayout.GDI32 ref: 00007FF679FA009F

Part of subcall function 00007FF679FA0290: EtwTraceMessage.NTDLL ref: 00007FF679FA02C0

BitBlt.GDI32 ref: 00007FF679FA0133
ReleaseDC.USER32 ref: 00007FF679FA013F
EndPaint.USER32 ref: 00007FF679FA014D

Strings

, xrefs: 00007FF679FA0118

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Paint$BeginLayoutMessageReleaseTraceWindow
String ID:
API String ID: 2660142050-3916222277
Opcode ID: 3a2c93ca69e43fad927191d85ab710223b0d35e792a0df8edd8125c207e329be
Instruction ID: ab372e2f0aa472338593406a487b6557e6173471df49f05ac04da1a3fcf53e0a
Opcode Fuzzy Hash: 3a2c93ca69e43fad927191d85ab710223b0d35e792a0df8edd8125c207e329be
Instruction Fuzzy Hash: EA310136A2878286EB54CF15F45462AB7E0FB8AB94F144131DE4E83B68CF7DE445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9CD20 Relevance: 12.1, APIs: 8, Instructions: 80memorylibrarywindowCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0(00000000,00000000,00000000,00007FF679F9BF2C), ref: 00007FF679F9CDA2
LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF679F96A8F), ref: 00007FF679F9CDD6
_errno.MSVCRT ref: 00007FF679F9CDDF
_wtol.MSVCRT ref: 00007FF679F9CDEA
_errno.MSVCRT ref: 00007FF679F9CDF7
LoadIconW.USER32 ref: 00007FF679F9CE07
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF679F96A8F), ref: 00007FF679F9CE13
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF679F96A8F), ref: 00007FF679F9CE1C

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: FreeLibraryLoadTask_errno$AllocIcon_wtol
String ID:
API String ID: 3883829943-0
Opcode ID: 1bea2f343861c28689dae4db68f67a7e16fdb981ebd31af88e725b1a45b67d5f
Instruction ID: 6361c2377473ed2707bb383c73a3ced724c7b58e610a22aba12da0e0f972e01c
Opcode Fuzzy Hash: 1bea2f343861c28689dae4db68f67a7e16fdb981ebd31af88e725b1a45b67d5f
Instruction Fuzzy Hash: D2318137A19A8386EB24EF15A44407863F1FB49BA4B994131DE1EC3794EF3DE856CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9C420 Relevance: 10.7, APIs: 7, Instructions: 171COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,00000000,00000000,?,?), ref: 00007FF679F9C467
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF679F9C4AF
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF679F9C4DB
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF679F9C4F6
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF679F9C522
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF679F9C5CF
RevertToSelf.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F9C637

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: StringWindows$Delete$Buffer$ImpersonateLoggedRevertSelfUser
String ID:
API String ID: 874656061-0
Opcode ID: 284dee9168f5c8c4decd6e96c77035c4d48dde5b38e177f56b1e70b282ca3436
Instruction ID: 481f3067d63a648a756a0e07c8869ffde56fd9ad47432c290d8a0953cebd347f
Opcode Fuzzy Hash: 284dee9168f5c8c4decd6e96c77035c4d48dde5b38e177f56b1e70b282ca3436
Instruction Fuzzy Hash: 06811933A28A8786EB14CF26C8943B927E0FB45BA8F144135DA0EC76A4DF7DE449C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9BF5C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,?,00007FF679F96A84), ref: 00007FF679F9BFC6
RevertToSelf.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,?,00007FF679F96A84), ref: 00007FF679F9C03F
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,?,00007FF679F96A84), ref: 00007FF679F9C064

Strings

TRUE, xrefs: 00007FF679F9C092
FALSE, xrefs: 00007FF679F9C087

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: FreeImpersonateLoggedRevertSelfTaskUser
String ID: FALSE$TRUE
API String ID: 3752364418-1412513891
Opcode ID: 78378e669159d3ed43995d5b017fd894a5bd4d91803d17f85cb3e3148e295bd6
Instruction ID: c2879612a4bbd99b4408da56c09a2db04bae0be56643cef694eed59bf7dd3fb3
Opcode Fuzzy Hash: 78378e669159d3ed43995d5b017fd894a5bd4d91803d17f85cb3e3148e295bd6
Instruction Fuzzy Hash: 89415933A28B8686EB60CF15E88036967E0FB85B94F404135DA8EC3B64DF7DE455CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9E3C4 Relevance: 10.6, APIs: 7, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetUserObjectInformationW.USER32 ref: 00007FF679F9E3EB
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E3F1
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E41D

Part of subcall function 00007FF679F9A238: EtwTraceMessage.NTDLL ref: 00007FF679F9A261

LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9E44E
GetUserObjectInformationW.USER32 ref: 00007FF679F9E476
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E499
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9E4C1

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ErrorLast$InformationLocalObjectUser$AllocFreeMessageTrace
String ID:
API String ID: 2029726541-0
Opcode ID: cdef9c8008b1d24512f1f665c36496de61b3b215d5f65f46fd7682734cadae9a
Instruction ID: b7fc8ba4002206d6c18cb096c9c702dc42dc37c96788c656136ecb22eb6e2ede
Opcode Fuzzy Hash: cdef9c8008b1d24512f1f665c36496de61b3b215d5f65f46fd7682734cadae9a
Instruction Fuzzy Hash: 04313C36B28A8395EB148F19E8447B923E0EF86B98F644535CA4EC76A8DF7CE4458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9D4B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

OpenDesktopW.USER32 ref: 00007FF679F9D4CE
SetThreadDesktop.USER32 ref: 00007FF679F9D4DF
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9D4E9

Part of subcall function 00007FF679F9A238: EtwTraceMessage.NTDLL ref: 00007FF679F9A261

CloseDesktop.USER32 ref: 00007FF679F9D525
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9D52D

Strings

winlogon, xrefs: 00007FF679F9D4C0

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Desktop$ErrorLast$CloseMessageOpenThreadTrace
String ID: winlogon
API String ID: 3758285829-3575102327
Opcode ID: 0b4a7dc20e99248901369e1b2af18269318e1223a8adc957210f73dbc0d4f38b
Instruction ID: 99b480b161a899bf831000b1dbd455790e917868f5328ab06e0fce3a67dc4a48
Opcode Fuzzy Hash: 0b4a7dc20e99248901369e1b2af18269318e1223a8adc957210f73dbc0d4f38b
Instruction Fuzzy Hash: 37114263F28BC341EB14CF55E94867523E1EF46B98F645031DA0ECB664DE7DE4468300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9B2E8 Relevance: 9.1, APIs: 6, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF679F9B31A
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F9B433
CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F9B43C
memcpy.MSVCRT ref: 00007FF679F9B455
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F9B47E
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F9B48C

Part of subcall function 00007FF679F9A218: EtwTraceMessage.NTDLL ref: 00007FF679F9A22B

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Task$Free$AllocMessageTracememcpymemset
String ID:
API String ID: 412478286-0
Opcode ID: 7c153861a633cb2777003ae0a5080577ee06139addc109216cbbf956f1f5cd09
Instruction ID: f1e0416a9fbb702397d099a553b1bbeb467eb7edfa827b67e4d929599f800dc6
Opcode Fuzzy Hash: 7c153861a633cb2777003ae0a5080577ee06139addc109216cbbf956f1f5cd09
Instruction Fuzzy Hash: 0A515A33B29B828AEB14DF65E4502AD23E1EB45B98F104036DE4E93B58DF3CE9068740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9DF6C Relevance: 9.1, APIs: 6, Instructions: 68synchronizationthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF679F9DF8F
CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF679F9DFC7
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9DFF2

Part of subcall function 00007FF679F9A238: EtwTraceMessage.NTDLL ref: 00007FF679F9A261

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F9E01D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E040
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF679F9E068

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleMessageObjectSingleThreadTraceWaitmemset
String ID:
API String ID: 1682848740-0
Opcode ID: 46e6b5c3b0f8aa8e31107bbd9ca0b565c528f2ebf4e463368e41e7a3efbda1ed
Instruction ID: 25aa646b29269d9b06d75f2ea0737d4958df4c0b214b4f24fef05d8c565c005b
Opcode Fuzzy Hash: 46e6b5c3b0f8aa8e31107bbd9ca0b565c528f2ebf4e463368e41e7a3efbda1ed
Instruction Fuzzy Hash: 8D31F733E29B8385EA14CF15E8043A923E5FB85B94F444636DA4EC36A4DF7DE546C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F937F0 Relevance: 9.0, APIs: 6, Instructions: 32COMMON

Download Yara Rule

APIs

LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9380B
AmsiUninitialize.AMSI ref: 00007FF679F93821
CoDisableCallCancellation.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F93829
CoUninitialize.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F9382F
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F9383D
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F97338

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: FreeUninitialize$AmsiCallCancellationDisableEventLocalTask
String ID:
API String ID: 3167936928-0
Opcode ID: 6858d9e30df0dcfbf67b6ce1753371e657be826698c9ca451710dec0b67db709
Instruction ID: 04de251124cda63f6023ffaef5b2ffe6e6c5f92b038b51a1671fc52c47f6f35e
Opcode Fuzzy Hash: 6858d9e30df0dcfbf67b6ce1753371e657be826698c9ca451710dec0b67db709
Instruction Fuzzy Hash: 8E017526B2AA8685EF199F65E85417823E0EB49F95B194435CD0EC73A0DF2CE4558210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9B994 Relevance: 9.0, APIs: 6, Instructions: 31encryptionwindowCOMMON

Download Yara Rule

APIs

DestroyIcon.USER32(?,?,0000000A,00007FF679F96A1E), ref: 00007FF679F9B9A6
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,0000000A,00007FF679F96A1E), ref: 00007FF679F9B9B5
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,0000000A,00007FF679F96A1E), ref: 00007FF679F9B9C4
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,0000000A,00007FF679F96A1E), ref: 00007FF679F9B9D3
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,0000000A,00007FF679F96A1E), ref: 00007FF679F9B9E7
CertFreeCertificateContext.CRYPT32 ref: 00007FF679F9B9F6

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Free$Task$CertCertificateContextDestroyIcon
String ID:
API String ID: 1758463638-0
Opcode ID: 10877b419859cd511e729633a2bde1fab1b411c78889c5dac0f300857978e8ab
Instruction ID: 04838a86f40d2f7434b542db75e2b2ea18c875f0bc124ced11fd013fcbcd354f
Opcode Fuzzy Hash: 10877b419859cd511e729633a2bde1fab1b411c78889c5dac0f300857978e8ab
Instruction Fuzzy Hash: 2B01C867635F4682EB15DF61D4A533823B0FB89F5AF150224CA0E8B158DF7CD498C394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F99C0C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F99CE5
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F99CF3
OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F99DE8

Strings

wil, xrefs: 00007FF679F99D0A, 00007FF679F99D45, 00007FF679F99E03, 00007FF679F99E33
_p0, xrefs: 00007FF679F99C98

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: OpenSemaphore$ErrorLast
String ID: _p0$wil
API String ID: 3042991519-1814513734
Opcode ID: 833088781b758e7a2cf04f8a7611536e1bc26bd4b1926d6580bc5d1c448e99e3
Instruction ID: f71565acb722c87bd770b83f9729a1273a3236de397142c67a38cb89a997b9a7
Opcode Fuzzy Hash: 833088781b758e7a2cf04f8a7611536e1bc26bd4b1926d6580bc5d1c448e99e3
Instruction Fuzzy Hash: 1C71CD63B2DAC386EF619F64A4442B963E8EF85B90F554132DA4DC7794EE3DE844C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F979F8 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 165COMMON

Download Yara Rule

APIs

CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F97B15
CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F97BC7

Part of subcall function 00007FF679F9A000: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FF679F98BC9), ref: 00007FF679F9A022
Part of subcall function 00007FF679F9A000: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FF679F98BC9), ref: 00007FF679F9A034

Strings

wil, xrefs: 00007FF679F97C4A, 00007FF679F97C8D
_p0, xrefs: 00007FF679F97AAC
internal\sdk\inc\wil\resultmacros.h, xrefs: 00007FF679F97C27, 00007FF679F97C6A

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: CreateErrorLastSemaphore
String ID: _p0$internal\sdk\inc\wil\resultmacros.h$wil
API String ID: 778173943-1203722284
Opcode ID: e59a87873efca91228c6980149d08e75932e5e9c95ac530b74547e51717e48c4
Instruction ID: 152d088770cc04bdc2f9fe8afbf8ce0d30ef4e3fae57a78254a6a763de5ec623
Opcode Fuzzy Hash: e59a87873efca91228c6980149d08e75932e5e9c95ac530b74547e51717e48c4
Instruction Fuzzy Hash: 4461AF63B29BC381EE618F2494547AA63E4EF84BA4F544536DA4DC3B98EF3CD545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F97790 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 110synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF679F977C8
CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F9780A

Part of subcall function 00007FF679F9A000: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FF679F98BC9), ref: 00007FF679F9A022
Part of subcall function 00007FF679F9A000: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FF679F98BC9), ref: 00007FF679F9A034

Part of subcall function 00007FF679F98870: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F9888F
Part of subcall function 00007FF679F98870: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F988A1

Strings

x, xrefs: 00007FF679F977DD
Local\SM0:%d:%d:%hs, xrefs: 00007FF679F977D3
wil, xrefs: 00007FF679F9786C, 00007FF679F97892, 00007FF679F97936

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ErrorHeapLastProcess$AllocCreateCurrentMutex
String ID: Local\SM0:%d:%d:%hs$wil$x
API String ID: 3112127618-630742106
Opcode ID: 92002ed23795a74e951eb270572a922eb61b186bbc03f7d13aab9b2cd1f3b32f
Instruction ID: 7b558cb4b9e35f5778497dd954c9e7f5ba883dbc28f1f5476a5de19ae15710cb
Opcode Fuzzy Hash: 92002ed23795a74e951eb270572a922eb61b186bbc03f7d13aab9b2cd1f3b32f
Instruction Fuzzy Hash: E8419C33B38AC392EB209F65E4807EA63A0EB98794F504032EA4DC7B55DE3CD559C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F95138 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F9516E
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9517C
new.LIBCMT ref: 00007FF679F95196
GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF679F951E1

Strings

internal\sdk\inc\wil\tokenhelpers.h, xrefs: 00007FF679F951A8, 00007FF679F951F0, 00007FF679F9522A

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID: internal\sdk\inc\wil\tokenhelpers.h
API String ID: 2567405617-3871617126
Opcode ID: 1ffd6dbedc111b1049763a05cd469ce08c267febaae59aca3930c93cc31331c7
Instruction ID: c7ccedd3b7f1db028bca57bf1c0b59e6d9ca75bfefba866663899b721ff0f626
Opcode Fuzzy Hash: 1ffd6dbedc111b1049763a05cd469ce08c267febaae59aca3930c93cc31331c7
Instruction Fuzzy Hash: 1B217123B2CAC381EB109F51E8406BA63E1FFC67A4F644131EA5DC7AA9DE3DE5458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F98870 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F9888F
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F988A1

Strings

wil, xrefs: 00007FF679F988BE, 00007FF679F9890E

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: wil
API String ID: 1617791916-1589926490
Opcode ID: 7ad0da0bc6465dabc86cdc8135d544a965b8adbcb967d66c1c276fa009d079ed
Instruction ID: 21c1195e59fc89e3d2e38742ae31653521813435a984484a39c671c94b4a9836
Opcode Fuzzy Hash: 7ad0da0bc6465dabc86cdc8135d544a965b8adbcb967d66c1c276fa009d079ed
Instruction Fuzzy Hash: 81314B23A28B8696E720DF16E4403AA63E0FB88794F548235DB8CC7B55EF3DE595C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F93780 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F9379B
CoEnableCallCancellation.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F937B0
AmsiUacInitialize.AMSI ref: 00007FF679F937C4
CoDisableCallCancellation.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F9730D
CoUninitialize.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F9731B

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: CallCancellationInitialize$AmsiDisableEnableUninitialize
String ID:
API String ID: 3148144523-0
Opcode ID: 3b4a0a84eb8e4beeff96c3ffa93fa2a326fb188288a30ff30b41d0ed82d0e75a
Instruction ID: 47d0fff03c2e617c56540af47d585116a4e397126f3f9432abc5a00d9aa5d7d6
Opcode Fuzzy Hash: 3b4a0a84eb8e4beeff96c3ffa93fa2a326fb188288a30ff30b41d0ed82d0e75a
Instruction Fuzzy Hash: 76212623B2CBC382EB598F65E44467922E1EF85BA8F148435D90EC7694DFADE546CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9FE53 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

UnregisterClassW.USER32 ref: 00007FF679F9FE73
UnregisterClassW.USER32 ref: 00007FF679F9FE91
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9FE9F
DeleteDC.GDI32 ref: 00007FF679F9FEB1
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F9FEC4

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ClassFreeLocalUnregister$Delete
String ID:
API String ID: 1956529754-0
Opcode ID: af42a267e88bc03621c1da599525a631b6c31afab5ec3cdc72a7cfcad17aefdc
Instruction ID: f47b744a4680f6ce3d78a22d0ef136ff7d3267e6c703d557bdde25cdacbedc63
Opcode Fuzzy Hash: af42a267e88bc03621c1da599525a631b6c31afab5ec3cdc72a7cfcad17aefdc
Instruction Fuzzy Hash: 2201E827A25A8689EB20EF31D8543B923A1FB4AF99F049031CA1D87A65CF2CD594C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9C9BC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF679F9B950: WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0(?,?,?,?,00007FF679F9CA22), ref: 00007FF679F9B96F
Part of subcall function 00007FF679F9B950: RaiseException.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FF679F9CA22), ref: 00007FF679F9B985

RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF679F9CA45
RtlLengthSid.NTDLL ref: 00007FF679F9CAC3

Strings

ds\security\services\lua\consentui\context.cpp, xrefs: 00007FF679F9CC01, 00007FF679F9CC16, 00007FF679F9CC2B, 00007FF679F9CC46, 00007FF679F9CC5B
Windows.Internal.StateRepository.Application, xrefs: 00007FF679F9CA12

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ActivationCreateExceptionFactoryLengthRaiseReferenceStringWindows
String ID: Windows.Internal.StateRepository.Application$ds\security\services\lua\consentui\context.cpp
API String ID: 1436923132-3692511694
Opcode ID: ac6a279d73b4630aff2bab37cafd4e21057c8fe2441cf34f1e32a0db50ffdd7a
Instruction ID: 12e5470f5b59a3d55b5a6390d2dc4218f31e52ad2e713d9300c5ca0b362ffec9
Opcode Fuzzy Hash: ac6a279d73b4630aff2bab37cafd4e21057c8fe2441cf34f1e32a0db50ffdd7a
Instruction Fuzzy Hash: E9614223729AC791E710DF61E850AAA67A0FB86BE0F415232DE5ED3BA5DE3CD445C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679FA05BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF679FA05E0
RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF679FA0631
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF679FA0678

Strings

AppEvents\Schemes\Apps\.Default\WindowsUAC\.Current, xrefs: 00007FF679FA0611

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: CloseCurrentOpenUserValue
String ID: AppEvents\Schemes\Apps\.Default\WindowsUAC\.Current
API String ID: 959624552-1582783161
Opcode ID: 7cb211b2319d2484271118ddd2ea72a63055e69232969d5aa9a3183ce6209266
Instruction ID: 13b3fa38c14ef4759a565c319e2b5492cace2f7936c4441fd9672c76cb895b3a
Opcode Fuzzy Hash: 7cb211b2319d2484271118ddd2ea72a63055e69232969d5aa9a3183ce6209266
Instruction Fuzzy Hash: 75212F22B28B8781EB148F15E45437967E0FB86B88F584135E94E87795DFACD946C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9FFE8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

SetPropW.USER32 ref: 00007FF679F9FFFE
FlashWindowEx.USER32 ref: 00007FF679FA0028

Strings

TwoFootCriticalNotification, xrefs: 00007FF679F9FFF4
, xrefs: 00007FF679FA0013

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: FlashPropWindow
String ID: $TwoFootCriticalNotification
API String ID: 1278527393-2469437643
Opcode ID: 7e539d80af679723a50f19627c5f64c5a8bb8572005d7ff16e6228ee2df21d68
Instruction ID: e457f847498bbcd1b932aaedc5e4f1a46bd69cbf1229370b19db9508520679ce
Opcode Fuzzy Hash: 7e539d80af679723a50f19627c5f64c5a8bb8572005d7ff16e6228ee2df21d68
Instruction Fuzzy Hash: C2E012B363874183E7108F10F44935A77A0F75A759F541124E98A47658DF7DC198CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F93600 Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

APIs

AmsiUacScan.AMSI ref: 00007FF679F9363F
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF679F936A0
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F936A9
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF679F936B2

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: FreeLocal$AmsiEventScan
String ID:
API String ID: 2910536158-0
Opcode ID: 820b2bb45d0619a70507507d0e5ec155fa956682729f9485b21050a7c0634e92
Instruction ID: fb68c341f4cc2dabb0c0d2aaf499979c5b704952e0ad34b78043b8ebbb884cc6
Opcode Fuzzy Hash: 820b2bb45d0619a70507507d0e5ec155fa956682729f9485b21050a7c0634e92
Instruction Fuzzy Hash: 2C711673A29B8785EB148F15D4403A963E0FB85BA8F508032DA4EC73A9DF7DE445CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9DBDC Relevance: 6.1, APIs: 4, Instructions: 88synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF679F9D8A3), ref: 00007FF679F9DC39
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF679F9D8A3), ref: 00007FF679F9DC46
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF679F9D8A3), ref: 00007FF679F9DC88
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF679F9D8A3), ref: 00007FF679F9DC93

Part of subcall function 00007FF679FA0380: EtwTraceMessage.NTDLL ref: 00007FF679FA03B7

Part of subcall function 00007FF679F9A218: EtwTraceMessage.NTDLL ref: 00007FF679F9A22B

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ErrorLastMessageObjectSingleTraceWait
String ID:
API String ID: 2828113838-0
Opcode ID: d320e9a1a7c455f8445992d790062423f6f85f0a5f08e9d49ff3ba12f0b6cd9c
Instruction ID: d88df164f53eb0fd756e8222fcac7df15576131a2b550f26171d5d9136df9f2b
Opcode Fuzzy Hash: d320e9a1a7c455f8445992d790062423f6f85f0a5f08e9d49ff3ba12f0b6cd9c
Instruction Fuzzy Hash: 24413823A2C6C345EB68CF16954827522E4EF45B64F344532EA4EC36E4DFBCE8828780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F94610 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF679F94683
RtlLookupFunctionEntry.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF679F946A2
RtlVirtualUnwind.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00007FF679F91EF7), ref: 00007FF679F946EF
__raise_securityfailure.LIBCMT ref: 00007FF679F947D4

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 1a36e1d22939388315354ccc0137201634089dd6f1b4e6de5b798e6e8be04ba2
Instruction ID: b604e5b5e6c0bea85cd07aa58335a325cea129003159dc5cf33442bf98081edf
Opcode Fuzzy Hash: 1a36e1d22939388315354ccc0137201634089dd6f1b4e6de5b798e6e8be04ba2
Instruction Fuzzy Hash: BE41C47AA28F8285EA509F19F85036673E4FB9A794F904136D98EC3764DFBCE454C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9E4D8 Relevance: 6.0, APIs: 4, Instructions: 34threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF679F9DA9F), ref: 00007FF679F9E4E4
GetThreadDesktop.USER32(?,?,00000000,00007FF679F9DA9F), ref: 00007FF679F9E4EC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF679F9DA9F), ref: 00007FF679F9E529

Part of subcall function 00007FF679F9E3C4: GetUserObjectInformationW.USER32 ref: 00007FF679F9E3EB
Part of subcall function 00007FF679F9E3C4: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E3F1
Part of subcall function 00007FF679F9E3C4: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F9E41D

CloseDesktop.USER32(?,?,00000000,00007FF679F9DA9F), ref: 00007FF679F9E508

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ErrorLast$DesktopThread$CloseCurrentInformationObjectUser
String ID:
API String ID: 2001675675-0
Opcode ID: 8091418ad0455d055d58c0a2693ec9bdfb5b102dd5aa2b32c7ffda5fc07a03af
Instruction ID: a89422e09d7b0ddb771b56e1c3612c344e80f9888096d3aaed86036ca4d6f148
Opcode Fuzzy Hash: 8091418ad0455d055d58c0a2693ec9bdfb5b102dd5aa2b32c7ffda5fc07a03af
Instruction Fuzzy Hash: AB01EC22F2DBC781EE549F65A94427812E0EF86B94F584435D90ECB7A5EE3CE4458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F9A500 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

StringFromGUID2.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF679F9A537
RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF679F9A56D

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\UAC\COMAutoApprovalList, xrefs: 00007FF679F9A561

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: FromStringValue
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\UAC\COMAutoApprovalList
API String ID: 1884225406-3816395346
Opcode ID: a0e02dcd3db2e47f44ca7ce78d9b363da0cb4ecf81595da20a14ddc0fa1df37f
Instruction ID: 1d27dc628abb48ca1e8209ea6ffa65c9c302064afb83b386b8351d48bab8efd3
Opcode Fuzzy Hash: a0e02dcd3db2e47f44ca7ce78d9b363da0cb4ecf81595da20a14ddc0fa1df37f
Instruction Fuzzy Hash: 1C112173618B8786EB208F54E4403AAB3B0FB85714F900136DA8D87758DF7CD509CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F994D8 Relevance: 5.1, APIs: 4, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F99573
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F99584
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F99592
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F995A1

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 0180f77ebc56c7c2ce5e67e2a7baa2e0070938d7665c8334581b37d5ff794b4b
Instruction ID: c1dd40066bbf946792170d195faa5f316f4ee1c66657f4496689ad9833590a56
Opcode Fuzzy Hash: 0180f77ebc56c7c2ce5e67e2a7baa2e0070938d7665c8334581b37d5ff794b4b
Instruction Fuzzy Hash: FC3124A2A15B8286EB04DF5AA4443A877E4FB49FD8F598036DE0C87755DF39D492C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF679F98B8C Relevance: 5.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF679F99EE0: WaitForSingleObjectEx.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF679F98BB4), ref: 00007FF679F99EF9

Part of subcall function 00007FF679F9A000: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FF679F98BC9), ref: 00007FF679F9A022
Part of subcall function 00007FF679F9A000: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FF679F98BC9), ref: 00007FF679F9A034

SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F98BF0
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF679F98BDE

Part of subcall function 00007FF679F98C6C: ReleaseMutex.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF679F98C4E), ref: 00007FF679F98C70

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F98C26
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF679F98C34

Memory Dump Source

Source File: 0000000D.00000002.376827923.00007FF679F91000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF679F90000, based on PE: true

Associated: 0000000D.00000002.376816327.00007FF679F90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376843046.00007FF679FA1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376855078.00007FF679FA8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376870389.00007FF679FA9000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.376881955.00007FF679FAC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff679f90000_consent.jbxd

Similarity

API ID: ErrorLast$Heap$FreeMutexObjectProcessReleaseSingleWait
String ID:
API String ID: 2060072361-0
Opcode ID: dfc86838ead7c9c4049b0375952a65c205fd62fecb4223e794680a1955a5858e
Instruction ID: ebb01c800bfc65431915ab4bbb8dddb0141a8a492993a3f40f626e610b71639e
Opcode Fuzzy Hash: dfc86838ead7c9c4049b0375952a65c205fd62fecb4223e794680a1955a5858e
Instruction Fuzzy Hash: 85218C63B2ABC386FA149F62A84017963E0EF95BB0B094135DA9EC7395DF3CE8418300

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dry.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\0rPbJb\SndVol.exe

C:\Users\user\AppData\Local\0rPbJb\UxTheme.dll

C:\Users\user\AppData\Local\DLKXiO\WMsgAPI.dll

C:\Users\user\AppData\Local\DLKXiO\consent.exe

C:\Users\user\AppData\Local\GsjW\XmlLite.dll

C:\Users\user\AppData\Local\GsjW\sppsvc.exe

C:\Users\user\AppData\Local\dfAZPUGwQ\WINSTA.dll

C:\Users\user\AppData\Local\dfAZPUGwQ\consent.exe

C:\Users\user\AppData\Local\oudoiG\DWWIN.EXE

C:\Users\user\AppData\Local\oudoiG\VERSION.dll

C:\Users\user\AppData\Local\s8hTTPzEx\DUI70.dll

C:\Users\user\AppData\Local\s8hTTPzEx\SysResetErr.exe

C:\Users\user\AppData\Local\y1c6p\VERSION.dll

C:\Users\user\AppData\Local\y1c6p\cmstp.exe

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
dry.dll

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre