Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
eWlldJYfLc

Overview

General Information

Sample Name:eWlldJYfLc (renamed file extension from none to dll)
Analysis ID:595308
MD5:d098d01cbea52f858bce6d0d9faa5b26
SHA1:952ce9cd899108c2821bf488b98387b6db8424b8
SHA256:82c89b2a758177c7cfb7c1763b0444281c6b670deef015a886c866f18dbd8370
Tags:Dridexexe
Infos:

Detection

Dridex
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Dridex unpacked file
Multi AV Scanner detection for submitted file
Benign windows process drops PE files
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes memory attributes in foreign processes to executable or writable
Machine Learning detection for sample
Sigma detected: Suspicious Svchost Process
Queues an APC in another process (thread injection)
Sigma detected: Suspicious Call by Ordinal
Machine Learning detection for dropped file
Accesses ntoskrnl, likely to find offsets for exploits
Contains functionality to automate explorer (e.g. start an application)
Contains functionality to prevent local Windows debugging
Uses Atom Bombing / ProGate to inject into other processes
PE file contains section with special chars
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Queries the installation date of Windows
Detected potential crypto function
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Found evasive API chain checking for process token information
Binary contains a suspicious time stamp
PE file contains more sections than normal
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • loaddll64.exe (PID: 7088 cmdline: loaddll64.exe "C:\Users\user\Desktop\eWlldJYfLc.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)
    • cmd.exe (PID: 7112 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • rundll32.exe (PID: 7132 cmdline: rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 7120 cmdline: rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,IsInteractiveUserSession MD5: 73C519F050C20580F8A62C849D49215A)
      • explorer.exe (PID: 3968 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • svchost.exe (PID: 5604 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
        • sdclt.exe (PID: 3960 cmdline: C:\Windows\system32\sdclt.exe MD5: 0632A8402C6504CD541AC93676AAD0F5)
        • CloudNotifications.exe (PID: 5876 cmdline: C:\Windows\system32\CloudNotifications.exe MD5: D9FF4C8DBC1682E0508322307CB89C0F)
        • CloudNotifications.exe (PID: 2928 cmdline: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exe MD5: D9FF4C8DBC1682E0508322307CB89C0F)
        • systemreset.exe (PID: 6544 cmdline: C:\Windows\system32\systemreset.exe MD5: 872AE9FE08ED1AA78208678967BE2FEF)
        • Dxpserver.exe (PID: 3500 cmdline: C:\Windows\system32\Dxpserver.exe MD5: DCCB1D350193BE0A26CEAFF602DB848E)
        • Dxpserver.exe (PID: 1740 cmdline: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exe MD5: DCCB1D350193BE0A26CEAFF602DB848E)
        • mfpmp.exe (PID: 5604 cmdline: C:\Windows\system32\mfpmp.exe MD5: 7C3D09D6DB5DB4A272FCF4C1BB3986BD)
        • mfpmp.exe (PID: 3464 cmdline: C:\Users\user\AppData\Local\bj1HT\mfpmp.exe MD5: 7C3D09D6DB5DB4A272FCF4C1BB3986BD)
        • msra.exe (PID: 1908 cmdline: C:\Windows\system32\msra.exe MD5: 3240CC226FB8AC41A0431A8F3B9DD770)
        • mstsc.exe (PID: 7132 cmdline: C:\Windows\system32\mstsc.exe MD5: 3FBB5CD8829E9533D0FF5819DB0444C0)
        • mstsc.exe (PID: 3176 cmdline: C:\Users\user\AppData\Local\n0R5g\mstsc.exe MD5: 3FBB5CD8829E9533D0FF5819DB0444C0)
        • SndVol.exe (PID: 5936 cmdline: C:\Windows\system32\SndVol.exe MD5: CDD7C7DF2D0859AC3F4088423D11BD08)
        • SndVol.exe (PID: 5900 cmdline: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exe MD5: CDD7C7DF2D0859AC3F4088423D11BD08)
    • rundll32.exe (PID: 5384 cmdline: rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,QueryActiveSession MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 3156 cmdline: rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,QueryUserToken MD5: 73C519F050C20580F8A62C849D49215A)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000008.00000002.274772551.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
    00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
      00000023.00000002.574221343.00007FFC74C21000.00000020.00000001.01000000.00000013.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
        00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
          00000002.00000002.382839680.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
            Click to see the 5 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            33.2.mstsc.exe.7ffc74c20000.3.unpackJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
              35.2.SndVol.exe.7ffc74c20000.3.unpackJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
                20.2.CloudNotifications.exe.7ffc74c20000.3.unpackJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
                  8.2.rundll32.exe.7ffc670c0000.2.unpackJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
                    2.2.rundll32.exe.7ffc670c0000.2.unpackJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
                      Click to see the 5 entries

                      Sigma Signatures

                      System Summary

                      barindex
                      Sigma detected: Suspicious Svchost Process
                      Source: Process startedAuthor: Florian Roth: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 5604
                      Sigma detected: Suspicious Call by Ordinal
                      Source: Process startedAuthor: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7112, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1, ProcessId: 7132
                      Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 5604
                      Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\explorer.exe, ProcessId: 3968, TargetFilename: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exe

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Multi AV Scanner detection for submitted file
                      Source: eWlldJYfLc.dllVirustotal: Detection: 67%Perma Link
                      Source: eWlldJYfLc.dllMetadefender: Detection: 60%Perma Link
                      Source: eWlldJYfLc.dllReversingLabs: Detection: 88%
                      Antivirus / Scanner detection for submitted sample
                      Source: eWlldJYfLc.dllAvira: detected
                      Antivirus detection for dropped file
                      Source: C:\Users\user\AppData\Local\vFRJtv0CU\ACTIVEDS.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\dwmapi.dllAvira: detection malicious, Label: TR/Crypt.XPACK.Gen7
                      Source: C:\Users\user\AppData\Local\Nz4mnM\UxTheme.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
                      Source: C:\Users\user\AppData\Local\O0z6Mm4\XmlLite.dllAvira: detection malicious, Label: TR/Crypt.XPACK.Gen7
                      Source: C:\Users\user\AppData\Local\O0z6Mm4\XmlLite.dllAvira: detection malicious, Label: TR/Crypt.XPACK.Gen7
                      Source: C:\Users\user\AppData\Local\bj1HT\MFPlat.DLLAvira: detection malicious, Label: TR/Crypt.XPACK.Gen7
                      Source: C:\Users\user\AppData\Local\EQ0DjT2sP\DUI70.dllAvira: detection malicious, Label: TR/Crypt.XPACK.Gen4
                      Source: C:\Users\user\AppData\Local\Nz4mnM\UxTheme.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
                      Source: C:\Users\user\AppData\Local\n0R5g\Secur32.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
                      Machine Learning detection for sample
                      Source: eWlldJYfLc.dllJoe Sandbox ML: detected
                      Machine Learning detection for dropped file
                      Source: C:\Users\user\AppData\Local\vFRJtv0CU\ACTIVEDS.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\dwmapi.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\Nz4mnM\UxTheme.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\O0z6Mm4\XmlLite.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\O0z6Mm4\XmlLite.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\bj1HT\MFPlat.DLLJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\EQ0DjT2sP\DUI70.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\Nz4mnM\UxTheme.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\n0R5g\Secur32.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310EFCC memset,CreateFileW,CryptCATAdminCalcHashFromFileHandle,CryptCATAdminCalcHashFromFileHandle,SetFilePointer,GetLastError,memset,WinVerifyTrustEx,WTHelperProvDataFromStateData,WTHelperGetProvSignerFromChain,CertVerifyCertificateChainPolicy,WinVerifyTrustEx,CloseHandle,26_2_00007FF61310EFCC
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310F224 CreateFileW,CryptCATAdminCalcHashFromFileHandle,CryptCATAdminCalcHashFromFileHandle,GetLastError,CloseHandle,GetLastError,CryptCATAdminAcquireContext,CryptCATAdminEnumCatalogFromHash,memset,CryptCATCatalogInfoFromContext,CryptCATAdminReleaseCatalogContext,CryptCATAdminReleaseContext,GetLastError,GetLastError,26_2_00007FF61310F224
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B877F52C CryptProtectData,LocalAlloc,LocalFree,33_2_00007FF7B877F52C
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B877F8FC CryptBinaryToStringW,LocalAlloc,CryptBinaryToStringW,LocalFree,33_2_00007FF7B877F8FC

                      Exploits

                      barindex
                      Accesses ntoskrnl, likely to find offsets for exploits
                      Source: C:\Windows\explorer.exeFile opened: C:\Windows\system32\ntkrnlmp.exeJump to behavior
                      Source: eWlldJYfLc.dllStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
                      Source: Binary string: SndVol.pdbGCTL source: SndVol.exe, 00000023.00000000.548108875.00007FF742CF2000.00000002.00000001.01000000.00000012.sdmp, SndVol.exe, 00000023.00000002.574100528.00007FF742CF2000.00000002.00000001.01000000.00000012.sdmp, SndVol.exe.4.dr
                      Source: Binary string: SppExtComObj.pdb source: SppExtComObj.Exe.4.dr
                      Source: Binary string: MFPMP.pdb source: mfpmp.exe, 0000001D.00000000.471765821.00007FF670A47000.00000002.00000001.01000000.0000000D.sdmp, mfpmp.exe, 0000001D.00000002.500806173.00007FF670A47000.00000002.00000001.01000000.0000000D.sdmp, mfpmp.exe.4.dr
                      Source: Binary string: CloudNotifications.pdb source: CloudNotifications.exe, 00000014.00000000.405037506.00007FF74078B000.00000002.00000001.01000000.00000009.sdmp, CloudNotifications.exe, 00000014.00000002.430793146.00007FF74078B000.00000002.00000001.01000000.00000009.sdmp, CloudNotifications.exe.4.dr
                      Source: Binary string: deviceenroller.pdb source: DeviceEnroller.exe.4.dr
                      Source: Binary string: MFPMP.pdbUGP source: mfpmp.exe, 0000001D.00000000.471765821.00007FF670A47000.00000002.00000001.01000000.0000000D.sdmp, mfpmp.exe, 0000001D.00000002.500806173.00007FF670A47000.00000002.00000001.01000000.0000000D.sdmp, mfpmp.exe.4.dr
                      Source: Binary string: DXPServer.pdbGCTL source: Dxpserver.exe, 0000001A.00000000.442933050.00007FF613111000.00000002.00000001.01000000.0000000B.sdmp, Dxpserver.exe, 0000001A.00000002.465912323.00007FF613111000.00000002.00000001.01000000.0000000B.sdmp, Dxpserver.exe.4.dr
                      Source: Binary string: mstsc.pdbGCTL source: mstsc.exe, 00000021.00000000.509159807.00007FF7B8824000.00000002.00000001.01000000.00000010.sdmp, mstsc.exe, 00000021.00000002.535164127.00007FF7B8824000.00000002.00000001.01000000.00000010.sdmp, mstsc.exe.4.dr
                      Source: Binary string: CameraSettingsUIHost.pdbGCTL source: CameraSettingsUIHost.exe.4.dr
                      Source: Binary string: CameraSettingsUIHost.pdb source: CameraSettingsUIHost.exe.4.dr
                      Source: Binary string: SppExtComObj.pdbUGP source: SppExtComObj.Exe.4.dr
                      Source: Binary string: mstsc.pdb source: mstsc.exe, 00000021.00000000.509159807.00007FF7B8824000.00000002.00000001.01000000.00000010.sdmp, mstsc.exe, 00000021.00000002.535164127.00007FF7B8824000.00000002.00000001.01000000.00000010.sdmp, mstsc.exe.4.dr
                      Source: Binary string: DDODiag.pdbGCTL source: ddodiag.exe.4.dr
                      Source: Binary string: DDODiag.pdb source: ddodiag.exe.4.dr
                      Source: Binary string: SndVol.pdb source: SndVol.exe, 00000023.00000000.548108875.00007FF742CF2000.00000002.00000001.01000000.00000012.sdmp, SndVol.exe, 00000023.00000002.574100528.00007FF742CF2000.00000002.00000001.01000000.00000012.sdmp, SndVol.exe.4.dr
                      Source: Binary string: CloudNotifications.pdbGCTL source: CloudNotifications.exe, 00000014.00000000.405037506.00007FF74078B000.00000002.00000001.01000000.00000009.sdmp, CloudNotifications.exe, 00000014.00000002.430793146.00007FF74078B000.00000002.00000001.01000000.00000009.sdmp, CloudNotifications.exe.4.dr
                      Source: Binary string: DXPServer.pdb source: Dxpserver.exe, 0000001A.00000000.442933050.00007FF613111000.00000002.00000001.01000000.0000000B.sdmp, Dxpserver.exe, 0000001A.00000002.465912323.00007FF613111000.00000002.00000001.01000000.0000000B.sdmp, Dxpserver.exe.4.dr
                      Source: Binary string: deviceenroller.pdbGCTL source: DeviceEnroller.exe.4.dr
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6711ED10 FindFirstFileExW,0_2_00007FFC6711ED10
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C7ED10 FindFirstFileExW,20_2_00007FFC74C7ED10
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130E1914 SHCreateDirectory,memset,FindFirstFileW,CompareStringOrdinal,CompareStringOrdinal,CompareStringOrdinal,CompareStringOrdinal,SHCreateDirectory,CompareStringOrdinal,CreateFileW,CloseHandle,GetLastError,SetFileAttributesW,CopyFileExW,GetLastError,CoCreateGuid,StringFromGUID2,MoveFileW,GetLastError,CopyFileExW,GetLastError,FindNextFileW,FindClose,GetLastError,26_2_00007FF6130E1914
                      Source: explorer.exe, 00000004.00000000.324436158.000000000DA7E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.mi
                      Source: explorer.exe, 00000004.00000000.324436158.000000000DA7E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.micr
                      Source: svchost.exe, 0000000B.00000002.321751772.000001BB8E613000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
                      Source: svchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
                      Source: svchost.exe, 0000000B.00000002.321768696.000001BB8E629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
                      Source: svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
                      Source: svchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
                      Source: svchost.exe, 0000000B.00000002.321807705.000001BB8E63E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
                      Source: svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
                      Source: svchost.exe, 0000000B.00000003.320495277.000001BB8E669000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.321905396.000001BB8E66B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
                      Source: svchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
                      Source: svchost.exe, 0000000B.00000002.321768696.000001BB8E629000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
                      Source: svchost.exe, 0000000B.00000002.321768696.000001BB8E629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
                      Source: svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
                      Source: svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
                      Source: svchost.exe, 0000000B.00000002.321807705.000001BB8E63E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
                      Source: svchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
                      Source: svchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
                      Source: svchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
                      Source: svchost.exe, 0000000B.00000002.321768696.000001BB8E629000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
                      Source: svchost.exe, 0000000B.00000002.321820678.000001BB8E643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.321051969.000001BB8E642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320872446.000001BB8E641000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
                      Source: svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Stops/
                      Source: svchost.exe, 0000000B.00000002.321820678.000001BB8E643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.321051969.000001BB8E642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320872446.000001BB8E641000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
                      Source: svchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
                      Source: svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320872446.000001BB8E641000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
                      Source: svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
                      Source: svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
                      Source: svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
                      Source: svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
                      Source: svchost.exe, 0000000B.00000003.320872446.000001BB8E641000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
                      Source: svchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
                      Source: svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.321807705.000001BB8E63E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
                      Source: svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
                      Source: svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=
                      Source: DeviceEnroller.exe.4.drString found in binary or memory: https://login.windows.net-%s
                      Source: svchost.exe, 0000000B.00000002.321807705.000001BB8E63E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
                      Source: svchost.exe, 0000000B.00000002.321807705.000001BB8E63E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.321751772.000001BB8E613000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
                      Source: svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
                      Source: svchost.exe, 0000000B.00000003.320980194.000001BB8E646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320872446.000001BB8E641000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
                      Source: svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
                      Source: svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.321244735.000001BB8E63A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
                      Source: svchost.exe, 0000000B.00000002.321768696.000001BB8E629000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

                      E-Banking Fraud

                      barindex
                      Yara detected Dridex unpacked file
                      Source: Yara matchFile source: 33.2.mstsc.exe.7ffc74c20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 35.2.SndVol.exe.7ffc74c20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 20.2.CloudNotifications.exe.7ffc74c20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 8.2.rundll32.exe.7ffc670c0000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.rundll32.exe.7ffc670c0000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.7ffc670c0000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 26.2.Dxpserver.exe.7ffc74c20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 29.2.mfpmp.exe.7ffc74c20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.loaddll64.exe.7ffc670c0000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.rundll32.exe.7ffc670c0000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000008.00000002.274772551.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000023.00000002.574221343.00007FFC74C21000.00000020.00000001.01000000.00000013.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.382839680.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001D.00000002.500951495.00007FFC74C21000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.465961019.00007FFC74C21000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.260901088.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.267568902.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.543380049.00007FFC74C21000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY

                      System Summary

                      barindex
                      PE file contains section with special chars
                      Source: SppExtComObj.Exe.4.drStatic PE information: section name: ?g_Encry
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671097D00_2_00007FFC671097D0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F50200_2_00007FFC670F5020
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6711DDC00_2_00007FFC6711DDC0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671276500_2_00007FFC67127650
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712D5200_2_00007FFC6712D520
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6710A2C00_2_00007FFC6710A2C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F59F00_2_00007FFC670F59F0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670FAA700_2_00007FFC670FAA70
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6710CA500_2_00007FFC6710CA50
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E78800_2_00007FFC670E7880
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671131500_2_00007FFC67113150
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6713B7A00_2_00007FFC6713B7A0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C67900_2_00007FFC670C6790
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712C7800_2_00007FFC6712C780
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6713EF800_2_00007FFC6713EF80
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EE7B00_2_00007FFC670EE7B0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670DA7D00_2_00007FFC670DA7D0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67134FF00_2_00007FFC67134FF0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D8FC00_2_00007FFC670D8FC0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E6FE00_2_00007FFC670E6FE0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671408200_2_00007FFC67140820
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C10100_2_00007FFC670C1010
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E48000_2_00007FFC670E4800
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EC0300_2_00007FFC670EC030
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F00200_2_00007FFC670F0020
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E50500_2_00007FFC670E5050
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6710F8700_2_00007FFC6710F870
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671158400_2_00007FFC67115840
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670FF8700_2_00007FFC670FF870
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C6E900_2_00007FFC670C6E90
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712A6B00_2_00007FFC6712A6B0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C7E800_2_00007FFC670C7E80
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EF6B00_2_00007FFC670EF6B0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F06A00_2_00007FFC670F06A0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67127EC00_2_00007FFC67127EC0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67120F300_2_00007FFC67120F30
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E872B0_2_00007FFC670E872B
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671257600_2_00007FFC67125760
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E2F500_2_00007FFC670E2F50
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6713BF6F0_2_00007FFC6713BF6F
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671207700_2_00007FFC67120770
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670DE7700_2_00007FFC670DE770
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6713C5900_2_00007FFC6713C590
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670CC5A00_2_00007FFC670CC5A0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D95C00_2_00007FFC670D95C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F25C00_2_00007FFC670F25C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D65E00_2_00007FFC670D65E0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E36100_2_00007FFC670E3610
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F2E100_2_00007FFC670F2E10
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670CDE200_2_00007FFC670CDE20
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C16200_2_00007FFC670C1620
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D86700_2_00007FFC670D8670
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671106500_2_00007FFC67110650
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E49D0_2_00007FFC6712E49D
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67122CA00_2_00007FFC67122CA0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E4A60_2_00007FFC6712E4A6
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E4AD0_2_00007FFC6712E4AD
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E4B60_2_00007FFC6712E4B6
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EAC800_2_00007FFC670EAC80
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E48B0_2_00007FFC6712E48B
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712A4900_2_00007FFC6712A490
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E4940_2_00007FFC6712E494
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D3CD00_2_00007FFC670D3CD0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F5CD00_2_00007FFC670F5CD0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F3CF00_2_00007FFC670F3CF0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67118D200_2_00007FFC67118D20
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F0D100_2_00007FFC670F0D10
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F1D300_2_00007FFC670F1D30
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E3D500_2_00007FFC670E3D50
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670ED5500_2_00007FFC670ED550
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D9D700_2_00007FFC670D9D70
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671243900_2_00007FFC67124390
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67114BC00_2_00007FFC67114BC0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D23F00_2_00007FFC670D23F0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D74100_2_00007FFC670D7410
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E4000_2_00007FFC6712E400
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6713FC000_2_00007FFC6713FC00
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671294100_2_00007FFC67129410
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D54200_2_00007FFC670D5420
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C5C200_2_00007FFC670C5C20
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671282A00_2_00007FFC671282A0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712AAA00_2_00007FFC6712AAA0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EDAA00_2_00007FFC670EDAA0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67122AE00_2_00007FFC67122AE0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67127AF00_2_00007FFC67127AF0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E92C00_2_00007FFC670E92C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671122C00_2_00007FFC671122C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6711F2C00_2_00007FFC6711F2C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E82E00_2_00007FFC670E82E0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670FBAE00_2_00007FFC670FBAE0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EA3100_2_00007FFC670EA310
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F03000_2_00007FFC670F0300
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F1B300_2_00007FFC670F1B30
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670CBB200_2_00007FFC670CBB20
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C53500_2_00007FFC670C5350
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E33400_2_00007FFC670E3340
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D83400_2_00007FFC670D8340
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67125B500_2_00007FFC67125B50
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F43600_2_00007FFC670F4360
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F99900_2_00007FFC670F9990
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C29800_2_00007FFC670C2980
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670DE9B00_2_00007FFC670DE9B0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E11B00_2_00007FFC670E11B0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EE9A00_2_00007FFC670EE9A0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F21D00_2_00007FFC670F21D0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E69C00_2_00007FFC670E69C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EF1F00_2_00007FFC670EF1F0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F91F00_2_00007FFC670F91F0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F89F00_2_00007FFC670F89F0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712B2600_2_00007FFC6712B260
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670FB2500_2_00007FFC670FB250
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C7A400_2_00007FFC670C7A40
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670DD8900_2_00007FFC670DD890
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6713C8B10_2_00007FFC6713C8B1
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D08B00_2_00007FFC670D08B0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6713C0EB0_2_00007FFC6713C0EB
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C18D00_2_00007FFC670C18D0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670DE1100_2_00007FFC670DE110
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E39100_2_00007FFC670E3910
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670CB1000_2_00007FFC670CB100
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F61300_2_00007FFC670F6130
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712B9600_2_00007FFC6712B960
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E41400_2_00007FFC670E4140
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671269500_2_00007FFC67126950
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FF74078290820_2_00007FF740782908
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8D52020_2_00007FFC74C8D520
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C55CD020_2_00007FFC74C55CD0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8765020_2_00007FFC74C87650
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C7DDC020_2_00007FFC74C7DDC0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5502020_2_00007FFC74C55020
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C697D020_2_00007FFC74C697D0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C7315020_2_00007FFC74C73150
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4788020_2_00007FFC74C47880
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C6CA5020_2_00007FFC74C6CA50
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5AA7020_2_00007FFC74C5AA70
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C559F020_2_00007FFC74C559F0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C6A2C020_2_00007FFC74C6A2C0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5BAE020_2_00007FFC74C5BAE0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4D55020_2_00007FFC74C4D550
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C43D5020_2_00007FFC74C43D50
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C39D7020_2_00007FFC74C39D70
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C50D1020_2_00007FFC74C50D10
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C51D3020_2_00007FFC74C51D30
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C78D2020_2_00007FFC74C78D20
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C33CD020_2_00007FFC74C33CD0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C53CF020_2_00007FFC74C53CF0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8E49420_2_00007FFC74C8E494
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8A49020_2_00007FFC74C8A490
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4AC8020_2_00007FFC74C4AC80
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8E48B20_2_00007FFC74C8E48B
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8E4B620_2_00007FFC74C8E4B6
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8E4AD20_2_00007FFC74C8E4AD
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8E4A620_2_00007FFC74C8E4A6
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C82CA020_2_00007FFC74C82CA0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8E49D20_2_00007FFC74C8E49D
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C7065020_2_00007FFC74C70650
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C3867020_2_00007FFC74C38670
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C52E1020_2_00007FFC74C52E10
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4361020_2_00007FFC74C43610
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C2162020_2_00007FFC74C21620
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C2DE2020_2_00007FFC74C2DE20
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C525C020_2_00007FFC74C525C0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C395C020_2_00007FFC74C395C0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C365E020_2_00007FFC74C365E0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C9C59020_2_00007FFC74C9C590
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C2C5A020_2_00007FFC74C2C5A0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C42F5020_2_00007FFC74C42F50
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8077020_2_00007FFC74C80770
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C3E77020_2_00007FFC74C3E770
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C9BF6F20_2_00007FFC74C9BF6F
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8576020_2_00007FFC74C85760
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C80F3020_2_00007FFC74C80F30
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4872B20_2_00007FFC74C4872B
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C87EC020_2_00007FFC74C87EC0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C26E9020_2_00007FFC74C26E90
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C27E8020_2_00007FFC74C27E80
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4F6B020_2_00007FFC74C4F6B0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8A6B020_2_00007FFC74C8A6B0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C506A020_2_00007FFC74C506A0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4505020_2_00007FFC74C45050
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C7584020_2_00007FFC74C75840
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5F87020_2_00007FFC74C5F870
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C6F87020_2_00007FFC74C6F870
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C2101020_2_00007FFC74C21010
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4480020_2_00007FFC74C44800
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4C03020_2_00007FFC74C4C030
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5002020_2_00007FFC74C50020
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74CA082020_2_00007FFC74CA0820
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C3A7D020_2_00007FFC74C3A7D0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C38FC020_2_00007FFC74C38FC0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C94FF020_2_00007FFC74C94FF0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C46FE020_2_00007FFC74C46FE0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C2679020_2_00007FFC74C26790
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8C78020_2_00007FFC74C8C780
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C9EF8020_2_00007FFC74C9EF80
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4E7B020_2_00007FFC74C4E7B0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C9B7A020_2_00007FFC74C9B7A0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8695020_2_00007FFC74C86950
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4414020_2_00007FFC74C44140
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8B96020_2_00007FFC74C8B960
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C3E11020_2_00007FFC74C3E110
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4391020_2_00007FFC74C43910
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C2B10020_2_00007FFC74C2B100
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5613020_2_00007FFC74C56130
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C218D020_2_00007FFC74C218D0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C9C0EB20_2_00007FFC74C9C0EB
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C3D89020_2_00007FFC74C3D890
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C308B020_2_00007FFC74C308B0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C9C8B120_2_00007FFC74C9C8B1
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5B25020_2_00007FFC74C5B250
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C27A4020_2_00007FFC74C27A40
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8B26020_2_00007FFC74C8B260
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C521D020_2_00007FFC74C521D0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C469C020_2_00007FFC74C469C0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4F1F020_2_00007FFC74C4F1F0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C591F020_2_00007FFC74C591F0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C589F020_2_00007FFC74C589F0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5999020_2_00007FFC74C59990
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C2298020_2_00007FFC74C22980
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C3E9B020_2_00007FFC74C3E9B0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C411B020_2_00007FFC74C411B0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4E9A020_2_00007FFC74C4E9A0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C85B5020_2_00007FFC74C85B50
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C2535020_2_00007FFC74C25350
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4334020_2_00007FFC74C43340
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C3834020_2_00007FFC74C38340
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5436020_2_00007FFC74C54360
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4A31020_2_00007FFC74C4A310
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5030020_2_00007FFC74C50300
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C51B3020_2_00007FFC74C51B30
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C2BB2020_2_00007FFC74C2BB20
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C492C020_2_00007FFC74C492C0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C722C020_2_00007FFC74C722C0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C7F2C020_2_00007FFC74C7F2C0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C87AF020_2_00007FFC74C87AF0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C482E020_2_00007FFC74C482E0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C82AE020_2_00007FFC74C82AE0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C4DAA020_2_00007FFC74C4DAA0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C882A020_2_00007FFC74C882A0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8AAA020_2_00007FFC74C8AAA0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C3741020_2_00007FFC74C37410
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8941020_2_00007FFC74C89410
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8E40020_2_00007FFC74C8E400
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C9FC0020_2_00007FFC74C9FC00
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C25C2020_2_00007FFC74C25C20
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C3542020_2_00007FFC74C35420
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C74BC020_2_00007FFC74C74BC0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C323F020_2_00007FFC74C323F0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8439020_2_00007FFC74C84390
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310BC7026_2_00007FF61310BC70
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130F3C3826_2_00007FF6130F3C38
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130FA06426_2_00007FF6130FA064
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130FF46026_2_00007FF6130FF460
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130EAC8C26_2_00007FF6130EAC8C
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130F8CC026_2_00007FF6130F8CC0
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130E5CB826_2_00007FF6130E5CB8
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130E191426_2_00007FF6130E1914
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310290026_2_00007FF613102900
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310674026_2_00007FF613106740
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310079026_2_00007FF613100790
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF613108BE026_2_00007FF613108BE0
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310EFCC26_2_00007FF61310EFCC
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130E740426_2_00007FF6130E7404
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310100026_2_00007FF613101000
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF613104A4426_2_00007FF613104A44
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130E4A4426_2_00007FF6130E4A44
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF613103E8026_2_00007FF613103E80
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130EB2C026_2_00007FF6130EB2C0
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310D6F026_2_00007FF61310D6F0
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130F1B1426_2_00007FF6130F1B14
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130E533026_2_00007FF6130E5330
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130F355426_2_00007FF6130F3554
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130E295026_2_00007FF6130E2950
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130F717026_2_00007FF6130F7170
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF613105DC026_2_00007FF613105DC0
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310C5F026_2_00007FF61310C5F0
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310F22426_2_00007FF61310F224
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130FCE2026_2_00007FF6130FCE20
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130E661C26_2_00007FF6130E661C
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B87139A033_2_00007FF7B87139A0
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B87135EC33_2_00007FF7B87135EC
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B8718DF033_2_00007FF7B8718DF0
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B871CE0833_2_00007FF7B871CE08
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B871EAB433_2_00007FF7B871EAB4
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B87212E033_2_00007FF7B87212E0
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B8704EC433_2_00007FF7B8704EC4
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B879169033_2_00007FF7B8791690
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B870DA8C33_2_00007FF7B870DA8C
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B8706B9433_2_00007FF7B8706B94
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B87177C033_2_00007FF7B87177C0
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B870541033_2_00007FF7B8705410
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B874432033_2_00007FF7B8744320
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B87184C033_2_00007FF7B87184C0
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B87164DC33_2_00007FF7B87164DC
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B871A85833_2_00007FF7B871A858
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B871806033_2_00007FF7B8718060
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CE2BD835_2_00007FF742CE2BD8
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CE03A035_2_00007FF742CE03A0
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CE371835_2_00007FF742CE3718
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CD44E835_2_00007FF742CD44E8
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CD351435_2_00007FF742CD3514
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CE0CA835_2_00007FF742CE0CA8
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CEC4D035_2_00007FF742CEC4D0
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CEB08835_2_00007FF742CEB088
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CD308035_2_00007FF742CD3080
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CDA1A035_2_00007FF742CDA1A0
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CDA5C835_2_00007FF742CDA5C8
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CD831035_2_00007FF742CD8310
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CE4F1035_2_00007FF742CE4F10
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CD621835_2_00007FF742CD6218
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67107770 NtClose,0_2_00007FFC67107770
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712D520 NtQuerySystemInformation,0_2_00007FFC6712D520
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FF740787394 new,NtQueryWnfStateData,RtlSubscribeWnfStateChangeNotification,GetLastError,RtlUnsubscribeWnfNotificationWaitForCompletion,SetLastError,20_2_00007FF740787394
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C8D520 NtQuerySystemInformation,20_2_00007FFC74C8D520
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C55CD0 RtlAddVectoredContinueHandler,VirtualProtect,VirtualProtect,RtlCreateUserThread,NtClose,20_2_00007FFC74C55CD0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5C4D0 CreateFileMappingW,VirtualAlloc,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject,20_2_00007FFC74C5C4D0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C45F40 NtCreateSection,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject,20_2_00007FFC74C45F40
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C67770 NtClose,20_2_00007FFC74C67770
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5AA70 VirtualAlloc,NtDuplicateObject,RtlQueueApcWow64Thread,20_2_00007FFC74C5AA70
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5BAE0 NtReadVirtualMemory,20_2_00007FFC74C5BAE0
                      Source: eWlldJYfLc.dllBinary or memory string: OriginalFilenamedpnhupnp.dJ vs eWlldJYfLc.dll
                      Source: Dxpserver.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: Dxpserver.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: Dxpserver.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: mstsc.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: SndVol.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: SndVol.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: SndVol.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: SndVol.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: SndVol.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: SndVol.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: SndVol.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: SndVol.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: SndVol.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: C:\Windows\System32\loaddll64.exeSection loaded: kernel34.dllJump to behavior
                      Source: C:\Windows\explorer.exeSection loaded: kernel34.dllJump to behavior
                      Source: C:\Windows\explorer.exeSection loaded: windows.globalization.dllJump to behavior
                      Source: C:\Windows\explorer.exeSection loaded: capabilityaccessmanagerclient.dllJump to behavior
                      Source: C:\Windows\explorer.exeSection loaded: kernel34.dllJump to behavior
                      Source: C:\Windows\explorer.exeSection loaded: kernel34.dllJump to behavior
                      Source: C:\Windows\explorer.exeSection loaded: kernel34.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeSection loaded: kernel34.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeSection loaded: kernel34.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\bj1HT\mfpmp.exeSection loaded: kernel34.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeSection loaded: kernel34.dll
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeSection loaded: kernel34.dll
                      Source: dwmapi.dll.4.drStatic PE information: Number of sections : 61 > 10
                      Source: ACTIVEDS.dll.4.drStatic PE information: Number of sections : 61 > 10
                      Source: MFPlat.DLL.4.drStatic PE information: Number of sections : 61 > 10
                      Source: Secur32.dll.4.drStatic PE information: Number of sections : 61 > 10
                      Source: DUI70.dll.4.drStatic PE information: Number of sections : 61 > 10
                      Source: UxTheme.dll0.4.drStatic PE information: Number of sections : 61 > 10
                      Source: XmlLite.dll.4.drStatic PE information: Number of sections : 61 > 10
                      Source: XmlLite.dll0.4.drStatic PE information: Number of sections : 61 > 10
                      Source: eWlldJYfLc.dllStatic PE information: Number of sections : 60 > 10
                      Source: UxTheme.dll.4.drStatic PE information: Number of sections : 61 > 10
                      Source: eWlldJYfLc.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: dwmapi.dll.4.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: MFPlat.DLL.4.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: Secur32.dll.4.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: UxTheme.dll.4.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: XmlLite.dll.4.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: DUI70.dll.4.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: ACTIVEDS.dll.4.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: SppExtComObj.Exe.4.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: XmlLite.dll0.4.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: UxTheme.dll0.4.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: eWlldJYfLc.dllVirustotal: Detection: 67%
                      Source: eWlldJYfLc.dllMetadefender: Detection: 60%
                      Source: eWlldJYfLc.dllReversingLabs: Detection: 88%
                      Source: eWlldJYfLc.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Windows\System32\loaddll64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\eWlldJYfLc.dll"
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,IsInteractiveUserSession
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,QueryActiveSession
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,QueryUserToken
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\sdclt.exe C:\Windows\system32\sdclt.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\CloudNotifications.exe C:\Windows\system32\CloudNotifications.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exe C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\systemreset.exe C:\Windows\system32\systemreset.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\Dxpserver.exe C:\Windows\system32\Dxpserver.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exe C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\mfpmp.exe C:\Windows\system32\mfpmp.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\bj1HT\mfpmp.exe C:\Users\user\AppData\Local\bj1HT\mfpmp.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\msra.exe C:\Windows\system32\msra.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\mstsc.exe C:\Windows\system32\mstsc.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\n0R5g\mstsc.exe C:\Users\user\AppData\Local\n0R5g\mstsc.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\SndVol.exe C:\Windows\system32\SndVol.exe
                      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exe C:\Users\user\AppData\Local\Nz4mnM\SndVol.exe
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1Jump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,IsInteractiveUserSessionJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,QueryActiveSessionJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,QueryUserTokenJump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1Jump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\sdclt.exe C:\Windows\system32\sdclt.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\CloudNotifications.exe C:\Windows\system32\CloudNotifications.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exe C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\systemreset.exe C:\Windows\system32\systemreset.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\Dxpserver.exe C:\Windows\system32\Dxpserver.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exe C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -pJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\bj1HT\mfpmp.exe C:\Users\user\AppData\Local\bj1HT\mfpmp.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\msra.exe C:\Windows\system32\msra.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\mstsc.exe C:\Windows\system32\mstsc.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\n0R5g\mstsc.exe C:\Users\user\AppData\Local\n0R5g\mstsc.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\SndVol.exe C:\Windows\system32\SndVol.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exe C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                      Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\CryptoJump to behavior
                      Source: Dxpserver.exe.4.drBinary string: FNULL%s\*.*...Device%s\%s%s%s\%s%s\Device\%s%s\Device
                      Source: classification engineClassification label: mal100.troj.expl.evad.winDLL@46/19@0/0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FF740783570 CoCreateInstance,20_2_00007FF740783570
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C5CB00 GetProcessId,CreateToolhelp32Snapshot,Thread32First,20_2_00007FFC74C5CB00
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,IsInteractiveUserSession
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeMutant created: \Sessions\1\BaseNamedObjects\{02c91c43-0eca-a572-1a91-4df7a7da9f72}
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeMutant created: \Sessions\1\BaseNamedObjects\{25ac7a03-cb33-2ddf-542d-93d552beab0b}
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FF740784798 FindResourceExW,LoadResource,LockResource,20_2_00007FF740784798
                      Source: eWlldJYfLc.dllStatic PE information: Image base 0x140000000 > 0x60000000
                      Source: eWlldJYfLc.dllStatic file information: File size 1368064 > 1048576
                      Source: eWlldJYfLc.dllStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
                      Source: Binary string: SndVol.pdbGCTL source: SndVol.exe, 00000023.00000000.548108875.00007FF742CF2000.00000002.00000001.01000000.00000012.sdmp, SndVol.exe, 00000023.00000002.574100528.00007FF742CF2000.00000002.00000001.01000000.00000012.sdmp, SndVol.exe.4.dr
                      Source: Binary string: SppExtComObj.pdb source: SppExtComObj.Exe.4.dr
                      Source: Binary string: MFPMP.pdb source: mfpmp.exe, 0000001D.00000000.471765821.00007FF670A47000.00000002.00000001.01000000.0000000D.sdmp, mfpmp.exe, 0000001D.00000002.500806173.00007FF670A47000.00000002.00000001.01000000.0000000D.sdmp, mfpmp.exe.4.dr
                      Source: Binary string: CloudNotifications.pdb source: CloudNotifications.exe, 00000014.00000000.405037506.00007FF74078B000.00000002.00000001.01000000.00000009.sdmp, CloudNotifications.exe, 00000014.00000002.430793146.00007FF74078B000.00000002.00000001.01000000.00000009.sdmp, CloudNotifications.exe.4.dr
                      Source: Binary string: deviceenroller.pdb source: DeviceEnroller.exe.4.dr
                      Source: Binary string: MFPMP.pdbUGP source: mfpmp.exe, 0000001D.00000000.471765821.00007FF670A47000.00000002.00000001.01000000.0000000D.sdmp, mfpmp.exe, 0000001D.00000002.500806173.00007FF670A47000.00000002.00000001.01000000.0000000D.sdmp, mfpmp.exe.4.dr
                      Source: Binary string: DXPServer.pdbGCTL source: Dxpserver.exe, 0000001A.00000000.442933050.00007FF613111000.00000002.00000001.01000000.0000000B.sdmp, Dxpserver.exe, 0000001A.00000002.465912323.00007FF613111000.00000002.00000001.01000000.0000000B.sdmp, Dxpserver.exe.4.dr
                      Source: Binary string: mstsc.pdbGCTL source: mstsc.exe, 00000021.00000000.509159807.00007FF7B8824000.00000002.00000001.01000000.00000010.sdmp, mstsc.exe, 00000021.00000002.535164127.00007FF7B8824000.00000002.00000001.01000000.00000010.sdmp, mstsc.exe.4.dr
                      Source: Binary string: CameraSettingsUIHost.pdbGCTL source: CameraSettingsUIHost.exe.4.dr
                      Source: Binary string: CameraSettingsUIHost.pdb source: CameraSettingsUIHost.exe.4.dr
                      Source: Binary string: SppExtComObj.pdbUGP source: SppExtComObj.Exe.4.dr
                      Source: Binary string: mstsc.pdb source: mstsc.exe, 00000021.00000000.509159807.00007FF7B8824000.00000002.00000001.01000000.00000010.sdmp, mstsc.exe, 00000021.00000002.535164127.00007FF7B8824000.00000002.00000001.01000000.00000010.sdmp, mstsc.exe.4.dr
                      Source: Binary string: DDODiag.pdbGCTL source: ddodiag.exe.4.dr
                      Source: Binary string: DDODiag.pdb source: ddodiag.exe.4.dr
                      Source: Binary string: SndVol.pdb source: SndVol.exe, 00000023.00000000.548108875.00007FF742CF2000.00000002.00000001.01000000.00000012.sdmp, SndVol.exe, 00000023.00000002.574100528.00007FF742CF2000.00000002.00000001.01000000.00000012.sdmp, SndVol.exe.4.dr
                      Source: Binary string: CloudNotifications.pdbGCTL source: CloudNotifications.exe, 00000014.00000000.405037506.00007FF74078B000.00000002.00000001.01000000.00000009.sdmp, CloudNotifications.exe, 00000014.00000002.430793146.00007FF74078B000.00000002.00000001.01000000.00000009.sdmp, CloudNotifications.exe.4.dr
                      Source: Binary string: DXPServer.pdb source: Dxpserver.exe, 0000001A.00000000.442933050.00007FF613111000.00000002.00000001.01000000.0000000B.sdmp, Dxpserver.exe, 0000001A.00000002.465912323.00007FF613111000.00000002.00000001.01000000.0000000B.sdmp, Dxpserver.exe.4.dr
                      Source: Binary string: deviceenroller.pdbGCTL source: DeviceEnroller.exe.4.dr
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6713D500 push rax; iretd 0_2_00007FFC6713D501
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C9D500 push rax; iretd 20_2_00007FFC74C9D501
                      Source: eWlldJYfLc.dllStatic PE information: section name: .vxl
                      Source: eWlldJYfLc.dllStatic PE information: section name: .qwubgr
                      Source: eWlldJYfLc.dllStatic PE information: section name: .eer
                      Source: eWlldJYfLc.dllStatic PE information: section name: .xwwauf
                      Source: eWlldJYfLc.dllStatic PE information: section name: .pkc
                      Source: eWlldJYfLc.dllStatic PE information: section name: .npkda
                      Source: eWlldJYfLc.dllStatic PE information: section name: .vhs
                      Source: eWlldJYfLc.dllStatic PE information: section name: .iaywj
                      Source: eWlldJYfLc.dllStatic PE information: section name: .nasi
                      Source: eWlldJYfLc.dllStatic PE information: section name: .zhvprh
                      Source: eWlldJYfLc.dllStatic PE information: section name: .yatdsp
                      Source: eWlldJYfLc.dllStatic PE information: section name: .njso
                      Source: eWlldJYfLc.dllStatic PE information: section name: .lgliat
                      Source: eWlldJYfLc.dllStatic PE information: section name: .ntqjh
                      Source: eWlldJYfLc.dllStatic PE information: section name: .sucsek
                      Source: eWlldJYfLc.dllStatic PE information: section name: .qsxjui
                      Source: eWlldJYfLc.dllStatic PE information: section name: .twctcm
                      Source: eWlldJYfLc.dllStatic PE information: section name: .nms
                      Source: eWlldJYfLc.dllStatic PE information: section name: .ogj
                      Source: eWlldJYfLc.dllStatic PE information: section name: .vrkgb
                      Source: eWlldJYfLc.dllStatic PE information: section name: .gikfw
                      Source: eWlldJYfLc.dllStatic PE information: section name: .ktl
                      Source: eWlldJYfLc.dllStatic PE information: section name: .crcn
                      Source: eWlldJYfLc.dllStatic PE information: section name: .wtfr
                      Source: eWlldJYfLc.dllStatic PE information: section name: .hep
                      Source: eWlldJYfLc.dllStatic PE information: section name: .ywg
                      Source: eWlldJYfLc.dllStatic PE information: section name: .sqsp
                      Source: eWlldJYfLc.dllStatic PE information: section name: .gzb
                      Source: eWlldJYfLc.dllStatic PE information: section name: .fatlss
                      Source: eWlldJYfLc.dllStatic PE information: section name: .plqa
                      Source: eWlldJYfLc.dllStatic PE information: section name: .vzt
                      Source: eWlldJYfLc.dllStatic PE information: section name: .dsbyd
                      Source: eWlldJYfLc.dllStatic PE information: section name: .cdelc
                      Source: eWlldJYfLc.dllStatic PE information: section name: .qkhkj
                      Source: eWlldJYfLc.dllStatic PE information: section name: .mnzegr
                      Source: eWlldJYfLc.dllStatic PE information: section name: .krw
                      Source: eWlldJYfLc.dllStatic PE information: section name: .jvsmn
                      Source: eWlldJYfLc.dllStatic PE information: section name: .bygpq
                      Source: eWlldJYfLc.dllStatic PE information: section name: .kzdbu
                      Source: eWlldJYfLc.dllStatic PE information: section name: .mwxorn
                      Source: eWlldJYfLc.dllStatic PE information: section name: .raf
                      Source: eWlldJYfLc.dllStatic PE information: section name: .zcyw
                      Source: eWlldJYfLc.dllStatic PE information: section name: .zeczh
                      Source: eWlldJYfLc.dllStatic PE information: section name: .pvv
                      Source: eWlldJYfLc.dllStatic PE information: section name: .lug
                      Source: eWlldJYfLc.dllStatic PE information: section name: .ski
                      Source: eWlldJYfLc.dllStatic PE information: section name: .japjd
                      Source: eWlldJYfLc.dllStatic PE information: section name: .mwtzml
                      Source: eWlldJYfLc.dllStatic PE information: section name: .vgssf
                      Source: eWlldJYfLc.dllStatic PE information: section name: .gsroye
                      Source: eWlldJYfLc.dllStatic PE information: section name: .vcmr
                      Source: eWlldJYfLc.dllStatic PE information: section name: .ufki
                      Source: eWlldJYfLc.dllStatic PE information: section name: .btl
                      Source: eWlldJYfLc.dllStatic PE information: section name: .pmeh
                      Source: mfpmp.exe.4.drStatic PE information: section name: .didat
                      Source: mstsc.exe.4.drStatic PE information: section name: .didat
                      Source: SndVol.exe.4.drStatic PE information: section name: .imrsiv
                      Source: SndVol.exe.4.drStatic PE information: section name: .didat
                      Source: DeviceEnroller.exe.4.drStatic PE information: section name: .didat
                      Source: CameraSettingsUIHost.exe.4.drStatic PE information: section name: .imrsiv
                      Source: CloudNotifications.exe.4.drStatic PE information: section name: .imrsiv
                      Source: CloudNotifications.exe.4.drStatic PE information: section name: .didat
                      Source: dwmapi.dll.4.drStatic PE information: section name: .vxl
                      Source: dwmapi.dll.4.drStatic PE information: section name: .qwubgr
                      Source: dwmapi.dll.4.drStatic PE information: section name: .eer
                      Source: dwmapi.dll.4.drStatic PE information: section name: .xwwauf
                      Source: dwmapi.dll.4.drStatic PE information: section name: .pkc
                      Source: dwmapi.dll.4.drStatic PE information: section name: .npkda
                      Source: dwmapi.dll.4.drStatic PE information: section name: .vhs
                      Source: dwmapi.dll.4.drStatic PE information: section name: .iaywj
                      Source: dwmapi.dll.4.drStatic PE information: section name: .nasi
                      Source: dwmapi.dll.4.drStatic PE information: section name: .zhvprh
                      Source: dwmapi.dll.4.drStatic PE information: section name: .yatdsp
                      Source: dwmapi.dll.4.drStatic PE information: section name: .njso
                      Source: dwmapi.dll.4.drStatic PE information: section name: .lgliat
                      Source: dwmapi.dll.4.drStatic PE information: section name: .ntqjh
                      Source: dwmapi.dll.4.drStatic PE information: section name: .sucsek
                      Source: dwmapi.dll.4.drStatic PE information: section name: .qsxjui
                      Source: dwmapi.dll.4.drStatic PE information: section name: .twctcm
                      Source: dwmapi.dll.4.drStatic PE information: section name: .nms
                      Source: dwmapi.dll.4.drStatic PE information: section name: .ogj
                      Source: dwmapi.dll.4.drStatic PE information: section name: .vrkgb
                      Source: dwmapi.dll.4.drStatic PE information: section name: .gikfw
                      Source: dwmapi.dll.4.drStatic PE information: section name: .ktl
                      Source: dwmapi.dll.4.drStatic PE information: section name: .crcn
                      Source: dwmapi.dll.4.drStatic PE information: section name: .wtfr
                      Source: dwmapi.dll.4.drStatic PE information: section name: .hep
                      Source: dwmapi.dll.4.drStatic PE information: section name: .ywg
                      Source: dwmapi.dll.4.drStatic PE information: section name: .sqsp
                      Source: dwmapi.dll.4.drStatic PE information: section name: .gzb
                      Source: dwmapi.dll.4.drStatic PE information: section name: .fatlss
                      Source: dwmapi.dll.4.drStatic PE information: section name: .plqa
                      Source: dwmapi.dll.4.drStatic PE information: section name: .vzt
                      Source: dwmapi.dll.4.drStatic PE information: section name: .dsbyd
                      Source: dwmapi.dll.4.drStatic PE information: section name: .cdelc
                      Source: dwmapi.dll.4.drStatic PE information: section name: .qkhkj
                      Source: dwmapi.dll.4.drStatic PE information: section name: .mnzegr
                      Source: dwmapi.dll.4.drStatic PE information: section name: .krw
                      Source: dwmapi.dll.4.drStatic PE information: section name: .jvsmn
                      Source: dwmapi.dll.4.drStatic PE information: section name: .bygpq
                      Source: dwmapi.dll.4.drStatic PE information: section name: .kzdbu
                      Source: dwmapi.dll.4.drStatic PE information: section name: .mwxorn
                      Source: dwmapi.dll.4.drStatic PE information: section name: .raf
                      Source: dwmapi.dll.4.drStatic PE information: section name: .zcyw
                      Source: dwmapi.dll.4.drStatic PE information: section name: .zeczh
                      Source: dwmapi.dll.4.drStatic PE information: section name: .pvv
                      Source: dwmapi.dll.4.drStatic PE information: section name: .lug
                      Source: dwmapi.dll.4.drStatic PE information: section name: .ski
                      Source: dwmapi.dll.4.drStatic PE information: section name: .japjd
                      Source: dwmapi.dll.4.drStatic PE information: section name: .mwtzml
                      Source: dwmapi.dll.4.drStatic PE information: section name: .vgssf
                      Source: dwmapi.dll.4.drStatic PE information: section name: .gsroye
                      Source: dwmapi.dll.4.drStatic PE information: section name: .vcmr
                      Source: dwmapi.dll.4.drStatic PE information: section name: .ufki
                      Source: dwmapi.dll.4.drStatic PE information: section name: .btl
                      Source: dwmapi.dll.4.drStatic PE information: section name: .pmeh
                      Source: dwmapi.dll.4.drStatic PE information: section name: .bfwtl
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .vxl
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .qwubgr
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .eer
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .xwwauf
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .pkc
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .npkda
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .vhs
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .iaywj
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .nasi
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .zhvprh
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .yatdsp
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .njso
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .lgliat
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .ntqjh
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .sucsek
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .qsxjui
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .twctcm
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .nms
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .ogj
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .vrkgb
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .gikfw
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .ktl
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .crcn
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .wtfr
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .hep
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .ywg
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .sqsp
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .gzb
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .fatlss
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .plqa
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .vzt
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .dsbyd
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .cdelc
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .qkhkj
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .mnzegr
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .krw
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .jvsmn
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .bygpq
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .kzdbu
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .mwxorn
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .raf
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .zcyw
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .zeczh
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .pvv
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .lug
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .ski
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .japjd
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .mwtzml
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .vgssf
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .gsroye
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .vcmr
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .ufki
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .btl
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .pmeh
                      Source: MFPlat.DLL.4.drStatic PE information: section name: .mivbr
                      Source: Secur32.dll.4.drStatic PE information: section name: .vxl
                      Source: Secur32.dll.4.drStatic PE information: section name: .qwubgr
                      Source: Secur32.dll.4.drStatic PE information: section name: .eer
                      Source: Secur32.dll.4.drStatic PE information: section name: .xwwauf
                      Source: Secur32.dll.4.drStatic PE information: section name: .pkc
                      Source: Secur32.dll.4.drStatic PE information: section name: .npkda
                      Source: Secur32.dll.4.drStatic PE information: section name: .vhs
                      Source: Secur32.dll.4.drStatic PE information: section name: .iaywj
                      Source: Secur32.dll.4.drStatic PE information: section name: .nasi
                      Source: Secur32.dll.4.drStatic PE information: section name: .zhvprh
                      Source: Secur32.dll.4.drStatic PE information: section name: .yatdsp
                      Source: Secur32.dll.4.drStatic PE information: section name: .njso
                      Source: Secur32.dll.4.drStatic PE information: section name: .lgliat
                      Source: Secur32.dll.4.drStatic PE information: section name: .ntqjh
                      Source: Secur32.dll.4.drStatic PE information: section name: .sucsek
                      Source: Secur32.dll.4.drStatic PE information: section name: .qsxjui
                      Source: Secur32.dll.4.drStatic PE information: section name: .twctcm
                      Source: Secur32.dll.4.drStatic PE information: section name: .nms
                      Source: Secur32.dll.4.drStatic PE information: section name: .ogj
                      Source: Secur32.dll.4.drStatic PE information: section name: .vrkgb
                      Source: Secur32.dll.4.drStatic PE information: section name: .gikfw
                      Source: Secur32.dll.4.drStatic PE information: section name: .ktl
                      Source: Secur32.dll.4.drStatic PE information: section name: .crcn
                      Source: Secur32.dll.4.drStatic PE information: section name: .wtfr
                      Source: Secur32.dll.4.drStatic PE information: section name: .hep
                      Source: Secur32.dll.4.drStatic PE information: section name: .ywg
                      Source: Secur32.dll.4.drStatic PE information: section name: .sqsp
                      Source: Secur32.dll.4.drStatic PE information: section name: .gzb
                      Source: Secur32.dll.4.drStatic PE information: section name: .fatlss
                      Source: Secur32.dll.4.drStatic PE information: section name: .plqa
                      Source: Secur32.dll.4.drStatic PE information: section name: .vzt
                      Source: Secur32.dll.4.drStatic PE information: section name: .dsbyd
                      Source: Secur32.dll.4.drStatic PE information: section name: .cdelc
                      Source: Secur32.dll.4.drStatic PE information: section name: .qkhkj
                      Source: Secur32.dll.4.drStatic PE information: section name: .mnzegr
                      Source: Secur32.dll.4.drStatic PE information: section name: .krw
                      Source: Secur32.dll.4.drStatic PE information: section name: .jvsmn
                      Source: Secur32.dll.4.drStatic PE information: section name: .bygpq
                      Source: Secur32.dll.4.drStatic PE information: section name: .kzdbu
                      Source: Secur32.dll.4.drStatic PE information: section name: .mwxorn
                      Source: Secur32.dll.4.drStatic PE information: section name: .raf
                      Source: Secur32.dll.4.drStatic PE information: section name: .zcyw
                      Source: Secur32.dll.4.drStatic PE information: section name: .zeczh
                      Source: Secur32.dll.4.drStatic PE information: section name: .pvv
                      Source: Secur32.dll.4.drStatic PE information: section name: .lug
                      Source: Secur32.dll.4.drStatic PE information: section name: .ski
                      Source: Secur32.dll.4.drStatic PE information: section name: .japjd
                      Source: Secur32.dll.4.drStatic PE information: section name: .mwtzml
                      Source: Secur32.dll.4.drStatic PE information: section name: .vgssf
                      Source: Secur32.dll.4.drStatic PE information: section name: .gsroye
                      Source: Secur32.dll.4.drStatic PE information: section name: .vcmr
                      Source: Secur32.dll.4.drStatic PE information: section name: .ufki
                      Source: Secur32.dll.4.drStatic PE information: section name: .btl
                      Source: Secur32.dll.4.drStatic PE information: section name: .pmeh
                      Source: Secur32.dll.4.drStatic PE information: section name: .uuuuw
                      Source: UxTheme.dll.4.drStatic PE information: section name: .vxl
                      Source: UxTheme.dll.4.drStatic PE information: section name: .qwubgr
                      Source: UxTheme.dll.4.drStatic PE information: section name: .eer
                      Source: UxTheme.dll.4.drStatic PE information: section name: .xwwauf
                      Source: UxTheme.dll.4.drStatic PE information: section name: .pkc
                      Source: UxTheme.dll.4.drStatic PE information: section name: .npkda
                      Source: UxTheme.dll.4.drStatic PE information: section name: .vhs
                      Source: UxTheme.dll.4.drStatic PE information: section name: .iaywj
                      Source: UxTheme.dll.4.drStatic PE information: section name: .nasi
                      Source: UxTheme.dll.4.drStatic PE information: section name: .zhvprh
                      Source: UxTheme.dll.4.drStatic PE information: section name: .yatdsp
                      Source: UxTheme.dll.4.drStatic PE information: section name: .njso
                      Source: UxTheme.dll.4.drStatic PE information: section name: .lgliat
                      Source: UxTheme.dll.4.drStatic PE information: section name: .ntqjh
                      Source: UxTheme.dll.4.drStatic PE information: section name: .sucsek
                      Source: UxTheme.dll.4.drStatic PE information: section name: .qsxjui
                      Source: UxTheme.dll.4.drStatic PE information: section name: .twctcm
                      Source: UxTheme.dll.4.drStatic PE information: section name: .nms
                      Source: UxTheme.dll.4.drStatic PE information: section name: .ogj
                      Source: UxTheme.dll.4.drStatic PE information: section name: .vrkgb
                      Source: UxTheme.dll.4.drStatic PE information: section name: .gikfw
                      Source: UxTheme.dll.4.drStatic PE information: section name: .ktl
                      Source: UxTheme.dll.4.drStatic PE information: section name: .crcn
                      Source: UxTheme.dll.4.drStatic PE information: section name: .wtfr
                      Source: UxTheme.dll.4.drStatic PE information: section name: .hep
                      Source: UxTheme.dll.4.drStatic PE information: section name: .ywg
                      Source: UxTheme.dll.4.drStatic PE information: section name: .sqsp
                      Source: UxTheme.dll.4.drStatic PE information: section name: .gzb
                      Source: UxTheme.dll.4.drStatic PE information: section name: .fatlss
                      Source: UxTheme.dll.4.drStatic PE information: section name: .plqa
                      Source: UxTheme.dll.4.drStatic PE information: section name: .vzt
                      Source: UxTheme.dll.4.drStatic PE information: section name: .dsbyd
                      Source: UxTheme.dll.4.drStatic PE information: section name: .cdelc
                      Source: UxTheme.dll.4.drStatic PE information: section name: .qkhkj
                      Source: UxTheme.dll.4.drStatic PE information: section name: .mnzegr
                      Source: UxTheme.dll.4.drStatic PE information: section name: .krw
                      Source: UxTheme.dll.4.drStatic PE information: section name: .jvsmn
                      Source: UxTheme.dll.4.drStatic PE information: section name: .bygpq
                      Source: UxTheme.dll.4.drStatic PE information: section name: .kzdbu
                      Source: UxTheme.dll.4.drStatic PE information: section name: .mwxorn
                      Source: UxTheme.dll.4.drStatic PE information: section name: .raf
                      Source: UxTheme.dll.4.drStatic PE information: section name: .zcyw
                      Source: UxTheme.dll.4.drStatic PE information: section name: .zeczh
                      Source: UxTheme.dll.4.drStatic PE information: section name: .pvv
                      Source: UxTheme.dll.4.drStatic PE information: section name: .lug
                      Source: UxTheme.dll.4.drStatic PE information: section name: .ski
                      Source: UxTheme.dll.4.drStatic PE information: section name: .japjd
                      Source: UxTheme.dll.4.drStatic PE information: section name: .mwtzml
                      Source: UxTheme.dll.4.drStatic PE information: section name: .vgssf
                      Source: UxTheme.dll.4.drStatic PE information: section name: .gsroye
                      Source: UxTheme.dll.4.drStatic PE information: section name: .vcmr
                      Source: UxTheme.dll.4.drStatic PE information: section name: .ufki
                      Source: UxTheme.dll.4.drStatic PE information: section name: .btl
                      Source: UxTheme.dll.4.drStatic PE information: section name: .pmeh
                      Source: UxTheme.dll.4.drStatic PE information: section name: .leg
                      Source: XmlLite.dll.4.drStatic PE information: section name: .vxl
                      Source: XmlLite.dll.4.drStatic PE information: section name: .qwubgr
                      Source: XmlLite.dll.4.drStatic PE information: section name: .eer
                      Source: XmlLite.dll.4.drStatic PE information: section name: .xwwauf
                      Source: XmlLite.dll.4.drStatic PE information: section name: .pkc
                      Source: XmlLite.dll.4.drStatic PE information: section name: .npkda
                      Source: XmlLite.dll.4.drStatic PE information: section name: .vhs
                      Source: XmlLite.dll.4.drStatic PE information: section name: .iaywj
                      Source: XmlLite.dll.4.drStatic PE information: section name: .nasi
                      Source: XmlLite.dll.4.drStatic PE information: section name: .zhvprh
                      Source: XmlLite.dll.4.drStatic PE information: section name: .yatdsp
                      Source: XmlLite.dll.4.drStatic PE information: section name: .njso
                      Source: XmlLite.dll.4.drStatic PE information: section name: .lgliat
                      Source: XmlLite.dll.4.drStatic PE information: section name: .ntqjh
                      Source: XmlLite.dll.4.drStatic PE information: section name: .sucsek
                      Source: XmlLite.dll.4.drStatic PE information: section name: .qsxjui
                      Source: XmlLite.dll.4.drStatic PE information: section name: .twctcm
                      Source: XmlLite.dll.4.drStatic PE information: section name: .nms
                      Source: XmlLite.dll.4.drStatic PE information: section name: .ogj
                      Source: XmlLite.dll.4.drStatic PE information: section name: .vrkgb
                      Source: XmlLite.dll.4.drStatic PE information: section name: .gikfw
                      Source: XmlLite.dll.4.drStatic PE information: section name: .ktl
                      Source: XmlLite.dll.4.drStatic PE information: section name: .crcn
                      Source: XmlLite.dll.4.drStatic PE information: section name: .wtfr
                      Source: XmlLite.dll.4.drStatic PE information: section name: .hep
                      Source: XmlLite.dll.4.drStatic PE information: section name: .ywg
                      Source: XmlLite.dll.4.drStatic PE information: section name: .sqsp
                      Source: XmlLite.dll.4.drStatic PE information: section name: .gzb
                      Source: XmlLite.dll.4.drStatic PE information: section name: .fatlss
                      Source: XmlLite.dll.4.drStatic PE information: section name: .plqa
                      Source: XmlLite.dll.4.drStatic PE information: section name: .vzt
                      Source: XmlLite.dll.4.drStatic PE information: section name: .dsbyd
                      Source: XmlLite.dll.4.drStatic PE information: section name: .cdelc
                      Source: XmlLite.dll.4.drStatic PE information: section name: .qkhkj
                      Source: XmlLite.dll.4.drStatic PE information: section name: .mnzegr
                      Source: XmlLite.dll.4.drStatic PE information: section name: .krw
                      Source: XmlLite.dll.4.drStatic PE information: section name: .jvsmn
                      Source: XmlLite.dll.4.drStatic PE information: section name: .bygpq
                      Source: XmlLite.dll.4.drStatic PE information: section name: .kzdbu
                      Source: XmlLite.dll.4.drStatic PE information: section name: .mwxorn
                      Source: XmlLite.dll.4.drStatic PE information: section name: .raf
                      Source: XmlLite.dll.4.drStatic PE information: section name: .zcyw
                      Source: XmlLite.dll.4.drStatic PE information: section name: .zeczh
                      Source: XmlLite.dll.4.drStatic PE information: section name: .pvv
                      Source: XmlLite.dll.4.drStatic PE information: section name: .lug
                      Source: XmlLite.dll.4.drStatic PE information: section name: .ski
                      Source: XmlLite.dll.4.drStatic PE information: section name: .japjd
                      Source: XmlLite.dll.4.drStatic PE information: section name: .mwtzml
                      Source: XmlLite.dll.4.drStatic PE information: section name: .vgssf
                      Source: XmlLite.dll.4.drStatic PE information: section name: .gsroye
                      Source: XmlLite.dll.4.drStatic PE information: section name: .vcmr
                      Source: XmlLite.dll.4.drStatic PE information: section name: .ufki
                      Source: XmlLite.dll.4.drStatic PE information: section name: .btl
                      Source: XmlLite.dll.4.drStatic PE information: section name: .pmeh
                      Source: XmlLite.dll.4.drStatic PE information: section name: .sfgb
                      Source: DUI70.dll.4.drStatic PE information: section name: .vxl
                      Source: DUI70.dll.4.drStatic PE information: section name: .qwubgr
                      Source: DUI70.dll.4.drStatic PE information: section name: .eer
                      Source: DUI70.dll.4.drStatic PE information: section name: .xwwauf
                      Source: DUI70.dll.4.drStatic PE information: section name: .pkc
                      Source: DUI70.dll.4.drStatic PE information: section name: .npkda
                      Source: DUI70.dll.4.drStatic PE information: section name: .vhs
                      Source: DUI70.dll.4.drStatic PE information: section name: .iaywj
                      Source: DUI70.dll.4.drStatic PE information: section name: .nasi
                      Source: DUI70.dll.4.drStatic PE information: section name: .zhvprh
                      Source: DUI70.dll.4.drStatic PE information: section name: .yatdsp
                      Source: DUI70.dll.4.drStatic PE information: section name: .njso
                      Source: DUI70.dll.4.drStatic PE information: section name: .lgliat
                      Source: DUI70.dll.4.drStatic PE information: section name: .ntqjh
                      Source: DUI70.dll.4.drStatic PE information: section name: .sucsek
                      Source: DUI70.dll.4.drStatic PE information: section name: .qsxjui
                      Source: DUI70.dll.4.drStatic PE information: section name: .twctcm
                      Source: DUI70.dll.4.drStatic PE information: section name: .nms
                      Source: DUI70.dll.4.drStatic PE information: section name: .ogj
                      Source: DUI70.dll.4.drStatic PE information: section name: .vrkgb
                      Source: DUI70.dll.4.drStatic PE information: section name: .gikfw
                      Source: DUI70.dll.4.drStatic PE information: section name: .ktl
                      Source: DUI70.dll.4.drStatic PE information: section name: .crcn
                      Source: DUI70.dll.4.drStatic PE information: section name: .wtfr
                      Source: DUI70.dll.4.drStatic PE information: section name: .hep
                      Source: DUI70.dll.4.drStatic PE information: section name: .ywg
                      Source: DUI70.dll.4.drStatic PE information: section name: .sqsp
                      Source: DUI70.dll.4.drStatic PE information: section name: .gzb
                      Source: DUI70.dll.4.drStatic PE information: section name: .fatlss
                      Source: DUI70.dll.4.drStatic PE information: section name: .plqa
                      Source: DUI70.dll.4.drStatic PE information: section name: .vzt
                      Source: DUI70.dll.4.drStatic PE information: section name: .dsbyd
                      Source: DUI70.dll.4.drStatic PE information: section name: .cdelc
                      Source: DUI70.dll.4.drStatic PE information: section name: .qkhkj
                      Source: DUI70.dll.4.drStatic PE information: section name: .mnzegr
                      Source: DUI70.dll.4.drStatic PE information: section name: .krw
                      Source: DUI70.dll.4.drStatic PE information: section name: .jvsmn
                      Source: DUI70.dll.4.drStatic PE information: section name: .bygpq
                      Source: DUI70.dll.4.drStatic PE information: section name: .kzdbu
                      Source: DUI70.dll.4.drStatic PE information: section name: .mwxorn
                      Source: DUI70.dll.4.drStatic PE information: section name: .raf
                      Source: DUI70.dll.4.drStatic PE information: section name: .zcyw
                      Source: DUI70.dll.4.drStatic PE information: section name: .zeczh
                      Source: DUI70.dll.4.drStatic PE information: section name: .pvv
                      Source: DUI70.dll.4.drStatic PE information: section name: .lug
                      Source: DUI70.dll.4.drStatic PE information: section name: .ski
                      Source: DUI70.dll.4.drStatic PE information: section name: .japjd
                      Source: DUI70.dll.4.drStatic PE information: section name: .mwtzml
                      Source: DUI70.dll.4.drStatic PE information: section name: .vgssf
                      Source: DUI70.dll.4.drStatic PE information: section name: .gsroye
                      Source: DUI70.dll.4.drStatic PE information: section name: .vcmr
                      Source: DUI70.dll.4.drStatic PE information: section name: .ufki
                      Source: DUI70.dll.4.drStatic PE information: section name: .btl
                      Source: DUI70.dll.4.drStatic PE information: section name: .pmeh
                      Source: DUI70.dll.4.drStatic PE information: section name: .mquhr
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .vxl
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .qwubgr
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .eer
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .xwwauf
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .pkc
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .npkda
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .vhs
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .iaywj
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .nasi
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .zhvprh
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .yatdsp
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .njso
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .lgliat
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .ntqjh
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .sucsek
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .qsxjui
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .twctcm
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .nms
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .ogj
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .vrkgb
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .gikfw
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .ktl
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .crcn
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .wtfr
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .hep
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .ywg
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .sqsp
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .gzb
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .fatlss
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .plqa
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .vzt
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .dsbyd
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .cdelc
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .qkhkj
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .mnzegr
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .krw
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .jvsmn
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .bygpq
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .kzdbu
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .mwxorn
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .raf
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .zcyw
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .zeczh
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .pvv
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .lug
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .ski
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .japjd
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .mwtzml
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .vgssf
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .gsroye
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .vcmr
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .ufki
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .btl
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .pmeh
                      Source: ACTIVEDS.dll.4.drStatic PE information: section name: .nfr
                      Source: SppExtComObj.Exe.4.drStatic PE information: section name: ?g_Encry
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .vxl
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .qwubgr
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .eer
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .xwwauf
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .pkc
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .npkda
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .vhs
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .iaywj
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .nasi
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .zhvprh
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .yatdsp
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .njso
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .lgliat
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .ntqjh
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .sucsek
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .qsxjui
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .twctcm
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .nms
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .ogj
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .vrkgb
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .gikfw
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .ktl
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .crcn
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .wtfr
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .hep
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .ywg
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .sqsp
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .gzb
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .fatlss
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .plqa
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .vzt
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .dsbyd
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .cdelc
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .qkhkj
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .mnzegr
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .krw
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .jvsmn
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .bygpq
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .kzdbu
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .mwxorn
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .raf
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .zcyw
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .zeczh
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .pvv
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .lug
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .ski
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .japjd
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .mwtzml
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .vgssf
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .gsroye
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .vcmr
                      Source: XmlLite.dll0.4.drStatic PE information: section name: .ufki
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B871BEA0 LoadLibraryW,GetProcAddress,GetProcAddress,33_2_00007FF7B871BEA0
                      Source: Dxpserver.exe.4.drStatic PE information: 0xABA47AA2 [Sat Apr 2 16:00:34 2061 UTC]
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.78392111205
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.78392111205
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.78392111205
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.78392111205
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.78392111205
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.78392111205
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.78392111205
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.78392111205
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.59477523886
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.78392111205
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.78392111205
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\n0R5g\Secur32.dllJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\n0R5g\mstsc.exeJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\EQ0DjT2sP\CameraSettingsUIHost.exeJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\O0z6Mm4\XmlLite.dllJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\aJcBg\DeviceEnroller.exeJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\bj1HT\mfpmp.exeJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\4O9p1cGN\dwmapi.dllJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\aJcBg\XmlLite.dllJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\EQ0DjT2sP\DUI70.dllJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\vFRJtv0CU\SppExtComObj.ExeJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Nz4mnM\UxTheme.dllJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\vFRJtv0CU\ACTIVEDS.dllJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\R7Mg9\UxTheme.dllJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\O0z6Mm4\ddodiag.exeJump to dropped file
                      Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\bj1HT\MFPlat.DLLJump to dropped file
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130F3080 WinSqmSetString,IsIconic,ShowWindow,GetSystemMenu,CheckMenuItem,26_2_00007FF6130F3080
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B87139A0 SetFocus,LoadCursorW,SetCursor,DefWindowProcW,GetClientRect,IsIconic,memset,GetTitleBarInfo,GetCursorPos,SendMessageW,33_2_00007FF7B87139A0
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B870F5A4 DefWindowProcW,IsIconic,GetClientRect,GetLastError,VariantClear,DefWindowProcW,33_2_00007FF7B870F5A4
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B878C560 GetWindowRect,IsWindow,IsIconic,GetSystemMetrics,GetSystemMetrics,GetWindowRect,PtInRect,PtInRect,SystemParametersInfoW,CopyRect,SetWindowPos,33_2_00007FF7B878C560
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B870CE48 IsIconic,GetWindowPlacement,GetLastError,33_2_00007FF7B870CE48
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B8709A6C IsIconic,GetWindowPlacement,GetWindowRect,33_2_00007FF7B8709A6C
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B870CF28 IsIconic,GetWindowPlacement,GetLastError,IsZoomed,SetWindowPlacement,GetLastError,SetWindowPos,SetWindowPos,GetClientRect,MoveWindow,33_2_00007FF7B870CF28
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B8711B44 lstrcmpW,LockWindowUpdate,IsIconic,GetWindowPlacement,GetWindowLongW,SetWindowLongW,SetWindowLongW,VariantInit,VariantClear,GetRgnBox,OffsetRgn,VariantClear,ShowWindow,SetWindowPos,SetWindowPos,SetWindowRgn,LockWindowUpdate,33_2_00007FF7B8711B44
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B8712F5C IsWindowVisible,IsIconic,33_2_00007FF7B8712F5C
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B87104F8 IsZoomed,IsIconic,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,33_2_00007FF7B87104F8
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B8712884 GetWindowRect,GetWindowLongW,GetWindowLongW,memset,CopyRect,IntersectRect,MoveWindow,IsIconic,memset,GetWindowPlacement,33_2_00007FF7B8712884
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\explorer.exe TID: 5344Thread sleep count: 63 > 30Jump to behavior
                      Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\EQ0DjT2sP\CameraSettingsUIHost.exeJump to dropped file
                      Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\aJcBg\DeviceEnroller.exeJump to dropped file
                      Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\EQ0DjT2sP\DUI70.dllJump to dropped file
                      Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\vFRJtv0CU\SppExtComObj.ExeJump to dropped file
                      Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\vFRJtv0CU\ACTIVEDS.dllJump to dropped file
                      Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\O0z6Mm4\ddodiag.exeJump to dropped file
                      Source: C:\Windows\System32\loaddll64.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-81998
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_20-79317
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeAPI coverage: 0.3 %
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeAPI coverage: 0.4 %
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeAPI coverage: 0.3 %
                      Source: C:\Windows\System32\loaddll64.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6711DDC0 GetSystemInfo,0_2_00007FFC6711DDC0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6711ED10 FindFirstFileExW,0_2_00007FFC6711ED10
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FFC74C7ED10 FindFirstFileExW,20_2_00007FFC74C7ED10
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6130E1914 SHCreateDirectory,memset,FindFirstFileW,CompareStringOrdinal,CompareStringOrdinal,CompareStringOrdinal,CompareStringOrdinal,SHCreateDirectory,CompareStringOrdinal,CreateFileW,CloseHandle,GetLastError,SetFileAttributesW,CopyFileExW,GetLastError,CoCreateGuid,StringFromGUID2,MoveFileW,GetLastError,CopyFileExW,GetLastError,FindNextFileW,FindClose,GetLastError,26_2_00007FF6130E1914
                      Source: explorer.exe, 00000004.00000000.304934300.000000000832A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
                      Source: explorer.exe, 00000004.00000000.303147807.00000000080ED000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
                      Source: explorer.exe, 00000004.00000000.303959479.0000000008223000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}m&ven_n
                      Source: explorer.exe, 00000004.00000000.280980769.0000000000680000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _VMware_SATA_CD00#5&280b647&
                      Source: explorer.exe, 00000004.00000000.340794911.000000000069D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: explorer.exe, 00000004.00000000.303959479.0000000008223000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
                      Source: explorer.exe, 00000004.00000000.303959479.0000000008223000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}t]
                      Source: explorer.exe, 00000004.00000000.267951079.00000000062C4000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: explorer.exe, 00000004.00000000.263815655.0000000004287000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0
                      Source: explorer.exe, 00000004.00000000.303880362.000000000820E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
                      Source: explorer.exe, 00000004.00000000.303959479.0000000008223000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}}^
                      Source: explorer.exe, 00000004.00000000.303147807.00000000080ED000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
                      Source: explorer.exe, 00000004.00000000.303959479.0000000008223000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00l
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FF740781828 GetCurrentThreadId,memset,IsDebuggerPresent,OutputDebugStringW,20_2_00007FF740781828
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B871BEA0 LoadLibraryW,GetProcAddress,GetProcAddress,33_2_00007FF7B871BEA0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FF7407859A4 TlsGetValue,GetProcessHeap,HeapFree,TlsSetValue,AcquireSRWLockExclusive,TlsFree,ReleaseSRWLockExclusive,20_2_00007FF7407859A4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671097D0 LdrLoadDll,FindClose,0_2_00007FFC671097D0
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FF740788410 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,20_2_00007FF740788410
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FF7407886F0 SetUnhandledExceptionFilter,20_2_00007FF7407886F0
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF61310FCB0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,26_2_00007FF61310FCB0
                      Source: C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exeCode function: 26_2_00007FF6131100E0 SetUnhandledExceptionFilter,26_2_00007FF6131100E0
                      Source: C:\Users\user\AppData\Local\bj1HT\mfpmp.exeCode function: 29_2_00007FF670A429F0 SetUnhandledExceptionFilter,29_2_00007FF670A429F0
                      Source: C:\Users\user\AppData\Local\bj1HT\mfpmp.exeCode function: 29_2_00007FF670A42D14 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,29_2_00007FF670A42D14
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B8822264 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,33_2_00007FF7B8822264
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CEF2E0 SetUnhandledExceptionFilter,35_2_00007FF742CEF2E0
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CEEE40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,35_2_00007FF742CEEE40

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Benign windows process drops PE files
                      Source: C:\Windows\explorer.exeFile created: dwmapi.dll.4.drJump to dropped file
                      Changes memory attributes in foreign processes to executable or writable
                      Source: C:\Windows\System32\rundll32.exeMemory protected: C:\Windows\explorer.exe base: 7FFC866FEFE0 protect: page execute and read and writeJump to behavior
                      Source: C:\Windows\System32\rundll32.exeMemory protected: C:\Windows\explorer.exe base: 7FFC866FE000 protect: page execute readJump to behavior
                      Source: C:\Windows\System32\rundll32.exeMemory protected: C:\Windows\explorer.exe base: 7FFC85C32A20 protect: page execute and read and writeJump to behavior
                      Queues an APC in another process (thread injection)
                      Source: C:\Windows\System32\rundll32.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
                      Contains functionality to automate explorer (e.g. start an application)
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CDA5C8 GetDC,GetDeviceCaps,ReleaseDC,LoadIconW,SendMessageW,GetWindowBand,FindWindowW,GetWindowBand,FindWindowW,SendMessageTimeoutW,GetWindowLongW,SetWindowLongW,SetForegroundWindow,IsThemeActive,DwmIsCompositionEnabled,GetWindowRect,GetClientRect,EnterCriticalSection,GetWindowRect,LeaveCriticalSection,SetWindowPos,LeaveCriticalSection,memset,Shell_NotifyIconGetRect,GetWindowRect,DwmIsCompositionEnabled,Shell_NotifyIconGetRect,InflateRect,CalculatePopupWindowPosition,SetWindowPos,InvalidateRect,GetClientRect,EnterCriticalSection,SetWindowPos,GetDlgItem,SetFocus,ShowWindow,LeaveCriticalSection,SetTimer,NotifyWinEvent,35_2_00007FF742CDA5C8
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: 35_2_00007FF742CDA5C8 GetDC,GetDeviceCaps,ReleaseDC,LoadIconW,SendMessageW,GetWindowBand,FindWindowW,GetWindowBand,FindWindowW,SendMessageTimeoutW,GetWindowLongW,SetWindowLongW,SetForegroundWindow,IsThemeActive,DwmIsCompositionEnabled,GetWindowRect,GetClientRect,EnterCriticalSection,GetWindowRect,LeaveCriticalSection,SetWindowPos,LeaveCriticalSection,memset,Shell_NotifyIconGetRect,GetWindowRect,DwmIsCompositionEnabled,Shell_NotifyIconGetRect,InflateRect,CalculatePopupWindowPosition,SetWindowPos,InvalidateRect,GetClientRect,EnterCriticalSection,SetWindowPos,GetDlgItem,SetFocus,ShowWindow,LeaveCriticalSection,SetTimer,NotifyWinEvent,35_2_00007FF742CDA5C8
                      Contains functionality to prevent local Windows debugging
                      Source: C:\Users\user\AppData\Local\bj1HT\mfpmp.exeCode function: 29_2_00007FF670A45730 EnterCriticalSection,IsDebuggerPresent,DebugBreak,GetLastError,SetLastError,LeaveCriticalSection,29_2_00007FF670A45730
                      Source: C:\Users\user\AppData\Local\bj1HT\mfpmp.exeCode function: 29_2_00007FF670A454A0 EnterCriticalSection,IsDebuggerPresent,DebugBreak,LeaveCriticalSection,29_2_00007FF670A454A0
                      Uses Atom Bombing / ProGate to inject into other processes
                      Source: C:\Windows\System32\rundll32.exeAtom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h Jump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1Jump to behavior
                      Source: explorer.exe, 00000004.00000000.280992287.0000000000688000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.311718742.0000000000688000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.262606736.0000000000688000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ProgmanEXE^
                      Source: explorer.exe, 00000004.00000000.341540544.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.281271896.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.271301902.00000000080ED000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: explorer.exe, 00000004.00000000.341540544.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.281271896.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.263000213.0000000000BE0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                      Source: SndVol.exe, 00000023.00000000.548108875.00007FF742CF2000.00000002.00000001.01000000.00000012.sdmp, SndVol.exe, 00000023.00000002.574100528.00007FF742CF2000.00000002.00000001.01000000.00000012.sdmp, SndVol.exe.4.drBinary or memory string: Software\Microsoft\Multimedia\Audio\SndVolSndVolPreferencesMaskSndVolSelectedDevicesShell_TrayWnd
                      Source: explorer.exe, 00000004.00000000.341540544.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.281271896.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.263000213.0000000000BE0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                      Source: explorer.exe, 00000004.00000000.311774801.0000000000708000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.281130871.0000000000708000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.341049556.0000000000708000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd4
                      Source: explorer.exe, 00000004.00000000.341540544.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.281271896.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.263000213.0000000000BE0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: WProgram Manager
                      Source: C:\Users\user\AppData\Local\Nz4mnM\SndVol.exeCode function: GetUserPreferredUILanguages,malloc,GetUserPreferredUILanguages,GetLocaleInfoEx,free,35_2_00007FF742CE9EF4
                      Source: C:\Windows\System32\loaddll64.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDateJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                      Source: C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exeCode function: 20_2_00007FF740783614 RegGetValueW,RegGetValueW,GetSystemTimeAsFileTime,TranslateMessage,DispatchMessageW,GetMessageW,20_2_00007FF740783614
                      Source: C:\Users\user\AppData\Local\n0R5g\mstsc.exeCode function: 33_2_00007FF7B881F5EC memset,GetVersionExW,GetVersionExW,33_2_00007FF7B881F5EC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67109400 GetUserNameW,0_2_00007FFC67109400

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid Accounts2
                      Native API                      		1
                      DLL Side-Loading                      		1
                      Exploitation for Privilege Escalation                      		1
                      Masquerading                      		OS Credential Dumping1
                      System Time Discovery                      		Remote Services1
                      Archive Collected Data                      		Exfiltration Over Other Network Medium2
                      Encrypted Channel                      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default Accounts1
                      Exploitation for Client Execution                      		Boot or Logon Initialization Scripts412
                      Process Injection                      		1
                      Virtualization/Sandbox Evasion                      		LSASS Memory21
                      Security Software Discovery                      		Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)1
                      DLL Side-Loading                      		412
                      Process Injection                      		Security Account Manager1
                      Virtualization/Sandbox Evasion                      		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)2
                      Obfuscated Files or Information                      		NTDS3
                      Process Discovery                      		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                      Rundll32                      		LSA Secrets1
                      Application Window Discovery                      		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.common2
                      Software Packing                      		Cached Domain Credentials1
                      Account Discovery                      		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup Items1
                      Timestomp                      		DCSync1
                      System Owner/User Discovery                      		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
                      DLL Side-Loading                      		Proc Filesystem1
                      File and Directory Discovery                      		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadow25
                      System Information Discovery                      		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 signatures2 2 Behavior Graph ID: 595308 Sample: eWlldJYfLc Startdate: 23/03/2022 Architecture: WINDOWS Score: 100 42 Antivirus detection for dropped file 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 6 other signatures 2->48 8 loaddll64.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        13 cmd.exe 1 8->13         started        15 rundll32.exe 8->15         started        17 rundll32.exe 8->17         started        signatures5 58 Changes memory attributes in foreign processes to executable or writable 10->58 60 Uses Atom Bombing / ProGate to inject into other processes 10->60 62 Queues an APC in another process (thread injection) 10->62 19 explorer.exe 3 58 10->19 injected 23 rundll32.exe 13->23         started        process6 file7 34 C:\Users\user\AppData\Local\...\ACTIVEDS.dll, PE32+ 19->34 dropped 36 C:\Users\user\AppData\Local\...\Secur32.dll, PE32+ 19->36 dropped 38 C:\Users\user\AppData\Local\bj1HT\mfpmp.exe, PE32+ 19->38 dropped 40 15 other files (6 malicious) 19->40 dropped 50 Benign windows process drops PE files 19->50 52 Accesses ntoskrnl, likely to find offsets for exploits 19->52 25 mfpmp.exe 19->25         started        28 SndVol.exe 19->28         started        30 Dxpserver.exe 19->30         started        32 11 other processes 19->32 signatures8 process9 signatures10 54 Contains functionality to prevent local Windows debugging 25->54 56 Contains functionality to automate explorer (e.g. start an application) 28->56

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      eWlldJYfLc.dll67%VirustotalBrowse
                      eWlldJYfLc.dll60%MetadefenderBrowse
                      eWlldJYfLc.dll88%ReversingLabsWin64.Trojan.Occamy
                      eWlldJYfLc.dll100%AviraTR/Crypt.ZPACK.Gen
                      eWlldJYfLc.dll100%Joe Sandbox ML

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Local\vFRJtv0CU\ACTIVEDS.dll100%AviraTR/Crypt.ZPACK.Gen
                      C:\Users\user\AppData\Local\4O9p1cGN\dwmapi.dll100%AviraTR/Crypt.XPACK.Gen7
                      C:\Users\user\AppData\Local\Nz4mnM\UxTheme.dll100%AviraTR/Crypt.ZPACK.Gen
                      C:\Users\user\AppData\Local\O0z6Mm4\XmlLite.dll100%AviraTR/Crypt.XPACK.Gen7
                      C:\Users\user\AppData\Local\O0z6Mm4\XmlLite.dll100%AviraTR/Crypt.XPACK.Gen7
                      C:\Users\user\AppData\Local\bj1HT\MFPlat.DLL100%AviraTR/Crypt.XPACK.Gen7
                      C:\Users\user\AppData\Local\EQ0DjT2sP\DUI70.dll100%AviraTR/Crypt.XPACK.Gen4
                      C:\Users\user\AppData\Local\Nz4mnM\UxTheme.dll100%AviraTR/Crypt.ZPACK.Gen
                      C:\Users\user\AppData\Local\n0R5g\Secur32.dll100%AviraTR/Crypt.ZPACK.Gen
                      C:\Users\user\AppData\Local\vFRJtv0CU\ACTIVEDS.dll100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\4O9p1cGN\dwmapi.dll100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\Nz4mnM\UxTheme.dll100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\O0z6Mm4\XmlLite.dll100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\O0z6Mm4\XmlLite.dll100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\bj1HT\MFPlat.DLL100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\EQ0DjT2sP\DUI70.dll100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\Nz4mnM\UxTheme.dll100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\n0R5g\Secur32.dll100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exe0%MetadefenderBrowse
                      C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exe0%ReversingLabs
                      C:\Users\user\AppData\Local\EQ0DjT2sP\CameraSettingsUIHost.exe0%MetadefenderBrowse
                      C:\Users\user\AppData\Local\EQ0DjT2sP\CameraSettingsUIHost.exe0%ReversingLabs
                      C:\Users\user\AppData\Local\Nz4mnM\SndVol.exe0%MetadefenderBrowse
                      C:\Users\user\AppData\Local\Nz4mnM\SndVol.exe0%ReversingLabs
                      C:\Users\user\AppData\Local\O0z6Mm4\ddodiag.exe0%MetadefenderBrowse
                      C:\Users\user\AppData\Local\O0z6Mm4\ddodiag.exe0%ReversingLabs

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      33.2.mstsc.exe.7ffc74c20000.3.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      8.2.rundll32.exe.7ffc670c0000.2.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      20.2.CloudNotifications.exe.7ffc74c20000.3.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      35.2.SndVol.exe.7ffc74c20000.3.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      33.2.mstsc.exe.15f26e10000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      29.2.mfpmp.exe.1cdaa1c0000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      0.2.loaddll64.exe.16b476e0000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      26.2.Dxpserver.exe.7ffc74c20000.3.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      2.2.rundll32.exe.7ffc670c0000.2.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      26.2.Dxpserver.exe.19273270000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      29.2.mfpmp.exe.7ffc74c20000.3.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      6.2.rundll32.exe.7ffc670c0000.2.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      6.2.rundll32.exe.28586ab0000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      20.2.CloudNotifications.exe.2953cdf0000.1.unpack100%AviraHEUR/AGEN.1215493Download File
                      8.2.rundll32.exe.2541e150000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      2.2.rundll32.exe.16bb42f0000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      3.2.rundll32.exe.17f7c0b0000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      0.2.loaddll64.exe.7ffc670c0000.2.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      35.2.SndVol.exe.1c1733a0000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      3.2.rundll32.exe.7ffc670c0000.2.unpack100%AviraTR/Crypt.XPACK.GenDownload File

                      Domains

                      ⊘No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://schemas.mi0%URL Reputationsafe
                      https://login.windows.net-%s0%Avira URL Cloudsafe
                      http://schemas.micr0%URL Reputationsafe
                      https://dynamic.t0%URL Reputationsafe

                      Domains and IPs

                      Contacted Domains

                      ⊘No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        http://schemas.miexplorer.exe, 00000004.00000000.324436158.000000000DA7E000.00000004.00000001.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://login.windows.net-%sDeviceEnroller.exe.4.drfalse
                        • Avira URL Cloud: safe
                        		low
                        https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=svchost.exe, 0000000B.00000003.320980194.000001BB8E646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320872446.000001BB8E641000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 0000000B.00000002.321807705.000001BB8E63E000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 0000000B.00000002.321807705.000001BB8E63E000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://dev.ditu.live.com/REST/v1/Traffic/Incidents/svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://dev.ditu.live.com/REST/v1/Transit/Stops/svchost.exe, 0000000B.00000003.320495277.000001BB8E669000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.321905396.000001BB8E66B000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://t0.tiles.ditu.live.com/tiles/gensvchost.exe, 0000000B.00000002.321768696.000001BB8E629000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 0000000B.00000002.321807705.000001BB8E63E000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://dev.virtualearth.net/REST/v1/Traffic/Incidents/svchost.exe, 0000000B.00000002.321768696.000001BB8E629000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://dev.virtualearth.net/REST/v1/Transit/Stops/svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320872446.000001BB8E641000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 0000000B.00000002.321807705.000001BB8E63E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.321751772.000001BB8E613000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=svchost.exe, 0000000B.00000002.321820678.000001BB8E643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.321051969.000001BB8E642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320872446.000001BB8E641000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://schemas.micrexplorer.exe, 00000004.00000000.324436158.000000000DA7E000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000B.00000002.321768696.000001BB8E629000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 0000000B.00000002.321768696.000001BB8E629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 0000000B.00000002.321820678.000001BB8E643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.321051969.000001BB8E642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320872446.000001BB8E641000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://dynamic.tsvchost.exe, 0000000B.00000003.320872446.000001BB8E641000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.321244735.000001BB8E63A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.bingmapsportal.comsvchost.exe, 0000000B.00000002.321751772.000001BB8E613000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 0000000B.00000003.320641560.000001BB8E651000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 0000000B.00000002.321768696.000001BB8E629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 0000000B.00000003.298657798.000001BB8E630000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.321807705.000001BB8E63E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 0000000B.00000002.321834175.000001BB8E64C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 0000000B.00000003.320766530.000001BB8E64A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high

                                                                                                World Map of Contacted IPs

                                                                                                ⊘No contacted IP infos

                                                                                                General Information

                                                                                                Joe Sandbox Version:34.0.0 Boulder Opal
                                                                                                Analysis ID:595308
                                                                                                Start date and time:2022-03-23 14:46:03 +01:00
                                                                                                Joe Sandbox Product:CloudBasic
                                                                                                Overall analysis duration:0h 15m 3s
                                                                                                Hypervisor based Inspection enabled:false
                                                                                                Report type:full
                                                                                                Sample file name:eWlldJYfLc (renamed file extension from none to dll)
                                                                                                Cookbook file name:default.jbs
                                                                                                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                Number of analysed new started processes analysed:41
                                                                                                Number of new started drivers analysed:0
                                                                                                Number of existing processes analysed:0
                                                                                                Number of existing drivers analysed:0
                                                                                                Number of injected processes analysed:1
                                                                                                Technologies:
                                                                                                • HCA enabled
                                                                                                • EGA enabled
                                                                                                • HDC enabled
                                                                                                • AMSI enabled
                                                                                                Analysis Mode:default
                                                                                                Analysis stop reason:Timeout
                                                                                                Detection:MAL
                                                                                                Classification:mal100.troj.expl.evad.winDLL@46/19@0/0
                                                                                                EGA Information:
                                                                                                • Successful, ratio: 90%
                                                                                                HDC Information:
                                                                                                • Successful, ratio: 29% (good quality ratio 17.8%)
                                                                                                • Quality average: 41%
                                                                                                • Quality standard deviation: 39%
                                                                                                HCA Information:
                                                                                                • Successful, ratio: 98%
                                                                                                • Number of executed functions: 69
                                                                                                • Number of non-executed functions: 113
                                                                                                Cookbook Comments:
                                                                                                • Adjust boot time
                                                                                                • Enable AMSI
                                                                                                • Override analysis time to 240s for rundll32

                                                                                                Warnings

                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
                                                                                                • Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, www.bing.com, client.wns.windows.com, fs.microsoft.com, login.live.com, sls.update.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, arc.msn.com
                                                                                                • Execution Graph export aborted for target mfpmp.exe, PID 3464 because there are no executed function
                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                • Report size getting too big, too many NtEnumerateKey calls found.

                                                                                                Simulations

                                                                                                Behavior and APIs

                                                                                                ⊘No simulations

                                                                                                Joe Sandbox View / Context

                                                                                                IPs

                                                                                                ⊘No context

                                                                                                Domains

                                                                                                ⊘No context

                                                                                                ASNs

                                                                                                ⊘No context

                                                                                                JA3 Fingerprints

                                                                                                ⊘No context

                                                                                                Dropped Files

                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exebjbMyaakCv.dllGet hashmaliciousBrowse
                                                                                                  CSSmwdf3UF.dllGet hashmaliciousBrowse
                                                                                                    eAcRwbpaRC.dllGet hashmaliciousBrowse
                                                                                                      6DcDu9JyeX.dllGet hashmaliciousBrowse
                                                                                                        EcPDKIddT5.dllGet hashmaliciousBrowse
                                                                                                          CsUUaEi57B.dllGet hashmaliciousBrowse
                                                                                                            f4.dllGet hashmaliciousBrowse
                                                                                                              p3D6mSixxP.dllGet hashmaliciousBrowse
                                                                                                                YCmvsk3Lmf.dllGet hashmaliciousBrowse
                                                                                                                  Ppy154hE7Y.dllGet hashmaliciousBrowse
                                                                                                                    yGI53fbtYF.dllGet hashmaliciousBrowse
                                                                                                                      zB14GfXeGv.dllGet hashmaliciousBrowse
                                                                                                                        U4zqCpLYS2.dllGet hashmaliciousBrowse
                                                                                                                          ASfbCicRC5.dllGet hashmaliciousBrowse
                                                                                                                            vVPS3LRIrm.dllGet hashmaliciousBrowse
                                                                                                                              KANve4zs8b.dllGet hashmaliciousBrowse
                                                                                                                                maCZfyeqR2.dllGet hashmaliciousBrowse
                                                                                                                                  C3AGWzJKYE.dllGet hashmaliciousBrowse
                                                                                                                                    Hya8QBERWA.dllGet hashmaliciousBrowse
                                                                                                                                      TWz0JnTOzu.dllGet hashmaliciousBrowse

                                                                                                                                        Created / dropped Files

                                                                                                                                        C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exe

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):304640
                                                                                                                                        Entropy (8bit):5.920357039114308
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6144:SidsFxbUPoT/FPrriCEe+oiXoGJm7JwQ9oWxDEHZwj:xaFxbFDBsBo6maPWxDcwj
                                                                                                                                        MD5:DCCB1D350193BE0A26CEAFF602DB848E
                                                                                                                                        SHA1:02673E7070A589B5BF6F217558A06067B388A350
                                                                                                                                        SHA-256:367CEA47389B6D5211595AE88454D9589AA8C996F5E765904FFEDE434424AF22
                                                                                                                                        SHA-512:ECD3C32E2BED31FC6328CA4B171B5D2503A2795324667F67FF48A67DF7C8B88760A62C0119A173487B9886E6AF3994025A85E42B064BEA38A466A6848AF65541
                                                                                                                                        Malicious:false
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Metadefender, Detection: 0%, Browse
                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                        Joe Sandbox View:
                                                                                                                                        • Filename: bjbMyaakCv.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: CSSmwdf3UF.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: eAcRwbpaRC.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: 6DcDu9JyeX.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: EcPDKIddT5.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: CsUUaEi57B.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: f4.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: p3D6mSixxP.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: YCmvsk3Lmf.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: Ppy154hE7Y.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: yGI53fbtYF.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: zB14GfXeGv.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: U4zqCpLYS2.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: ASfbCicRC5.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: vVPS3LRIrm.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: KANve4zs8b.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: maCZfyeqR2.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: C3AGWzJKYE.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: Hya8QBERWA.dll, Detection: malicious, Browse
                                                                                                                                        • Filename: TWz0JnTOzu.dll, Detection: malicious, Browse
                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9. E}.N.}.N.}.N...M.~.N...J.d.N...K.{.N...O.X.N.}.O.F.N...G.[.N....|.N...L.|.N.Rich}.N.........PE..d....z............".................`..........@..........................................`.......... ..........................................|....0..H....... ...............p...`...T............................<...............=...............................text...<........................... ..`.rdata..6...........................@..@.data...............................@....pdata.. ...........................@..@.rsrc...H....0......................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\4O9p1cGN\dwmapi.dll

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1372160
                                                                                                                                        Entropy (8bit):5.073965259759853
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12288:vZgJtlQepQn+NDo7nIYegQCLDF/B9wvj/cLvVZFuw:vZK6F7n5eRmDFJivohZFV
                                                                                                                                        MD5:76657995BEE544EFB7B57F3ADE10CACC
                                                                                                                                        SHA1:AFD9BC6AAEF6E67ABEB32C4111B61F39412D8DCA
                                                                                                                                        SHA-256:E4FAF63C9DF8C711816BDD85DED07539FC7F425EFFBAFDDB680EFE01E45DCD26
                                                                                                                                        SHA-512:BEF755E7AE0D4C82D7F0A86A881FBDAFC565C990C821EBA88B1D5C208B1A94097E3BC74A9AFA58B11146658CC68CECE1F615E28FC891852FB99FA4D703829670
                                                                                                                                        Malicious:true
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                        Preview:MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d.=...}^.........." ..... ...........$.........@..........................................`.............................................&...$...<....................................................................................0..(............................text............ .........@........ ..`.rdata..Co...0...p...0...0.@Co......@..@.data....;.......@.........@.;......@....pdata..8..................@8.......@..@.rsrc......................@........@..@.reloc..1..................@1.......@..B.vxl............. .........@........@..@.qwubgr.$....0... ...0...0.@$.......@..@.eer....

                                                                                                                                        C:\Users\user\AppData\Local\EQ0DjT2sP\CameraSettingsUIHost.exe

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):32104
                                                                                                                                        Entropy (8bit):6.224595599643794
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:768:HYxSW1tZfZjtM2mpgc8WtCpZswKro1PDg:HhAhty8WteuwKrwPDg
                                                                                                                                        MD5:34F32BC06CDC7AF56607D351B155140D
                                                                                                                                        SHA1:88EF25BC91BCC908AF743ECA254D6251E5564283
                                                                                                                                        SHA-256:47238D9ED75D01FD125AC76B500FEEF7F8B27255570AD02D18A4F049B05DF3BD
                                                                                                                                        SHA-512:D855414779125F4E311ACF4D5EFC8ACA4452323CABD1694798CA90FD5BD76DC70B5D06790A2AE311E7DD19190DCCB134F6EF96AB1B7CF5B8A40AD642B72D5144
                                                                                                                                        Malicious:false
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Metadefender, Detection: 0%, Browse
                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._Lp..-...-...-...U...-..tI...-..tI...-..tI...-..tI...-...-..K-..tI...-..tI..-..tI...-..Rich.-..........................PE..d....\YN.........."......*...2.......0.........@.................................................... ......................................._.......................Z..h#...........X..T...................`S..(...`R...............S...............................text....(.......*.................. ..`.imrsiv......@...........................rdata.......P......................@..@.data........p.......J..............@....pdata...............L..............@..@.rsrc................P..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\EQ0DjT2sP\DUI70.dll

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1654784
                                                                                                                                        Entropy (8bit):5.506546408859127
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12288:tZgJtlQepQn+NDo7nIYegQCLDF/B9wvj/cLvVZFuwmsNRt:tZK6F7n5eRmDFJivohZFVmu
                                                                                                                                        MD5:72722E89BA0B4F6CAD054811AB8BB33C
                                                                                                                                        SHA1:84099E5B7CF14C99D301AADAD9934E8981C019EB
                                                                                                                                        SHA-256:27DBA4A57AD9F0CA7678B55C851F17E1A2CAE742FCFD041D8503080831E93520
                                                                                                                                        SHA-512:08CF3ABE10557F284B0427849A4CEF2F111E67E6371F79C3B477F659CC36B438E6C9E541C2DD10C290C6A43E963EBE1B4A7BEF89910C7C98A6099E6E04F8A9BC
                                                                                                                                        Malicious:true
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                        Preview:MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d.=...}^.........." ..... ...........$.........@.............................@............`.............................................dQ..$...<....................................................................................0..(............................text............ .........@........ ..`.rdata..Co...0...p...0...0.@Co......@..@.data....;.......@.........@.;......@....pdata..8..................@8.......@..@.rsrc......................@........@..@.reloc..1..................@1.......@..B.vxl............. .........@........@..@.qwubgr.$....0... ...0...0.@$.......@..@.eer....

                                                                                                                                        C:\Users\user\AppData\Local\Nz4mnM\SndVol.exe

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):259904
                                                                                                                                        Entropy (8bit):5.955701055747905
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3072:UfYIZJbRydnidilSnGvLqeD358rwW39nuyHjVozZcxSHfcBL1ljbEyB7HbIa+:Uf9JonidFnqLV358rNnJqcRcy10/
                                                                                                                                        MD5:CDD7C7DF2D0859AC3F4088423D11BD08
                                                                                                                                        SHA1:128789A2EA904F684B5DF2384BA6EEF4EB60FB8E
                                                                                                                                        SHA-256:D98DB8339EB1B93A7345EECAC2B7290FA7156E3E12B7632D876BD0FD1F31EC66
                                                                                                                                        SHA-512:A093BF3C40C880A80164F2CAA87DF76DCD854375C5216D761E60F3770DFA04F4B02EC0CA6313C32413AC99A3EBDC081CF915A7B468EE3CED80F9B1ECF4B49804
                                                                                                                                        Malicious:true
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Metadefender, Detection: 0%, Browse
                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.BL]..L]..L]..E%...]..#9..O]..#9..U]..#9..F]..#9..W]..L]...\..#9..o]..#9k.M]..#9..M]..RichL]..........................PE..d...wJSn.........."............................@.............................@....................... .........................................p.... ..@...............@+...0.......U..T...................p&..(...p%...............&......P........................text............................... ..`.imrsiv..................................rdata....... ......................@..@.data...............................@....pdata..............................@..@.didat..............................@....rsrc...@.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Nz4mnM\UxTheme.dll

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1372160
                                                                                                                                        Entropy (8bit):5.07954324475136
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12288:2ZgJtlQepQn+NDo7nIYegQCLDF/B9wvj/cLvVZFuw:2ZK6F7n5eRmDFJivohZFV
                                                                                                                                        MD5:AA4563F3E285E21921818923EEC1AB27
                                                                                                                                        SHA1:F36D24960356D6CCB49EF189025B9366324851D9
                                                                                                                                        SHA-256:33736F3A5EB68B07C19FDA12C97A3A17120719FA53FFF3B74EB4B5BCA81ED86E
                                                                                                                                        SHA-512:26BBE92AF58E8B574BA3C4673938F48BF12AFA872FDE65BC3E4A48C590C20BD03B9F1DA460E9F5EB8D5410272E0741D8C4EC3B068CFA4D78595E0A8042E5E488
                                                                                                                                        Malicious:true
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                        Preview:MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d.=...}^.........." ..... ...........$.........@..........................................`.................................................$...<....................................................................................0..(............................text............ .........@........ ..`.rdata..Co...0...p...0...0.@Co......@..@.data....;.......@.........@.;......@....pdata..8..................@8.......@..@.rsrc......................@........@..@.reloc..1..................@1.......@..B.vxl............. .........@........@..@.qwubgr.$....0... ...0...0.@$.......@..@.eer....

                                                                                                                                        C:\Users\user\AppData\Local\O0z6Mm4\XmlLite.dll

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1372160
                                                                                                                                        Entropy (8bit):5.066544233417286
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12288:CZgJtlQepQn+NDo7nIYegQCLDF/B9wvj/cLvVZFuw:CZK6F7n5eRmDFJivohZFV
                                                                                                                                        MD5:CFC069A16E13B366B0F56BD27F5BC600
                                                                                                                                        SHA1:CD6DF254F7B0550B0CC2524F4592571C9EC3F7B1
                                                                                                                                        SHA-256:1A044F24CC8B8D583E66F577C90C92FF15FF4F3D1FE8096A38B5032C1F8B8D6B
                                                                                                                                        SHA-512:55F44E15EB12F94804DFE947774B2078DCCD13E0A98EEB9963F90BC0289BD7345F90063DCD29530D161C0B411623C411613FAA6323C53F1C5C7595D19004C117
                                                                                                                                        Malicious:true
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                        Preview:MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d.=...}^.........." ..... ...........$.........@..........................................`.................................................$...<....................................................................................0..(............................text............ .........@........ ..`.rdata..Co...0...p...0...0.@Co......@..@.data....;.......@.........@.;......@....pdata..8..................@8.......@..@.rsrc......................@........@..@.reloc..1..................@1.......@..B.vxl............. .........@........@..@.qwubgr.$....0... ...0...0.@$.......@..@.eer....

                                                                                                                                        C:\Users\user\AppData\Local\O0z6Mm4\ddodiag.exe

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):37888
                                                                                                                                        Entropy (8bit):5.0324146638870335
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:768:Ii5tlKBaheiGK/hc3aZkLmMgMaouZl6i9Kott/D:/C0heiGK/hc3aZkLmMgMaouZl6i9t/D
                                                                                                                                        MD5:3CE911D7C12A2EFA9108514013BD17FE
                                                                                                                                        SHA1:2F739BD7731932A0BF13A3B8526FC867EC41C63E
                                                                                                                                        SHA-256:FC55CB5FF243496B039D3DB181BD846BDD38D11C7D52E4BA20D882B65FBE1C3B
                                                                                                                                        SHA-512:33F4FD94916DB3F0BC4E138DD88125D9B45108F7EECFDE0A54BE1901F4BE3F1966BC0FE9278A919A3D94AEC53A8269ACA9451EBA7D53C82BF64CC215522AD78E
                                                                                                                                        Malicious:false
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Metadefender, Detection: 0%, Browse
                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.=...S...S...S.s.P...S.s.W...S.s.V...S.s.R...S...R.$.S.s.Z...S.s....S.s.Q...S.Rich..S.........PE..d...~3............"......&...p......p/.........@.....................................q....`.......... .......................................~..d.......p.......................(...`z..T........................... E.............. F...............................text...P%.......&.................. ..`.rdata.."D...@...F...*..............@..@.data................p..............@....pdata..............................@..@.rsrc...p...........................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exe

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):77072
                                                                                                                                        Entropy (8bit):6.115516882753233
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:1536:PBw6bK5qGy2vbnG4bhimIHw28N6GgIpdNtgdNttP+O1K9dr3uhyZb3NnPg5:FbK522vDfnp28a+O1AdCoZxno5
                                                                                                                                        MD5:D9FF4C8DBC1682E0508322307CB89C0F
                                                                                                                                        SHA1:52FF480ABF6A6CE9BC32BD3B467C028C35849C6F
                                                                                                                                        SHA-256:E99A6238FDF53700DE8588E1C1128D52680C1DCAAD4E32B38EF2170395495D29
                                                                                                                                        SHA-512:C068F98855514994AA7CD66ED02E3FD05B7E81EAD714F83CC158B65AAC6DE12A1D324375C41FEC5C1B6A3F1D6D8639EBFF71D510A720148A33E645ED066DAF2C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................=.....................................e............Q............Rich....................PE..d................."............................@.............................p.......*............... ......................................p........@.. .... ..L........%...`......P...T............................................... .......`....................text.............................. ..`.imrsiv..................................rdata...W.......X..................@..@.data...x...........................@....pdata..L.... ......................@..@.didat.......0......................@....rsrc... ....@......................@..@.reloc.......`......................@..B................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\R7Mg9\UxTheme.dll

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1372160
                                                                                                                                        Entropy (8bit):5.079630029271723
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12288:qZgJtlQepQn+NDo7nIYegQCLDF/B9wvj/cLvVZFuw:qZK6F7n5eRmDFJivohZFV
                                                                                                                                        MD5:EEEA0804F1E5EB7827FD942423AC682D
                                                                                                                                        SHA1:09CD42B0D6B83B896B61016364BCAE0FDB729FA2
                                                                                                                                        SHA-256:EC50BADCD4F4E021A341A08A03FA8A72D4496A5B71BA1BBF6C4F49F79EA61F45
                                                                                                                                        SHA-512:0C58E87B0716CBB5A0D7DE3A0463C4AF9E09C28EE99543F5A4130A7658B2BB8EB8A88F5BEE0B6877DC9224B6AA0988850C83BF5EB48CB4A22FBEEEF79EBBEE6C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d.=...}^.........." ..... ...........$.........@..........................................`.................................................$...<....................................................................................0..(............................text............ .........@........ ..`.rdata..Co...0...p...0...0.@Co......@..@.data....;.......@.........@.;......@....pdata..8..................@8.......@..@.rsrc......................@........@..@.reloc..1..................@1.......@..B.vxl............. .........@........@..@.qwubgr.$....0... ...0...0.@$.......@..@.eer....

                                                                                                                                        C:\Users\user\AppData\Local\aJcBg\DeviceEnroller.exe

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):359936
                                                                                                                                        Entropy (8bit):6.00535524532166
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6144:NXYgu80D0GEiHJb3r/mrKqfNF3Ne8xQOQ2UyQPyHS:Nok0DTHJrr/MKqfNPRyyQI
                                                                                                                                        MD5:53688BC273A0CB9FD174F809FB56F866
                                                                                                                                        SHA1:F69901D480530661A3342E567C2F789D3361851D
                                                                                                                                        SHA-256:D39F1DE499FFD7D8E12ADEA0979AA70FB291C8BD9061019AA0045A247A4B948B
                                                                                                                                        SHA-512:2233B66D79042C2C1F8B10228FAEE3698FA2C54396B0331F7352DC087F23493BDEB89CECD7E23A1B2CFBD124D9ADB483413DC55DDA813C4F49B18120A702AE15
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(...l...l...l...e.2.0.....o.....t...l...............a.....G.....^.m.....m...Richl...................PE..d......{.........."......|..........0N.........@..........................................`.......... ..................................................pE...@...$..............h....#..T...................0...(...0...............X...(....... ....................text....{.......|.................. ..`.rdata..............................@..@.data........ ......................@....pdata...$...@...&..................@..@.didat.......p.......0..............@....rsrc...pE.......F...2..............@..@.reloc..h............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\aJcBg\XmlLite.dll

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1372160
                                                                                                                                        Entropy (8bit):5.0665476710905875
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12288:qZgJtlQepQn+NDo7nIYegQCLDF/B9wvj/cLvVZFuw:qZK6F7n5eRmDFJivohZFV
                                                                                                                                        MD5:5A3E479CD2E6CE8BFB95EB1B9473DF7C
                                                                                                                                        SHA1:E006DC68DA1C26A263DA0FF6D1B3B6E5E8E5A657
                                                                                                                                        SHA-256:0D7E29272223CE36DAA5CAA7DCDADBAED9CE393E26FF9A8C7BE5382A072B7EDF
                                                                                                                                        SHA-512:932974FAD53CD8F754758A2F6712140217369C207CEEDB00A7A34A606C43095DCB4C979151077BBE39C9EF4390E9F1FEB926CEFCDA7D765860B1FB0A3BC8D524
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d.=...}^.........." ..... ...........$.........@..........................................`.................................................$...<....................................................................................0..(............................text............ .........@........ ..`.rdata..Co...0...p...0...0.@Co......@..@.data....;.......@.........@.;......@....pdata..8..................@8.......@..@.rsrc......................@........@..@.reloc..1..................@1.......@..B.vxl............. .........@........@..@.qwubgr.$....0... ...0...0.@$.......@..@.eer....

                                                                                                                                        C:\Users\user\AppData\Local\bj1HT\MFPlat.DLL

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1376256
                                                                                                                                        Entropy (8bit):5.093356085119384
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12288:3ZgJtlQepQn+NDo7nIYegQCLDF/B9wvj/cLvVZFuw:3ZK6F7n5eRmDFJivohZFV
                                                                                                                                        MD5:094F25E8EE0B130D03AE8565EC8BF099
                                                                                                                                        SHA1:5988CCA553B95A1D599AF1409602270FC2E97713
                                                                                                                                        SHA-256:B738ACDF220BAB43ED0EF6E0ABBBEDF3037FA9B654626C526393ECADB11D756B
                                                                                                                                        SHA-512:485AF608EE610ECDC4AE8471415EEBBA38A47A1312CDBE8A5B9E3E5DC6D40707570D37C819B572E25F59199ED645D75B973BA042C049302AF39BF77CBB2B808D
                                                                                                                                        Malicious:true
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                        Preview:MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d.=...}^.........." ..... ...........$.........@..........................................`.................................................$...<....................................................................................0..(............................text............ .........@........ ..`.rdata..Co...0...p...0...0.@Co......@..@.data....;.......@.........@.;......@....pdata..8..................@8.......@..@.rsrc......................@........@..@.reloc..1..................@1.......@..B.vxl............. .........@........@..@.qwubgr.$....0... ...0...0.@$.......@..@.eer....

                                                                                                                                        C:\Users\user\AppData\Local\bj1HT\mfpmp.exe

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49688
                                                                                                                                        Entropy (8bit):6.083384253651048
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:768:vcqpeHOwVxW4zmjjJF686T/5Lel2fBetjEWI9Whu3H1PcSP:vcEoVxJodg/tfiEAhu3VPcSP
                                                                                                                                        MD5:7C3D09D6DB5DB4A272FCF4C1BB3986BD
                                                                                                                                        SHA1:F0C392891B6D73EADB20F669A29064910507E55E
                                                                                                                                        SHA-256:E459FF6CBA8C93589B206C07BDCCD2E6C57766BE6BB4754F2FB1DEF9EF2E3BDE
                                                                                                                                        SHA-512:6CFE325CD0A78D6ACC9473BA51069E234CB0F9A47F285A6204EE787902C77005491B41C301DD38602CC387329F214E700F9203E4ECE5077E58D30276821640E4
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0._.Q`..Q`..Q`..)...Q`..5c..Q`..5d..Q`..Qa..Q`..5a..Q`..5e..Q`..5n..Q`..5...Q`..5b..Q`.Rich.Q`.................PE..d...^.A..........."......R...V......P).........@....................................s.....`.......... ......................................h...........`................$..........`z..T...........................Pq..............`r......H...`....................text....Q.......R.................. ..`.rdata..T-...p.......V..............@..@.data...............................@....pdata..............................@..@.didat..0...........................@....rsrc...`...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\n0R5g\Secur32.dll

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1372160
                                                                                                                                        Entropy (8bit):5.0819568503752945
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12288:7ZgJtlQepQn+NDo7nIYegQCLDF/B9wvj/cLvVZFuw:7ZK6F7n5eRmDFJivohZFV
                                                                                                                                        MD5:A9D03770C3381277E769A3A10F4FA7BA
                                                                                                                                        SHA1:A9968FB16A693C97870A01AC3F6448B4029B02EB
                                                                                                                                        SHA-256:4D5CEA934217B0CAD20DE8A5D5A7E7E9E09FBBC46025CB9CED2857964CF0D72F
                                                                                                                                        SHA-512:7A1AF1FF937D496AA040195A998320FF4F9240CA0D7B223EBDAC29E02ADFA6A91EE010A1AE287F7AC9111B0BBB965898EFEF9373F805FD1335D5F254809E6EEC
                                                                                                                                        Malicious:true
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                        Preview:MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d.=...}^.........." ..... ...........$.........@..........................................`.............................................#...$...<....................................................................................0..(............................text............ .........@........ ..`.rdata..Co...0...p...0...0.@Co......@..@.data....;.......@.........@.;......@....pdata..8..................@8.......@..@.rsrc......................@........@..@.reloc..1..................@1.......@..B.vxl............. .........@........@..@.qwubgr.$....0... ...0...0.@$.......@..@.eer....

                                                                                                                                        C:\Users\user\AppData\Local\n0R5g\mstsc.exe

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):3640832
                                                                                                                                        Entropy (8bit):5.884402821447862
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:98304:q8yNOTNEpZxGb+ZPgN6tYDNBMe+8noqvEYw0n2WFfZT+xgsLOsMg:q8yNOTNEpZxk+ZIN6tYDNBMe+8noqvEB
                                                                                                                                        MD5:3FBB5CD8829E9533D0FF5819DB0444C0
                                                                                                                                        SHA1:A4A6E4E50421E57EA4745BA44568B107A9369447
                                                                                                                                        SHA-256:043870DBAB955C1851E1710D941495357383A08F3F30DD3E3A1945583A85E0CA
                                                                                                                                        SHA-512:349459CCF4DDFB0B05B066869C99088BA3012930D5BBC3ED1C9E4CF6400687B1EFE698C5B1734BF6FF299F6C65DD7A71A2709D3773E9E96F6FDE659F5D883F48
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... w.dN$.dN$.dN$..M%.dN$..J%.dN$..K%.dN$..O%.dN$.dO$TfN$..G%.eN$...$.dN$..L%.dN$Rich.dN$........PE..d.....Y..........."......$....%.....p..........@..............................7......K8...`..................................................].......p..H>!.....`.............7. *..P...T...........................`...............`........\..`....................text....".......$.................. ..`.rdata...\...@...^...(..............@..@.data...P(..........................@....pdata..`...........................@..@.didat..(....`....... ..............@....rsrc...H>!..p...@!.."..............@..@.reloc.. *....7..,...b7.............@..B........................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\vFRJtv0CU\ACTIVEDS.dll

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1372160
                                                                                                                                        Entropy (8bit):5.069365048727469
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12288:QZgJtlQepQn+NDo7nIYegQCLDF/B9wvj/cLvVZFuw:QZK6F7n5eRmDFJivohZFV
                                                                                                                                        MD5:7030AA0D1AD9097FBA4716E8769ADF1C
                                                                                                                                        SHA1:238ADB06CB99D070EC79034110FB65D5E854859E
                                                                                                                                        SHA-256:A847A1B3D028F0F305E1EA8B62B07690DEC695682DA8C5015CE9AB6F9EF69ABC
                                                                                                                                        SHA-512:2919F2D46B8364A8F05D7E46F2356AE6174821CD9A3658EB27A4A8F4C0FC5CDEDD87CD26EEE3DA281E8F5F3D9AF04192E443BC94F910A188F8B6369802BC877E
                                                                                                                                        Malicious:true
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                        Preview:MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb.....qb.;...{qb......qb..#...qb...f.oqb....hqb.z....qb.....:qb.;...tqb.Rich.qb.................................................................................................PE..d.=...}^.........." ..... ...........$.........@..........................................`.............................................y...$...<....................................................................................0..(............................text............ .........@........ ..`.rdata..Co...0...p...0...0.@Co......@..@.data....;.......@.........@.;......@....pdata..8..................@8.......@..@.rsrc......................@........@..@.reloc..1..................@1.......@..B.vxl............. .........@........@..@.qwubgr.$....0... ...0...0.@$.......@..@.eer....

                                                                                                                                        C:\Users\user\AppData\Local\vFRJtv0CU\SppExtComObj.Exe

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):577024
                                                                                                                                        Entropy (8bit):7.365924302927238
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12288:KEpKNOQ/1mgFgnHF+2ryqfut4iob3vBzx4PQpIQbwhsi:lpKbbFgl+2Oqfuqiob3JUFs
                                                                                                                                        MD5:809E11DECADAEBE2454EFEDD620C4769
                                                                                                                                        SHA1:A121B9FC2010247C65CE8975FE4D88F5E9AC953E
                                                                                                                                        SHA-256:8906D8D8BCD7C8302A3E56EA2EBD0357748ACC9D3FDA91925609C742384B9CC2
                                                                                                                                        SHA-512:F78F46437C011C102A9BCEC2A8565EDC75500C9448AC17457FF44D3C8DB1980F772C0D1546F1DEE0F8A6F2C7273A5A915860B768DE9BB24EBEFE2907CE18B0DF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.].a.3.a.3.a.3.h.u.3...6.`.3...7.t.3...2.n.3.a.2...3...=.r.3...0.e.3....`.3...1.`.3.Richa.3.........PE..d...b.............".................0..........@................CS P................3................ .......................................Y..h................J......................T............................S...............z..`............................text............................... ..`?g_Encry.-.......................... ..`.rdata..._.......`..................@..@.data........p.......V..............@....pdata...J.......L...d..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1450
                                                                                                                                        Entropy (8bit):7.341856001318595
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Uk1KaW6dGUcke/TZTy9huyg1FxVOJ8Mk20PrbBuN1rhbzQcR8Yw76s80c+:UwKZBUckerYh/g19u8F2Ub8N1NXQcGYO
                                                                                                                                        MD5:464F2980E43A11D0B043075EFE6C5BF4
                                                                                                                                        SHA1:41A667A8B3E476E64CB9C026908057E9FD420507
                                                                                                                                        SHA-256:EF19B78322AB9FF8DF1F08E2936B698BD7A57E490EA7E40E675421D60344EDF6
                                                                                                                                        SHA-512:162D82A7F9C8B2F152331CDA46B34A428B329F506FE854B6203653F99A0E1125D664ADE6C08E878216C9E957606314323251B6B7ED3ABC82884E243F7E094A5F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:........................................user.....................RSA1................a>.(.p_{..E..%......Lr...z...$f....y7)b<.. ...b...............0........s..`).F.g.t......o<..j.n..X.R...XqM....\....~?.,......................z..O......w...L.aI....?E......,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ....u/..0.Y..U;...{5}.y..9MFX..l.............. ....G`.....hj.Lwi........Zu2.\/.fI.............).z#..#....@.. U....j..{.C.Z.Ufd...mX.Q%..2.^7.J/.<.'0..m...:.m%.[g...D.Ky...y..0."...R.IB.X..H.W...T.+X..-).....*.4.......SY..7..Leb.^...6=.j......,.N.b_.5.eqA..%..Xp.........H{7..A..71.Pe.f.V%...O#.cR.......zC..t.X..~e2X..d....V<......H@.qE....r`...0..._....;.U....A..w.........^.lD.!Y...].....Fm;Nf]7.f....Dw{.jC...<... .;pC~.Ke'iL..p5...Z.b.n..Zz..J <<&d..$i.lf.......*{.9^.J.j{..+.....5.b.u.g. .w.{q.O........d....=T.....8P-.....\)$.1.......z....V.~*.].m`bV.g.!4....z.~GI...[3...V?#..;.bg.A...n.....*.$O..{+.o".bm!J.p..H..@..&wlT..Jn..1GAT......

                                                                                                                                        Static File Info

                                                                                                                                        General

                                                                                                                                        File type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                        Entropy (8bit):5.088449668278153
                                                                                                                                        TrID:
                                                                                                                                        • Win64 Dynamic Link Library (generic) (102004/3) 86.43%
                                                                                                                                        • Win64 Executable (generic) (12005/4) 10.17%
                                                                                                                                        • Generic Win/DOS Executable (2004/3) 1.70%
                                                                                                                                        • DOS Executable Generic (2002/1) 1.70%
                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
                                                                                                                                        File name:eWlldJYfLc.dll
                                                                                                                                        File size:1368064
                                                                                                                                        MD5:d098d01cbea52f858bce6d0d9faa5b26
                                                                                                                                        SHA1:952ce9cd899108c2821bf488b98387b6db8424b8
                                                                                                                                        SHA256:82c89b2a758177c7cfb7c1763b0444281c6b670deef015a886c866f18dbd8370
                                                                                                                                        SHA512:ca6b21d580689b8e50b55277d9630e972da202270800c3820c060782f464115220674cfcf78fb3253c5d4607cebf23f087a5281a7a324f94aa75b97a8329f702
                                                                                                                                        SSDEEP:12288:LZgJtlQepQn+NDo7nIYegQCLDF/B9wvj/cLvVZFuw:LZK6F7n5eRmDFJivohZFV
                                                                                                                                        File Content Preview:MZ......................@.......................................X..Z.qb..qb..qb.a...jqb.s....qb.9...\qb.s...(qb......qb..#.. qb../b..qb......qb.....Hqb..(c./qb.r,f..qb..(c..qb.;...,qb../..Tqb.....Zqb......qb.z...Bqb.....nqb.....[qb......qb.;...{qb......qb

                                                                                                                                        File Icon

                                                                                                                                        Icon Hash:74f0e4ecccdce0e4

                                                                                                                                        Static PE Info

                                                                                                                                        General

                                                                                                                                        Entrypoint:0x1400424b0
                                                                                                                                        Entrypoint Section:.text
                                                                                                                                        Digitally signed:false
                                                                                                                                        Imagebase:0x140000000
                                                                                                                                        Subsystem:windows gui
                                                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
                                                                                                                                        DLL Characteristics:TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
                                                                                                                                        Time Stamp:0x5E7D9D05 [Fri Mar 27 06:28:21 2020 UTC]
                                                                                                                                        TLS Callbacks:
                                                                                                                                        CLR (.Net) Version:
                                                                                                                                        OS Version Major:5
                                                                                                                                        OS Version Minor:0
                                                                                                                                        File Version Major:5
                                                                                                                                        File Version Minor:0
                                                                                                                                        Subsystem Version Major:5
                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                        Import Hash:4a2e61e1749a0183eccaadb9c4ef6ec2

                                                                                                                                        Entrypoint Preview

                                                                                                                                        Instruction
                                                                                                                                        dec eax
                                                                                                                                        mov dword ptr [00070639h], ecx
                                                                                                                                        dec eax
                                                                                                                                        lea ecx, dword ptr [FFFFF2F2h]
                                                                                                                                        dec esp
                                                                                                                                        mov dword ptr [0007064Bh], eax
                                                                                                                                        dec esp
                                                                                                                                        mov dword ptr [00070654h], edi
                                                                                                                                        dec esp
                                                                                                                                        mov dword ptr [00070655h], esi
                                                                                                                                        dec eax
                                                                                                                                        xor eax, eax
                                                                                                                                        dec eax
                                                                                                                                        inc eax
                                                                                                                                        dec eax
                                                                                                                                        add ecx, eax
                                                                                                                                        dec esp
                                                                                                                                        mov dword ptr [00070655h], esp
                                                                                                                                        dec eax
                                                                                                                                        dec ecx
                                                                                                                                        dec eax
                                                                                                                                        mov dword ptr [00070653h], esi
                                                                                                                                        dec eax
                                                                                                                                        test eax, eax
                                                                                                                                        je 00007F13CCA7C10Dh
                                                                                                                                        dec eax
                                                                                                                                        mov dword ptr [0007060Fh], esp
                                                                                                                                        dec eax
                                                                                                                                        mov dword ptr [00070600h], ebp
                                                                                                                                        dec eax
                                                                                                                                        mov dword ptr [00070649h], ebx
                                                                                                                                        dec eax
                                                                                                                                        mov dword ptr [0007063Ah], edi
                                                                                                                                        dec eax
                                                                                                                                        test eax, eax
                                                                                                                                        je 00007F13CCA7C0ECh
                                                                                                                                        dec esp
                                                                                                                                        mov dword ptr [000705FEh], ecx
                                                                                                                                        dec esp
                                                                                                                                        mov dword ptr [0007060Fh], ebp
                                                                                                                                        dec eax
                                                                                                                                        mov dword ptr [000705D0h], edx
                                                                                                                                        jmp ecx
                                                                                                                                        dec eax
                                                                                                                                        add edi, ecx
                                                                                                                                        retn 0008h
                                                                                                                                        ud2
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        int3
                                                                                                                                        push esi
                                                                                                                                        dec eax
                                                                                                                                        sub esp, 00000080h
                                                                                                                                        dec eax
                                                                                                                                        mov dword ptr [esp+78h], 58225FC8h
                                                                                                                                        mov dword ptr [esp+60h], 2DFAE652h
                                                                                                                                        mov al, byte ptr [esp+77h]
                                                                                                                                        mov dl, al
                                                                                                                                        add dl, FFFFFF85h
                                                                                                                                        mov byte ptr [esp+77h], dl
                                                                                                                                        mov word ptr [esp+5Eh], 3327h
                                                                                                                                        dec esp
                                                                                                                                        mov eax, dword ptr [esp+78h]
                                                                                                                                        inc esp
                                                                                                                                        mov ecx, dword ptr [esp+64h]

                                                                                                                                        Data Directories

                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x14d0100x8ee.pmeh
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xa99240x3c.rdata
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xbf0000x3d8.rsrc
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x10000x0.text
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xc00000xefc.reloc
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x430000x28.rdata
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                        Sections

                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                        .text0x10000x418cc0x42000False0.781412760417data7.78392111205IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                                        .rdata0x430000x66f430x67000False0.700320938258data7.87281050709IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .data0xaa0000x13ba70x14000False0.0782836914062data2.51707039551IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                                        .pdata0xbe0000x1380x1000False0.061279296875PEX Binary Archive0.599172422844IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .rsrc0xbf0000x69e0x1000False0.123291015625data1.07831823765IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .reloc0xc00000xf310x1000False0.416748046875data5.36145191459IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                                                                                        .vxl0xc10000x14d40x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .qwubgr0xc30000x11240x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .eer0xc50000x1e660x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .xwwauf0xc70000x9cd0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .pkc0xc80000x42a0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .npkda0xc90000x7360x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .vhs0xca0000x1af0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .iaywj0xcb0000x14550x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .nasi0xcd0000x8fe0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .zhvprh0xce0000x6cd00x7000False0.00177873883929data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .yatdsp0xd50000x5430x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .njso0xd60000x12780x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .lgliat0xd80000x7360x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .ntqjh0xd90000xbf60x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .sucsek0xda0000x23b0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .qsxjui0xdb0000x9cd0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .twctcm0xdc0000x11240x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .nms0xde0000x23b0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .ogj0xdf0000x12780x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .vrkgb0xe10000x7060x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .gikfw0xe20000x8fe0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .ktl0xe30000x9cd0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .crcn0xe40000x5a70x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .wtfr0xe50000x1ee0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .hep0xe60000x13e0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .ywg0xe70000xd330x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .sqsp0xe80000x2da0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .gzb0xe90000x23b0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .fatlss0xea0000x7360x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .plqa0xeb0000x13e0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .vzt0xec0000x13e0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .dsbyd0xed0000x1e660x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .cdelc0xef0000x7360x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .qkhkj0xf00000x5a70x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .mnzegr0xf10000x13e0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .krw0xf20000x23b0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .jvsmn0xf30000x3890x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .bygpq0xf40000x12780x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .kzdbu0xf60000xbde0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .mwxorn0xf70000x3fe0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .raf0xf80000x3890x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .zcyw0xf90000x2da0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .zeczh0xfa0000x128f0x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .pvv0xfc0000x13e0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .lug0xfd0000x451740x46000False0.0010498046875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .ski0x1430000x8fe0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .japjd0x1440000x128f0x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .mwtzml0x1460000x8fe0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .vgssf0x1470000x13e0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .gsroye0x1480000x12780x2000False0.0037841796875data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .vcmr0x14a0000x23b0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .ufki0x14b0000x3890x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .btl0x14c0000x2da0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                        .pmeh0x14d0000x8fe0x1000False0.25537109375data3.73292380196IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                        Resources

                                                                                                                                        NameRVASizeTypeLanguageCountry
                                                                                                                                        RT_VERSION0xbf0a00x2dcdataEnglishUnited States
                                                                                                                                        RT_MANIFEST0xbf3800x56ASCII text, with CRLF line terminatorsEnglishUnited States

                                                                                                                                        Imports

                                                                                                                                        DLLImport
                                                                                                                                        ADVAPI32.dllGetServiceDisplayNameW
                                                                                                                                        KERNEL32.dllLoadLibraryA, HeapUnlock

                                                                                                                                        Exports

                                                                                                                                        NameOrdinalAddress
                                                                                                                                        IsInteractiveUserSession10x14001b188
                                                                                                                                        QueryActiveSession20x14002de80
                                                                                                                                        QueryUserToken30x140021f90
                                                                                                                                        RegisterUsertokenForNoWinlogon40x140037744
                                                                                                                                        WTSCloseServer50x140001e84
                                                                                                                                        WTSConnectSessionA60x1400128ec
                                                                                                                                        WTSConnectSessionW70x14003b464
                                                                                                                                        WTSCreateListenerA80x14003ca60
                                                                                                                                        WTSCreateListenerW90x140016670
                                                                                                                                        WTSDisconnectSession100x14002e280
                                                                                                                                        WTSEnableChildSessions110x14001d394
                                                                                                                                        WTSEnumerateListenersA120x140008b14
                                                                                                                                        WTSEnumerateListenersW130x14000ae90
                                                                                                                                        WTSEnumerateProcessesA140x140006aa4
                                                                                                                                        WTSEnumerateProcessesExA150x140036e0c
                                                                                                                                        WTSEnumerateProcessesExW160x14003dd78
                                                                                                                                        WTSEnumerateProcessesW170x1400040c8
                                                                                                                                        WTSEnumerateServersA180x140035160
                                                                                                                                        WTSEnumerateServersW190x140038de0
                                                                                                                                        WTSEnumerateSessionsA200x140031ca8
                                                                                                                                        WTSEnumerateSessionsExA210x14000d828
                                                                                                                                        WTSEnumerateSessionsExW220x14001fae0
                                                                                                                                        WTSEnumerateSessionsW230x1400287b8
                                                                                                                                        WTSFreeMemory240x14002b15c
                                                                                                                                        WTSFreeMemoryExA250x140029c60
                                                                                                                                        WTSFreeMemoryExW260x14000a54c
                                                                                                                                        WTSGetChildSessionId270x140037034
                                                                                                                                        WTSGetListenerSecurityA280x140010070
                                                                                                                                        WTSGetListenerSecurityW290x14002dea0
                                                                                                                                        WTSIsChildSessionsEnabled300x14002b160
                                                                                                                                        WTSLogoffSession310x14002f53c
                                                                                                                                        WTSOpenServerA320x140026a74
                                                                                                                                        WTSOpenServerExA330x140028860
                                                                                                                                        WTSOpenServerExW340x14002380c
                                                                                                                                        WTSOpenServerW350x14002aa8c
                                                                                                                                        WTSQueryListenerConfigA360x140019714
                                                                                                                                        WTSQueryListenerConfigW370x1400401a4
                                                                                                                                        WTSQuerySessionInformationA380x140030ae4
                                                                                                                                        WTSQuerySessionInformationW390x140024f78
                                                                                                                                        WTSQueryUserConfigA400x14002490c
                                                                                                                                        WTSQueryUserConfigW410x14003dda8
                                                                                                                                        WTSQueryUserToken420x140004d64
                                                                                                                                        WTSRegisterSessionNotification430x140008d84
                                                                                                                                        WTSRegisterSessionNotificationEx440x14001a96c
                                                                                                                                        WTSSendMessageA450x14003dd78
                                                                                                                                        WTSSendMessageW460x14000a2cc
                                                                                                                                        WTSSetListenerSecurityA470x140037dec
                                                                                                                                        WTSSetListenerSecurityW480x140033d00
                                                                                                                                        WTSSetRenderHint490x1400309e8
                                                                                                                                        WTSSetSessionInformationA500x140027a8c
                                                                                                                                        WTSSetSessionInformationW510x140020908
                                                                                                                                        WTSSetUserConfigA520x140013664
                                                                                                                                        WTSSetUserConfigW530x14002f130
                                                                                                                                        WTSShutdownSystem540x1400234cc
                                                                                                                                        WTSStartRemoteControlSessionA550x14002f0b0
                                                                                                                                        WTSStartRemoteControlSessionW560x140040e90
                                                                                                                                        WTSStopRemoteControlSession570x14000daec
                                                                                                                                        WTSTerminateProcess580x1400270d8
                                                                                                                                        WTSUnRegisterSessionNotification590x14002c144
                                                                                                                                        WTSUnRegisterSessionNotificationEx600x140035390
                                                                                                                                        WTSVirtualChannelClose610x140042810
                                                                                                                                        WTSVirtualChannelOpen620x140035678
                                                                                                                                        WTSVirtualChannelOpenEx630x14002dff4
                                                                                                                                        WTSVirtualChannelPurgeInput640x14000e808
                                                                                                                                        WTSVirtualChannelPurgeOutput650x14003aacc
                                                                                                                                        WTSVirtualChannelQuery660x1400235d4
                                                                                                                                        WTSVirtualChannelRead670x140041888
                                                                                                                                        WTSVirtualChannelWrite680x14000c228
                                                                                                                                        WTSWaitSystemEvent690x140038334

                                                                                                                                        Version Infos

                                                                                                                                        DescriptionData
                                                                                                                                        LegalCopyright Microsoft Corporation. All rights
                                                                                                                                        InternalNamedpnhup
                                                                                                                                        FileVersion1.56
                                                                                                                                        CompanyNameMicrosoft C
                                                                                                                                        ProductNameSysinternals Streams
                                                                                                                                        ProductVersion6.1
                                                                                                                                        FileDescriptionThai K
                                                                                                                                        OriginalFilenamedpnhupnp.d
                                                                                                                                        Translation0x0409 0x04b0

                                                                                                                                        Possible Origin

                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                        EnglishUnited States

                                                                                                                                        Network Behavior

                                                                                                                                        ⊘No network behavior found

                                                                                                                                        Statistics

                                                                                                                                        CPU Usage

                                                                                                                                        Click to jump to process

                                                                                                                                        Memory Usage

                                                                                                                                        Click to jump to process

                                                                                                                                        High Level Behavior Distribution

                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                        Behavior

                                                                                                                                        Click to jump to process

                                                                                                                                        System Behavior

                                                                                                                                        General

                                                                                                                                        Target ID:0
                                                                                                                                        Start time:15:47:10
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\loaddll64.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:loaddll64.exe "C:\Users\user\Desktop\eWlldJYfLc.dll"
                                                                                                                                        Imagebase:0x7ff72e730000
                                                                                                                                        File size:140288 bytes
                                                                                                                                        MD5 hash:4E8A40CAD6CCC047914E3A7830A2D8AA
                                                                                                                                        Has elevated privileges:true
                                                                                                                                        Has administrator privileges:true
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                        Reputation:moderate

                                                                                                                                        General

                                                                                                                                        Target ID:1
                                                                                                                                        Start time:15:47:11
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1
                                                                                                                                        Imagebase:0x7ff64ce50000
                                                                                                                                        File size:273920 bytes
                                                                                                                                        MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                        Has elevated privileges:true
                                                                                                                                        Has administrator privileges:true
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high

                                                                                                                                        General

                                                                                                                                        Target ID:2
                                                                                                                                        Start time:15:47:12
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\rundll32.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,IsInteractiveUserSession
                                                                                                                                        Imagebase:0x7ff7ef960000
                                                                                                                                        File size:69632 bytes
                                                                                                                                        MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                                                        Has elevated privileges:true
                                                                                                                                        Has administrator privileges:true
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.382839680.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                        Reputation:high

                                                                                                                                        General

                                                                                                                                        Target ID:3
                                                                                                                                        Start time:15:47:12
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\rundll32.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:rundll32.exe "C:\Users\user\Desktop\eWlldJYfLc.dll",#1
                                                                                                                                        Imagebase:0x7ff7ef960000
                                                                                                                                        File size:69632 bytes
                                                                                                                                        MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                                                        Has elevated privileges:true
                                                                                                                                        Has administrator privileges:true
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000003.00000002.260901088.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                        Reputation:high

                                                                                                                                        General

                                                                                                                                        Target ID:4
                                                                                                                                        Start time:15:47:14
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\explorer.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\Explorer.EXE
                                                                                                                                        Imagebase:0x7ff6b8cf0000
                                                                                                                                        File size:3933184 bytes
                                                                                                                                        MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high

                                                                                                                                        General

                                                                                                                                        Target ID:6
                                                                                                                                        Start time:15:47:15
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\rundll32.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,QueryActiveSession
                                                                                                                                        Imagebase:0x7ff7ef960000
                                                                                                                                        File size:69632 bytes
                                                                                                                                        MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                                                        Has elevated privileges:true
                                                                                                                                        Has administrator privileges:true
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000006.00000002.267568902.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                        Reputation:high

                                                                                                                                        General

                                                                                                                                        Target ID:8
                                                                                                                                        Start time:15:47:18
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\rundll32.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:rundll32.exe C:\Users\user\Desktop\eWlldJYfLc.dll,QueryUserToken
                                                                                                                                        Imagebase:0x7ff7ef960000
                                                                                                                                        File size:69632 bytes
                                                                                                                                        MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                                                        Has elevated privileges:true
                                                                                                                                        Has administrator privileges:true
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000008.00000002.274772551.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                        Reputation:high

                                                                                                                                        General

                                                                                                                                        Target ID:11
                                                                                                                                        Start time:15:47:30
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                                                                        Imagebase:0x7ff73c930000
                                                                                                                                        File size:51288 bytes
                                                                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                        Has elevated privileges:true
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high

                                                                                                                                        General

                                                                                                                                        Target ID:18
                                                                                                                                        Start time:15:48:17
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\sdclt.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\sdclt.exe
                                                                                                                                        Imagebase:0x7ff60bf90000
                                                                                                                                        File size:1210880 bytes
                                                                                                                                        MD5 hash:0632A8402C6504CD541AC93676AAD0F5
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:moderate

                                                                                                                                        General

                                                                                                                                        Target ID:19
                                                                                                                                        Start time:15:48:18
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\CloudNotifications.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\CloudNotifications.exe
                                                                                                                                        Imagebase:0x7ff793190000
                                                                                                                                        File size:77072 bytes
                                                                                                                                        MD5 hash:D9FF4C8DBC1682E0508322307CB89C0F
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:moderate

                                                                                                                                        General

                                                                                                                                        Target ID:20
                                                                                                                                        Start time:15:48:20
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Users\user\AppData\Local\R7Mg9\CloudNotifications.exe
                                                                                                                                        Imagebase:0x7ff740780000
                                                                                                                                        File size:77072 bytes
                                                                                                                                        MD5 hash:D9FF4C8DBC1682E0508322307CB89C0F
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security

                                                                                                                                        General

                                                                                                                                        Target ID:22
                                                                                                                                        Start time:15:48:33
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\systemreset.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\systemreset.exe
                                                                                                                                        Imagebase:0x7ff764df0000
                                                                                                                                        File size:506184 bytes
                                                                                                                                        MD5 hash:872AE9FE08ED1AA78208678967BE2FEF
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                        General

                                                                                                                                        Target ID:25
                                                                                                                                        Start time:15:48:34
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\Dxpserver.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\Dxpserver.exe
                                                                                                                                        Imagebase:0x7ff7a7db0000
                                                                                                                                        File size:304640 bytes
                                                                                                                                        MD5 hash:DCCB1D350193BE0A26CEAFF602DB848E
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                        General

                                                                                                                                        Target ID:26
                                                                                                                                        Start time:15:48:38
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Users\user\AppData\Local\4O9p1cGN\Dxpserver.exe
                                                                                                                                        Imagebase:0x7ff7540f0000
                                                                                                                                        File size:304640 bytes
                                                                                                                                        MD5 hash:DCCB1D350193BE0A26CEAFF602DB848E
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001A.00000002.465961019.00007FFC74C21000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security
                                                                                                                                        Antivirus matches:
                                                                                                                                        • Detection: 0%, Metadefender, Browse
                                                                                                                                        • Detection: 0%, ReversingLabs

                                                                                                                                        General

                                                                                                                                        Target ID:28
                                                                                                                                        Start time:15:48:49
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\mfpmp.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\mfpmp.exe
                                                                                                                                        Imagebase:0x7ff6cc190000
                                                                                                                                        File size:49688 bytes
                                                                                                                                        MD5 hash:7C3D09D6DB5DB4A272FCF4C1BB3986BD
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                        General

                                                                                                                                        Target ID:29
                                                                                                                                        Start time:15:48:51
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Users\user\AppData\Local\bj1HT\mfpmp.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Users\user\AppData\Local\bj1HT\mfpmp.exe
                                                                                                                                        Imagebase:0x7ff670a40000
                                                                                                                                        File size:49688 bytes
                                                                                                                                        MD5 hash:7C3D09D6DB5DB4A272FCF4C1BB3986BD
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001D.00000002.500951495.00007FFC74C21000.00000020.00000001.01000000.0000000E.sdmp, Author: Joe Security

                                                                                                                                        General

                                                                                                                                        Target ID:30
                                                                                                                                        Start time:15:49:06
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\msra.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\msra.exe
                                                                                                                                        Imagebase:0x7ff7a2430000
                                                                                                                                        File size:600064 bytes
                                                                                                                                        MD5 hash:3240CC226FB8AC41A0431A8F3B9DD770
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                        General

                                                                                                                                        Target ID:31
                                                                                                                                        Start time:15:49:06
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\mstsc.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\mstsc.exe
                                                                                                                                        Imagebase:0x7ff633000000
                                                                                                                                        File size:3640832 bytes
                                                                                                                                        MD5 hash:3FBB5CD8829E9533D0FF5819DB0444C0
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                        General

                                                                                                                                        Target ID:33
                                                                                                                                        Start time:15:49:08
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Users\user\AppData\Local\n0R5g\mstsc.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Users\user\AppData\Local\n0R5g\mstsc.exe
                                                                                                                                        Imagebase:0x7ff7b8700000
                                                                                                                                        File size:3640832 bytes
                                                                                                                                        MD5 hash:3FBB5CD8829E9533D0FF5819DB0444C0
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000021.00000002.543380049.00007FFC74C21000.00000020.00000001.01000000.00000011.sdmp, Author: Joe Security

                                                                                                                                        General

                                                                                                                                        Target ID:34
                                                                                                                                        Start time:15:49:25
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Windows\System32\SndVol.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\SndVol.exe
                                                                                                                                        Imagebase:0x7ff62b390000
                                                                                                                                        File size:259904 bytes
                                                                                                                                        MD5 hash:CDD7C7DF2D0859AC3F4088423D11BD08
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                        General

                                                                                                                                        Target ID:35
                                                                                                                                        Start time:15:49:27
                                                                                                                                        Start date:23/03/2022
                                                                                                                                        Path:C:\Users\user\AppData\Local\Nz4mnM\SndVol.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Users\user\AppData\Local\Nz4mnM\SndVol.exe
                                                                                                                                        Imagebase:0x7ff742cd0000
                                                                                                                                        File size:259904 bytes
                                                                                                                                        MD5 hash:CDD7C7DF2D0859AC3F4088423D11BD08
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000023.00000002.574221343.00007FFC74C21000.00000020.00000001.01000000.00000013.sdmp, Author: Joe Security
                                                                                                                                        Antivirus matches:
                                                                                                                                        • Detection: 0%, Metadefender, Browse
                                                                                                                                        • Detection: 0%, ReversingLabs

                                                                                                                                        Disassembly

                                                                                                                                        Reset < >

                                                                                                                                          Execution Graph

                                                                                                                                          Execution Coverage:2.2%
                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                          Signature Coverage:42.1%
                                                                                                                                          Total number of Nodes:397
                                                                                                                                          Total number of Limit Nodes:49
                                                                                                                                          execution_graph 81853 16b476e2978 81854 16b476e2986 81853->81854 81859 16b476e2060 VirtualAlloc 81854->81859 81856 16b476e29a2 81861 16b476e2264 81856->81861 81858 16b476e29ba 81860 16b476e20c4 81859->81860 81860->81856 81862 16b476e230f 81861->81862 81863 16b476e238c VirtualProtect 81861->81863 81862->81863 81864 16b476e23ee 81863->81864 81865 16b476e244d VirtualProtect 81864->81865 81866 16b476e2507 VirtualProtect 81865->81866 81867 16b476e2544 81865->81867 81866->81867 81869 16b476e25c5 81867->81869 81870 16b476e258c RtlAvlRemoveNode 81867->81870 81869->81858 81870->81869 81871 7ffc6711ed10 81885 7ffc6711ddc0 81871->81885 81876 7ffc6711ed53 FindFirstFileExW 81877 7ffc6711ed78 81876->81877 81878 7ffc6711ed95 81876->81878 81877->81878 81882 7ffc67109ad0 _RunAllParam 2 API calls 81877->81882 81884 7ffc6711edea 81878->81884 81934 7ffc6710d730 81878->81934 81879 7ffc6711eda4 81879->81878 81880 7ffc67109ad0 _RunAllParam 2 API calls 81879->81880 81880->81878 81882->81878 81886 7ffc6711ddeb 81885->81886 81887 7ffc6711eb83 81886->81887 81948 7ffc67106d10 81886->81948 81924 7ffc67109ad0 81887->81924 81890 7ffc6711de4c 81893 7ffc6711e47a 81890->81893 81902 7ffc6711e027 _RunAllParam 81890->81902 81906 7ffc6711e016 _RunAllParam 81890->81906 82097 7ffc67125760 81890->82097 81952 7ffc67109540 81893->81952 81895 7ffc6711e4e0 81994 7ffc6710ca50 81895->81994 81898 7ffc6711e54c 82022 7ffc6710a2c0 81898->82022 81899 7ffc6711e51f 82125 7ffc67119410 NtClose LdrLoadDll FindNextFileW _RunAllParam 81899->82125 81901 7ffc67125760 _RunAllParam 2 API calls 81904 7ffc6711e1ab 81901->81904 81905 7ffc67109ad0 _RunAllParam 2 API calls 81902->81905 81902->81906 81904->81893 81904->81901 81909 7ffc6711e2f7 _RunAllParam 81904->81909 81915 7ffc6711e2e6 _RunAllParam 81904->81915 81905->81906 81906->81915 82101 7ffc671097d0 81906->82101 81907 7ffc6711eb7c GetSystemInfo 81907->81887 81908 7ffc67125760 _RunAllParam 2 API calls 81911 7ffc6711e524 81908->81911 81910 7ffc67109ad0 _RunAllParam 2 API calls 81909->81910 81909->81915 81910->81915 81911->81907 81911->81908 81917 7ffc6711e727 _RunAllParam 81911->81917 81920 7ffc6711e716 _RunAllParam 81911->81920 81912 7ffc67108a60 _RunAllParam 2 API calls 81914 7ffc6711eb70 81912->81914 81913 7ffc671097d0 _RunAllParam 2 API calls 81919 7ffc6711e8ab 81913->81919 81914->81887 81914->81907 81915->81893 82119 7ffc67108a60 81915->82119 81916 7ffc67125760 _RunAllParam 2 API calls 81916->81919 81918 7ffc67109ad0 _RunAllParam 2 API calls 81917->81918 81917->81920 81918->81920 81919->81887 81919->81916 81921 7ffc6711e9f4 _RunAllParam 81919->81921 81923 7ffc6711e9e3 _RunAllParam 81919->81923 81920->81913 81920->81923 81921->81887 81922 7ffc67109ad0 _RunAllParam 2 API calls 81921->81922 81921->81923 81922->81923 81923->81887 81923->81912 81926 7ffc67109ae5 _RunAllParam 81924->81926 81925 7ffc67109af2 81925->81876 81925->81879 81926->81925 82265 7ffc671086f0 81926->82265 81928 7ffc67109b06 81929 7ffc67109b1d 81928->81929 81931 7ffc671097d0 _RunAllParam 2 API calls 81928->81931 81929->81925 81930 7ffc67108a60 _RunAllParam 2 API calls 81929->81930 81930->81925 81932 7ffc67109b12 81931->81932 81932->81925 81933 7ffc671086f0 _RunAllParam 2 API calls 81932->81933 81933->81929 81936 7ffc6710d771 81934->81936 81935 7ffc6710dd82 81936->81935 81937 7ffc67125760 _RunAllParam 2 API calls 81936->81937 81941 7ffc6710d928 _RunAllParam 81936->81941 81944 7ffc6710d917 _RunAllParam 81936->81944 81937->81936 81938 7ffc67108a60 _RunAllParam 2 API calls 81938->81935 81939 7ffc671097d0 _RunAllParam 2 API calls 81942 7ffc6710daba 81939->81942 81940 7ffc67125760 _RunAllParam 2 API calls 81940->81942 81943 7ffc67109ad0 _RunAllParam 2 API calls 81941->81943 81941->81944 81942->81935 81942->81940 81945 7ffc6710dc05 _RunAllParam 81942->81945 81947 7ffc6710dbf4 _RunAllParam 81942->81947 81943->81944 81944->81939 81944->81947 81945->81935 81946 7ffc67109ad0 _RunAllParam 2 API calls 81945->81946 81945->81947 81946->81947 81947->81935 81947->81938 81949 7ffc67106d41 81948->81949 81950 7ffc67106d2d 81948->81950 81949->81890 81950->81949 81951 7ffc67109ad0 _RunAllParam 2 API calls 81950->81951 81951->81949 81953 7ffc6711ddc0 14 API calls 81952->81953 81954 7ffc67109553 81953->81954 81955 7ffc67109558 81954->81955 82126 7ffc67100150 81954->82126 81955->81895 81958 7ffc671095a3 _RunAllParam 81959 7ffc671095de 81958->81959 82129 7ffc67100280 81958->82129 82132 7ffc671235d0 81959->82132 81961 7ffc671095f5 _RunAllParam 82136 7ffc67122750 81961->82136 81963 7ffc67109611 82139 7ffc67122a70 81963->82139 81965 7ffc6710961d _RunAllParam 81966 7ffc67109664 81965->81966 81970 7ffc6710962c _RunAllParam 81965->81970 81967 7ffc67122750 3 API calls 81966->81967 81968 7ffc6710967f 81967->81968 81971 7ffc67122a70 4 API calls 81968->81971 81969 7ffc6710964e 81969->81895 81970->81969 81973 7ffc670ed410 _RunAllParam 2 API calls 81970->81973 81972 7ffc6710968b _RunAllParam 81971->81972 81974 7ffc67122750 3 API calls 81972->81974 81973->81969 81975 7ffc671096a9 81974->81975 81976 7ffc67122a70 4 API calls 81975->81976 81977 7ffc671096b5 _RunAllParam 81976->81977 81978 7ffc671096c4 81977->81978 81979 7ffc671096f8 81977->81979 81984 7ffc671096cc _RunAllParam 81978->81984 81985 7ffc67109790 _RunAllParam 81978->81985 81980 7ffc6710975c 81979->81980 81981 7ffc671096fd 81979->81981 81980->81985 81987 7ffc67109766 _RunAllParam 81980->81987 81982 7ffc6710972d 81981->81982 81986 7ffc67109701 _RunAllParam 81981->81986 81982->81985 81988 7ffc67109732 _RunAllParam 81982->81988 81983 7ffc671096ee 81983->81895 81984->81983 82146 7ffc670ed410 81984->82146 81985->81983 81989 7ffc670ed410 _RunAllParam 2 API calls 81985->81989 81986->81983 81991 7ffc670ed410 _RunAllParam 2 API calls 81986->81991 81987->81983 81992 7ffc670ed410 _RunAllParam 2 API calls 81987->81992 81988->81983 81993 7ffc670ed410 _RunAllParam 2 API calls 81988->81993 81989->81983 81991->81983 81992->81983 81993->81983 81996 7ffc6710cab0 81994->81996 81995 7ffc67125760 _RunAllParam 2 API calls 81995->81996 81996->81995 82001 7ffc6710d099 81996->82001 82003 7ffc6710cc37 _RunAllParam 81996->82003 82005 7ffc6710ccc3 _RunAllParam 81996->82005 81997 7ffc6710d700 81997->81898 81997->81899 81998 7ffc6710d6d6 GetTokenInformation 81998->81997 81999 7ffc67108a60 _RunAllParam 2 API calls 81999->82001 82000 7ffc671097d0 _RunAllParam 2 API calls 82010 7ffc6710cdba 82000->82010 82001->81997 82001->81998 82002 7ffc67125760 _RunAllParam 2 API calls 82001->82002 82011 7ffc6710d277 _RunAllParam 82001->82011 82013 7ffc6710d303 _RunAllParam 82001->82013 82002->82001 82004 7ffc67109ad0 _RunAllParam 2 API calls 82003->82004 82003->82005 82004->82005 82005->82000 82018 7ffc6710cef6 _RunAllParam 82005->82018 82006 7ffc67125760 _RunAllParam 2 API calls 82006->82010 82007 7ffc67108a60 _RunAllParam 2 API calls 82009 7ffc6710d6d1 82007->82009 82008 7ffc671097d0 _RunAllParam 2 API calls 82015 7ffc6710d403 82008->82015 82009->81997 82009->81998 82010->81997 82010->82006 82016 7ffc6710cf07 _RunAllParam 82010->82016 82010->82018 82012 7ffc67109ad0 _RunAllParam 2 API calls 82011->82012 82011->82013 82012->82013 82013->82008 82021 7ffc6710d544 _RunAllParam 82013->82021 82014 7ffc67125760 _RunAllParam 2 API calls 82014->82015 82015->81997 82015->82014 82019 7ffc6710d555 _RunAllParam 82015->82019 82015->82021 82017 7ffc67109ad0 _RunAllParam 2 API calls 82016->82017 82016->82018 82017->82018 82018->81997 82018->81999 82019->81997 82020 7ffc67109ad0 _RunAllParam 2 API calls 82019->82020 82019->82021 82020->82021 82021->81997 82021->82007 82025 7ffc6710a31e 82022->82025 82023 7ffc6710a8fa 82237 7ffc671075b0 82023->82237 82024 7ffc67125760 _RunAllParam 2 API calls 82024->82025 82025->82023 82025->82024 82033 7ffc6710a4a7 _RunAllParam 82025->82033 82039 7ffc6710a533 _RunAllParam 82025->82039 82027 7ffc6710c326 _RunAllParam 82028 7ffc6710c321 82027->82028 82031 7ffc67107770 _RunAllParam 3 API calls 82027->82031 82028->81911 82029 7ffc67108a60 _RunAllParam 2 API calls 82029->82023 82030 7ffc671097d0 _RunAllParam 2 API calls 82044 7ffc6710a62b 82030->82044 82031->82028 82032 7ffc6710aaeb 82036 7ffc6710af9c 82032->82036 82037 7ffc6710af7f GetTokenInformation 82032->82037 82035 7ffc67109ad0 _RunAllParam 2 API calls 82033->82035 82033->82039 82034 7ffc67125760 _RunAllParam 2 API calls 82038 7ffc6710a92b 82034->82038 82035->82039 82036->82027 82042 7ffc67100150 _RunAllParam 2 API calls 82036->82042 82037->82036 82038->82027 82038->82032 82038->82034 82045 7ffc6710ab0d _RunAllParam 82038->82045 82054 7ffc6710aaf6 _RunAllParam 82038->82054 82039->82030 82055 7ffc6710a766 _RunAllParam 82039->82055 82040 7ffc67108a60 _RunAllParam 2 API calls 82040->82032 82041 7ffc671097d0 _RunAllParam 2 API calls 82048 7ffc6710aca3 82041->82048 82052 7ffc6710afb9 _RunAllParam 82042->82052 82043 7ffc67125760 _RunAllParam 2 API calls 82043->82044 82044->82023 82044->82043 82051 7ffc6710a777 _RunAllParam 82044->82051 82044->82055 82047 7ffc67109ad0 _RunAllParam 2 API calls 82045->82047 82045->82054 82046 7ffc67125760 _RunAllParam 2 API calls 82046->82048 82047->82054 82048->82036 82048->82046 82056 7ffc6710adf7 _RunAllParam 82048->82056 82065 7ffc6710ade6 _RunAllParam 82048->82065 82049 7ffc6710b608 GetTokenInformation 82049->82027 82062 7ffc6710b632 82049->82062 82050 7ffc67125760 _RunAllParam 2 API calls 82050->82052 82053 7ffc67109ad0 _RunAllParam 2 API calls 82051->82053 82051->82055 82052->82049 82052->82050 82063 7ffc6710b197 _RunAllParam 82052->82063 82067 7ffc6710b223 _RunAllParam 82052->82067 82053->82055 82054->82041 82054->82065 82055->82023 82055->82029 82060 7ffc67109ad0 _RunAllParam 2 API calls 82056->82060 82056->82065 82057 7ffc67108a60 _RunAllParam 2 API calls 82061 7ffc6710b5ee 82057->82061 82058 7ffc67125760 _RunAllParam 2 API calls 82058->82062 82059 7ffc671097d0 _RunAllParam 2 API calls 82073 7ffc6710b31b 82059->82073 82060->82065 82061->82027 82061->82049 82062->82058 82071 7ffc6710bc3e 82062->82071 82074 7ffc6710b7e7 _RunAllParam 82062->82074 82078 7ffc6710b873 _RunAllParam 82062->82078 82064 7ffc67109ad0 _RunAllParam 2 API calls 82063->82064 82063->82067 82064->82067 82065->82036 82065->82040 82066 7ffc67108a60 _RunAllParam 2 API calls 82066->82071 82067->82059 82089 7ffc6710b456 _RunAllParam 82067->82089 82068 7ffc671097d0 _RunAllParam 2 API calls 82080 7ffc6710b96b 82068->82080 82069 7ffc67125760 _RunAllParam 2 API calls 82069->82073 82070 7ffc6710c27a 82070->82027 82081 7ffc6710c29e _RunAllParam 82070->82081 82071->82027 82071->82070 82072 7ffc67125760 _RunAllParam 2 API calls 82071->82072 82086 7ffc6710be25 _RunAllParam 82071->82086 82090 7ffc6710be14 _RunAllParam 82071->82090 82072->82071 82073->82027 82073->82069 82082 7ffc6710b467 _RunAllParam 82073->82082 82073->82089 82075 7ffc67109ad0 _RunAllParam 2 API calls 82074->82075 82074->82078 82075->82078 82076 7ffc67108a60 _RunAllParam 2 API calls 82076->82070 82077 7ffc671097d0 _RunAllParam 2 API calls 82087 7ffc6710bfab 82077->82087 82078->82068 82094 7ffc6710baa6 _RunAllParam 82078->82094 82079 7ffc67125760 _RunAllParam 2 API calls 82079->82080 82080->82027 82080->82079 82091 7ffc6710bab7 _RunAllParam 82080->82091 82080->82094 82081->82028 82245 7ffc67107770 82081->82245 82085 7ffc67109ad0 _RunAllParam 2 API calls 82082->82085 82082->82089 82083 7ffc67125760 _RunAllParam 2 API calls 82083->82087 82085->82089 82088 7ffc67109ad0 _RunAllParam 2 API calls 82086->82088 82086->82090 82087->82027 82087->82083 82093 7ffc6710c0f7 _RunAllParam 82087->82093 82096 7ffc6710c0e6 _RunAllParam 82087->82096 82088->82090 82089->82027 82089->82057 82090->82077 82090->82096 82092 7ffc67109ad0 _RunAllParam 2 API calls 82091->82092 82091->82094 82092->82094 82093->82027 82095 7ffc67109ad0 _RunAllParam 2 API calls 82093->82095 82093->82096 82094->82027 82094->82066 82095->82096 82096->82027 82096->82076 82099 7ffc6712580c 82097->82099 82100 7ffc67125792 82097->82100 82098 7ffc67109ad0 _RunAllParam 2 API calls 82098->82100 82099->81890 82100->82098 82100->82099 82102 7ffc671097f6 _RunAllParam 82101->82102 82252 7ffc67109230 82102->82252 82104 7ffc6711ec40 _RunAllParam FindNextFileW 82116 7ffc67109a43 _RunAllParam 82104->82116 82105 7ffc67106180 _RunAllParam FindNextFileW 82106 7ffc6710980c _RunAllParam 82105->82106 82106->82105 82108 7ffc67109917 _RunAllParam 82106->82108 82114 7ffc67109912 _RunAllParam 82106->82114 82256 7ffc6711ec70 82106->82256 82109 7ffc67100150 _RunAllParam FindNextFileW 82108->82109 82110 7ffc67109960 _RunAllParam 82109->82110 82111 7ffc67109ad0 _RunAllParam FindNextFileW 82110->82111 82112 7ffc671099c4 _RunAllParam 82111->82112 82113 7ffc671099f2 82112->82113 82115 7ffc671099e0 LdrLoadDll 82112->82115 82113->82114 82117 7ffc67109a02 _RunAllParam 82113->82117 82114->82104 82114->82116 82115->82113 82116->81904 82117->82116 82262 7ffc6711ec40 82117->82262 82120 7ffc67108a78 _RunAllParam 82119->82120 82120->82120 82121 7ffc67125760 _RunAllParam 2 API calls 82120->82121 82122 7ffc67108b72 _RunAllParam 82120->82122 82124 7ffc67108a8b _RunAllParam 82120->82124 82121->82120 82123 7ffc67109ad0 _RunAllParam 2 API calls 82122->82123 82122->82124 82123->82124 82124->81893 82125->81911 82149 7ffc671000b0 82126->82149 82128 7ffc67100170 82128->81958 82130 7ffc671000b0 _RunAllParam 2 API calls 82129->82130 82131 7ffc67100294 82130->82131 82131->81958 82133 7ffc67123607 _RunAllParam 82132->82133 82160 7ffc67122e60 82133->82160 82135 7ffc67123618 82135->81961 82209 7ffc671226a0 82136->82209 82138 7ffc6712277a _RunAllParam 82138->81963 82140 7ffc67100150 _RunAllParam 2 API calls 82139->82140 82141 7ffc67122a94 82140->82141 82222 7ffc67122810 82141->82222 82143 7ffc67122aa4 82144 7ffc67122abb _RunAllParam 82143->82144 82236 7ffc67100330 LdrLoadDll FindNextFileW _RunAllParam 82143->82236 82144->81965 82147 7ffc67109ad0 _RunAllParam 2 API calls 82146->82147 82148 7ffc670ed428 82147->82148 82148->81983 82150 7ffc671000ce 82149->82150 82152 7ffc671000de 82149->82152 82155 7ffc67106d80 LdrLoadDll FindNextFileW _RunAllParam 82150->82155 82154 7ffc67100123 82152->82154 82156 7ffc67106df0 82152->82156 82154->82128 82155->82152 82157 7ffc67106e26 82156->82157 82158 7ffc67106e0d 82156->82158 82157->82154 82158->82157 82159 7ffc67109ad0 _RunAllParam 2 API calls 82158->82159 82159->82157 82161 7ffc67122e8b _RunAllParam 82160->82161 82162 7ffc67109ad0 _RunAllParam 2 API calls 82161->82162 82165 7ffc67122ed7 82162->82165 82163 7ffc6712312e 82164 7ffc6710d730 _RunAllParam 2 API calls 82163->82164 82166 7ffc67123136 _RunAllParam 82164->82166 82165->82163 82188 7ffc67122f00 _RunAllParam 82165->82188 82167 7ffc67109ad0 _RunAllParam 2 API calls 82166->82167 82177 7ffc67123166 _RunAllParam 82166->82177 82179 7ffc67123124 82167->82179 82168 7ffc671232b9 82168->82135 82169 7ffc671230b0 82172 7ffc671230e1 _RunAllParam 82169->82172 82173 7ffc67109ad0 _RunAllParam 2 API calls 82169->82173 82170 7ffc67123164 RegCloseKey 82170->82177 82171 7ffc67109ad0 LdrLoadDll FindNextFileW _RunAllParam 82171->82188 82175 7ffc67109ad0 _RunAllParam 2 API calls 82172->82175 82172->82177 82173->82172 82174 7ffc67122f56 RegCloseKey 82174->82188 82175->82179 82176 7ffc67122fa4 RegEnumKeyW 82176->82169 82176->82188 82177->82168 82178 7ffc6711ddc0 10 API calls 82177->82178 82180 7ffc671231ff 82178->82180 82179->82170 82179->82177 82180->82168 82197 7ffc67100180 82180->82197 82183 7ffc67123216 82184 7ffc67100280 2 API calls 82183->82184 82187 7ffc6712322f _RunAllParam 82184->82187 82185 7ffc67123268 _RunAllParam 82189 7ffc67122e60 10 API calls 82185->82189 82186 7ffc67123013 RegOpenKeyExW 82186->82188 82187->82185 82202 7ffc67106d80 LdrLoadDll FindNextFileW _RunAllParam 82187->82202 82188->82169 82188->82171 82188->82174 82188->82176 82188->82186 82192 7ffc67106180 82188->82192 82190 7ffc6712329f _RunAllParam 82189->82190 82190->82135 82203 7ffc671055b0 82192->82203 82194 7ffc6710619a 82195 7ffc67125760 _RunAllParam 2 API calls 82194->82195 82196 7ffc671061ca 82195->82196 82196->82188 82198 7ffc671000b0 _RunAllParam 2 API calls 82197->82198 82199 7ffc671001a3 82198->82199 82200 7ffc67106df0 _RunAllParam 2 API calls 82199->82200 82201 7ffc671001b7 82200->82201 82201->82183 82202->82185 82204 7ffc671055dc 82203->82204 82208 7ffc6710566c _RunAllParam 82203->82208 82205 7ffc67109ad0 _RunAllParam 2 API calls 82204->82205 82204->82208 82206 7ffc67105619 _RunAllParam 82205->82206 82207 7ffc67109ad0 _RunAllParam 2 API calls 82206->82207 82207->82208 82208->82194 82211 7ffc671226d0 82209->82211 82210 7ffc67109ad0 _RunAllParam 2 API calls 82210->82211 82211->82210 82212 7ffc671226ef RegEnumValueA 82211->82212 82215 7ffc67104310 82211->82215 82212->82211 82213 7ffc67122730 82212->82213 82213->82138 82216 7ffc6710434b 82215->82216 82217 7ffc67104385 82215->82217 82219 7ffc67106df0 _RunAllParam 2 API calls 82216->82219 82220 7ffc671043b9 _RunAllParam 82217->82220 82221 7ffc67106d80 LdrLoadDll FindNextFileW _RunAllParam 82217->82221 82219->82217 82220->82211 82221->82220 82223 7ffc6712283a 82222->82223 82224 7ffc6712282a 82222->82224 82223->82143 82224->82223 82225 7ffc67109ad0 _RunAllParam 2 API calls 82224->82225 82226 7ffc67122862 82225->82226 82227 7ffc67122887 82226->82227 82228 7ffc67122867 RegQueryValueExA 82226->82228 82229 7ffc6712288f 82227->82229 82230 7ffc67100280 2 API calls 82227->82230 82228->82227 82229->82143 82231 7ffc671228a6 82230->82231 82232 7ffc67109ad0 _RunAllParam 2 API calls 82231->82232 82233 7ffc671228b5 _RunAllParam 82232->82233 82234 7ffc671228ea 82233->82234 82235 7ffc671228cb RegQueryValueExA 82233->82235 82234->82143 82235->82234 82236->82144 82238 7ffc671075c1 82237->82238 82239 7ffc6710762c 82237->82239 82238->82239 82240 7ffc67109ad0 _RunAllParam 2 API calls 82238->82240 82239->82038 82242 7ffc671075db 82240->82242 82241 7ffc671075f0 82241->82038 82242->82241 82243 7ffc6710d730 _RunAllParam 2 API calls 82242->82243 82244 7ffc67107607 82243->82244 82244->82038 82246 7ffc671075b0 _RunAllParam 2 API calls 82245->82246 82247 7ffc6710777e 82246->82247 82248 7ffc6710779b 82247->82248 82249 7ffc67109ad0 _RunAllParam 2 API calls 82247->82249 82248->82028 82250 7ffc67107791 82249->82250 82250->82248 82251 7ffc67107796 NtClose 82250->82251 82251->82248 82253 7ffc6710923e _RunAllParam 82252->82253 82254 7ffc67109ad0 _RunAllParam 2 API calls 82253->82254 82255 7ffc67109270 _RunAllParam 82253->82255 82254->82255 82255->82106 82260 7ffc6711ec80 82256->82260 82257 7ffc67109ad0 _RunAllParam LdrLoadDll 82257->82260 82258 7ffc6711ece4 82258->82106 82259 7ffc6711ec94 FindNextFileW 82259->82260 82260->82257 82260->82258 82260->82259 82261 7ffc6710d730 _RunAllParam LdrLoadDll 82260->82261 82261->82260 82263 7ffc67109ad0 _RunAllParam 2 API calls 82262->82263 82264 7ffc6711ec58 82263->82264 82264->82116 82268 7ffc67108728 82265->82268 82266 7ffc67108796 _RunAllParam 82266->81928 82267 7ffc67125760 _RunAllParam 2 API calls 82267->82268 82268->82266 82268->82267 82270 7ffc671088a3 _RunAllParam 82268->82270 82269 7ffc67109ad0 _RunAllParam 2 API calls 82269->82266 82270->82266 82270->82269 82271 7ffc671070f0 82272 7ffc67107146 82271->82272 82273 7ffc67107110 82271->82273 82275 7ffc67109ad0 _RunAllParam 2 API calls 82272->82275 82274 7ffc67109ad0 _RunAllParam 2 API calls 82273->82274 82276 7ffc6710711f 82274->82276 82277 7ffc67107155 82275->82277 82276->82272 82278 7ffc67107128 RtlCreateHeap 82276->82278 82278->82272 82279 7ffc67107200 82280 7ffc6710725f 82279->82280 82281 7ffc67107215 82279->82281 82282 7ffc67107229 82281->82282 82284 7ffc67109ad0 _RunAllParam 2 API calls 82281->82284 82285 7ffc67107252 82282->82285 82286 7ffc67107190 82282->82286 82284->82282 82287 7ffc67107195 82286->82287 82288 7ffc671071ee 82286->82288 82287->82288 82289 7ffc67109ad0 _RunAllParam 2 API calls 82287->82289 82288->82285 82290 7ffc671071b5 82289->82290 82290->82288 82291 7ffc67109ad0 _RunAllParam 2 API calls 82290->82291 82292 7ffc671071db 82291->82292 82292->82288 82293 7ffc671071e0 RtlDeleteBoundaryDescriptor 82292->82293 82293->82288

                                                                                                                                          Executed Functions

                                                                                                                                          Function 00007FFC6710A2C0 Relevance: 5.0, APIs: 2, Instructions: 2002COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 9415309a58e3bb0cce1d0d6f8698424f4f4bce1af9acf6eed5649f75a2bafcac
                                                                                                                                          • Instruction ID: c78f56406c9c6561432bcf7cdc2e2f26f9ec8b994acfb5efb39312f479c7861d
                                                                                                                                          • Opcode Fuzzy Hash: 9415309a58e3bb0cce1d0d6f8698424f4f4bce1af9acf6eed5649f75a2bafcac
                                                                                                                                          • Instruction Fuzzy Hash: 0803E266A0C7AEC2EB249F12D4682B967A1FF45B88F444833CA4D07795EF3CE544E760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F59F0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 193COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 966 7ffc670f59f0-7ffc670f5a1a 967 7ffc670f5a51-7ffc670f5a7a call 7ffc67107db0 call 7ffc6711bbb0 966->967 968 7ffc670f5a1c-7ffc670f5a4c call 7ffc67101660 call 7ffc67121570 call 7ffc67107770 call 7ffc671223c0 966->968 977 7ffc670f5aba 967->977 978 7ffc670f5a7c-7ffc670f5a9a call 7ffc67101310 call 7ffc670dd1e0 967->978 968->967 981 7ffc670f5abc-7ffc670f5abf 977->981 991 7ffc670f5a9f-7ffc670f5ab2 call 7ffc67100cb0 978->991 984 7ffc670f5aca-7ffc670f5afa call 7ffc67121850 call 7ffc671075b0 981->984 985 7ffc670f5ac1-7ffc670f5ac5 call 7ffc67100e20 981->985 996 7ffc670f5b12-7ffc670f5b46 call 7ffc67121c30 call 7ffc67107db0 call 7ffc671220e0 call 7ffc67100e20 984->996 997 7ffc670f5afc-7ffc670f5b0f call 7ffc67121ac0 984->997 985->984 991->977 998 7ffc670f5ab4-7ffc670f5ab8 991->998 1009 7ffc670f5b48-7ffc670f5b53 call 7ffc671075b0 996->1009 1010 7ffc670f5b59-7ffc670f5b79 call 7ffc67101a90 call 7ffc67109ad0 996->1010 997->996 998->981 1009->1010 1015 7ffc670f5be0-7ffc670f5be3 1009->1015 1021 7ffc670f5b7b-7ffc670f5b8a 1010->1021 1022 7ffc670f5b8f-7ffc670f5bae call 7ffc670f2170 call 7ffc670e7eb0 1010->1022 1018 7ffc670f5c7b-7ffc670f5c8d call 7ffc67109ad0 1015->1018 1019 7ffc670f5be9-7ffc670f5c04 call 7ffc67121850 call 7ffc671075b0 1015->1019 1027 7ffc670f5c93-7ffc670f5cca call 7ffc671223c0 call 7ffc67103fd0 call 7ffc67100e20 1018->1027 1028 7ffc670f5c8f-7ffc670f5c91 ExitProcess 1018->1028 1035 7ffc670f5c06 1019->1035 1036 7ffc670f5c72-7ffc670f5c76 call 7ffc67121c30 1019->1036 1021->1022 1038 7ffc670f5bb0-7ffc670f5bcc call 7ffc6710f150 call 7ffc670e7eb0 1022->1038 1039 7ffc670f5bce-7ffc670f5bd2 call 7ffc670ffca0 1022->1039 1040 7ffc670f5c10-7ffc670f5c1d call 7ffc67121ac0 1035->1040 1036->1018 1038->1039 1049 7ffc670f5bd7-7ffc670f5bdb call 7ffc67100e20 1039->1049 1053 7ffc670f5c3b-7ffc670f5c6d call 7ffc67107db0 call 7ffc671220e0 call 7ffc671217b0 call 7ffc671223c0 call 7ffc67100e20 1040->1053 1054 7ffc670f5c1f-7ffc670f5c37 call 7ffc67121a70 call 7ffc6710f150 1040->1054 1049->1015 1053->1036 1054->1040 1065 7ffc670f5c39 1054->1065 1065->1036
                                                                                                                                          APIs
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CloseExitProcess
                                                                                                                                          • String ID: -R+
                                                                                                                                          • API String ID: 3487036407-215093852
                                                                                                                                          • Opcode ID: 861e373727f0bf5d6b131c94e4e6e9b6b0c96c54314d595459500fe5a7d22774
                                                                                                                                          • Instruction ID: 0bc01b030c3d127525b9bbaef63d67f3c16429dff6ef3f2e8a315d9e09d8e317
                                                                                                                                          • Opcode Fuzzy Hash: 861e373727f0bf5d6b131c94e4e6e9b6b0c96c54314d595459500fe5a7d22774
                                                                                                                                          • Instruction Fuzzy Hash: ED817F26B1C66AD5FB10EBB2C5652FD2365AF84348F814832DE0E579CADE2CE545C370
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6711ED10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 1071 7ffc6711ed10-7ffc6711ed37 call 7ffc6711ddc0 1074 7ffc6711ed3f-7ffc6711ed51 call 7ffc67109ad0 1071->1074 1075 7ffc6711ed39-7ffc6711ed3c 1071->1075 1078 7ffc6711ed53-7ffc6711ed76 FindFirstFileExW 1074->1078 1079 7ffc6711eda4-7ffc6711eda8 1074->1079 1075->1074 1082 7ffc6711ed9f-7ffc6711eda2 1078->1082 1083 7ffc6711ed78-7ffc6711ed7e 1078->1083 1080 7ffc6711edd1 1079->1080 1081 7ffc6711edaa-7ffc6711edb0 1079->1081 1084 7ffc6711edd8-7ffc6711ede2 1080->1084 1081->1080 1085 7ffc6711edb2-7ffc6711edb6 1081->1085 1082->1084 1083->1082 1086 7ffc6711ed80-7ffc6711ed84 1083->1086 1088 7ffc6711ee4d-7ffc6711ee58 call 7ffc6710d730 1084->1088 1089 7ffc6711ede4-7ffc6711ede8 1084->1089 1085->1080 1087 7ffc6711edb8-7ffc6711edca call 7ffc67109ad0 1085->1087 1086->1082 1090 7ffc6711ed86-7ffc6711ed98 call 7ffc67109ad0 1086->1090 1087->1080 1102 7ffc6711edcc 1087->1102 1103 7ffc6711ee61-7ffc6711ee72 1088->1103 1104 7ffc6711ee5a 1088->1104 1089->1088 1093 7ffc6711edea-7ffc6711edef 1089->1093 1090->1082 1107 7ffc6711ed9a 1090->1107 1097 7ffc6711ee1e-7ffc6711ee2c 1093->1097 1098 7ffc6711edf1-7ffc6711edf8 1093->1098 1100 7ffc6711ee2e-7ffc6711ee30 1097->1100 1101 7ffc6711ee32-7ffc6711ee35 1097->1101 1105 7ffc6711ee07-7ffc6711ee18 1098->1105 1106 7ffc6711edfa-7ffc6711edfe 1098->1106 1100->1101 1108 7ffc6711ee3b-7ffc6711ee4c 1100->1108 1101->1105 1109 7ffc6711ee37-7ffc6711ee39 1101->1109 1102->1080 1104->1103 1105->1097 1106->1097 1110 7ffc6711ee00-7ffc6711ee05 1106->1110 1107->1082 1109->1105 1109->1108 1110->1097 1110->1105
                                                                                                                                          APIs
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: FileFindFirst
                                                                                                                                          • String ID: .
                                                                                                                                          • API String ID: 1974802433-248832578
                                                                                                                                          • Opcode ID: 5588d055546eb8cf66efa63037f07df379a20e7f6d9627be0340d4208e6e69ea
                                                                                                                                          • Instruction ID: daf6856250c4f48e30f4f7e7ac2b7c69af0f1bd74807e2e3eeb4eaec37b02cd7
                                                                                                                                          • Opcode Fuzzy Hash: 5588d055546eb8cf66efa63037f07df379a20e7f6d9627be0340d4208e6e69ea
                                                                                                                                          • Instruction Fuzzy Hash: 7241F631A0D265C1EF644B62D1243792391EF44BA8F184A32CA6D1BBD8DF2DE986C320
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E7880 Relevance: 2.9, Strings: 2, Instructions: 383COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 1242 7ffc670e7880-7ffc670e78c5 1243 7ffc670e78c7-7ffc670e78ca 1242->1243 1244 7ffc670e78cf-7ffc670e790c call 7ffc6712d8a0 call 7ffc67114bc0 call 7ffc6712d3a0 1242->1244 1245 7ffc670e79b2-7ffc670e79b5 1243->1245 1265 7ffc670e7913-7ffc670e791d 1244->1265 1247 7ffc670e7be8-7ffc670e7bfa call 7ffc67123bb0 1245->1247 1248 7ffc670e79bb-7ffc670e79f4 call 7ffc67107de0 call 7ffc67121850 call 7ffc67100e20 call 7ffc67121ac0 1245->1248 1256 7ffc670e7c0c-7ffc670e7c1d 1247->1256 1257 7ffc670e7bfc-7ffc670e7c07 call 7ffc67121c30 call 7ffc671072a0 1247->1257 1278 7ffc670e79fa-7ffc670e7a05 call 7ffc671075b0 1248->1278 1279 7ffc670e7a83-7ffc670e7a91 call 7ffc67121c30 call 7ffc67123bb0 1248->1279 1257->1256 1266 7ffc670e791f 1265->1266 1267 7ffc670e795e-7ffc670e7969 1265->1267 1270 7ffc670e7920-7ffc670e7939 call 7ffc67123af0 call 7ffc6712d4d0 1266->1270 1267->1265 1271 7ffc670e796b-7ffc670e796f call 7ffc67123bb0 1267->1271 1292 7ffc670e793b-7ffc670e793f 1270->1292 1293 7ffc670e7943-7ffc670e795a call 7ffc67123c50 1270->1293 1277 7ffc670e7974-7ffc670e798b 1271->1277 1280 7ffc670e799d-7ffc670e79ab 1277->1280 1281 7ffc670e798d-7ffc670e7998 call 7ffc67121c30 call 7ffc671072a0 1277->1281 1290 7ffc670e7a14-7ffc670e7a1f call 7ffc671075b0 1278->1290 1291 7ffc670e7a07-7ffc670e7a0f call 7ffc6712cf10 1278->1291 1300 7ffc670e7a96-7ffc670e7a9e 1279->1300 1280->1245 1281->1280 1306 7ffc670e7a25-7ffc670e7a65 call 7ffc670cd690 call 7ffc67107db0 call 7ffc671220e0 call 7ffc67100e20 call 7ffc671075b0 1290->1306 1307 7ffc670e7bdf-7ffc670e7be3 call 7ffc67121c30 1290->1307 1291->1290 1292->1270 1298 7ffc670e7941 1292->1298 1293->1271 1302 7ffc670e795c 1293->1302 1298->1302 1304 7ffc670e7ab0-7ffc670e7ac1 1300->1304 1305 7ffc670e7aa0-7ffc670e7aab call 7ffc67121c30 call 7ffc671072a0 1300->1305 1302->1267 1305->1304 1322 7ffc670e7a67-7ffc670e7a7e call 7ffc671217b0 call 7ffc671223c0 call 7ffc670d36f0 1306->1322 1323 7ffc670e7ac2-7ffc670e7adb call 7ffc67100180 call 7ffc670ffcd0 1306->1323 1307->1247 1322->1279 1333 7ffc670e7b44-7ffc670e7b8e call 7ffc67100150 * 3 call 7ffc671220e0 call 7ffc670e5f40 1323->1333 1334 7ffc670e7add-7ffc670e7ae5 1323->1334 1361 7ffc670e7b94-7ffc670e7bc2 call 7ffc670e5e90 call 7ffc671223c0 call 7ffc670ffca0 * 3 1333->1361 1362 7ffc670e7c1e-7ffc670e7c2b call 7ffc6712d340 1333->1362 1334->1333 1336 7ffc670e7ae7-7ffc670e7af2 call 7ffc6712d340 1334->1336 1342 7ffc670e7b25-7ffc670e7b3f call 7ffc671002b0 1336->1342 1343 7ffc670e7af4-7ffc670e7b0c call 7ffc670ffcd0 1336->1343 1342->1333 1350 7ffc670e7bc7-7ffc670e7bda call 7ffc670ffca0 call 7ffc671223c0 call 7ffc670d36f0 1343->1350 1351 7ffc670e7b12-7ffc670e7b23 call 7ffc67100230 1343->1351 1350->1307 1351->1333 1361->1350 1369 7ffc670e7d15-7ffc670e7ded call 7ffc67106d10 call 7ffc670ffcc0 call 7ffc671090b0 call 7ffc67100bc0 call 7ffc67100e20 call 7ffc671006d0 call 7ffc67100280 call 7ffc670ffcb0 * 2 call 7ffc670f7fac call 7ffc670e5bb0 call 7ffc671002b0 call 7ffc670fbae0 1362->1369 1370 7ffc670e7c31-7ffc670e7d10 call 7ffc67106d10 call 7ffc670ffcc0 call 7ffc671090b0 call 7ffc67100bc0 call 7ffc67100e20 call 7ffc671006d0 call 7ffc67100280 call 7ffc670ffcb0 * 2 call 7ffc670f7fac call 7ffc670e6300 call 7ffc671002b0 call 7ffc670f9990 1362->1370 1428 7ffc670e7df2-7ffc670e7df7 1369->1428 1370->1428 1430 7ffc670e7df9-7ffc670e7e18 call 7ffc671215d0 1428->1430 1431 7ffc670e7e1b-7ffc670e7e81 call 7ffc670e5e90 call 7ffc671223c0 call 7ffc670ffca0 * 4 call 7ffc671223c0 call 7ffc670d36f0 call 7ffc67121c30 call 7ffc67123bb0 1428->1431 1430->1431 1454 7ffc670e7e93-7ffc670e7ea5 1431->1454 1455 7ffc670e7e83-7ffc670e7e8e call 7ffc67121c30 call 7ffc671072a0 1431->1455 1455->1454
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: )8GV$)8GV
                                                                                                                                          • API String ID: 0-993736920
                                                                                                                                          • Opcode ID: 061befe2941c03f03dbd409cc30a744c1902cebc942325edb7f29670219fe0a0
                                                                                                                                          • Instruction ID: e551a1038a0b7dc92577d3522c0671dbeaf1f1df1bd88cf90cafcf12714557a1
                                                                                                                                          • Opcode Fuzzy Hash: 061befe2941c03f03dbd409cc30a744c1902cebc942325edb7f29670219fe0a0
                                                                                                                                          • Instruction Fuzzy Hash: 95F17322A2C56AD5EB10EF72D4612FD6365EF94384F801832EA4D8769ADF3CD546C730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6711DDC0 Relevance: 2.4, APIs: 1, Instructions: 882COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: InfoSystem
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 31276548-0
                                                                                                                                          • Opcode ID: 5431e0cf82004956d4d9b66d8369a133d4c7d5605faf03c84d9b45e582fc3e19
                                                                                                                                          • Instruction ID: e1e2744c765ac1d2e5270ab3169ccf5505fa91137470748f6ccc94a6a02ac708
                                                                                                                                          • Opcode Fuzzy Hash: 5431e0cf82004956d4d9b66d8369a133d4c7d5605faf03c84d9b45e582fc3e19
                                                                                                                                          • Instruction Fuzzy Hash: 2482E462A0C7AAC6EB648B5294602B977A0FF45F85F444C37CA4D0BB95EF3CD654C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6710CA50 Relevance: 2.3, APIs: 1, Instructions: 784COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 275b5cfb1ed7da0fd965c210da93515670eebad8c799b5ec9897819ef378c5e7
                                                                                                                                          • Instruction ID: 391c30a6f5a6aa67b95649679ba6576edf73f979575dfece843ae0cef70d7b70
                                                                                                                                          • Opcode Fuzzy Hash: 275b5cfb1ed7da0fd965c210da93515670eebad8c799b5ec9897819ef378c5e7
                                                                                                                                          • Instruction Fuzzy Hash: 3C72CF62A0C7AAC5EB148F1294683F927A1FF45B88F945833CA8D07799DF3CE540E760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712D520 Relevance: 1.7, APIs: 1, Instructions: 237nativeCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 2025 7ffc6712d520-7ffc6712d577 call 7ffc67123e50 call 7ffc67123bb0 call 7ffc67100150 2032 7ffc6712d580-7ffc6712d599 call 7ffc67109ad0 2025->2032 2035 7ffc6712d5f5-7ffc6712d621 call 7ffc6711ddc0 call 7ffc670ffcb0 2032->2035 2036 7ffc6712d59b-7ffc6712d5c7 call 7ffc670ffcc0 call 7ffc670ffcb0 NtQuerySystemInformation 2032->2036 2045 7ffc6712d7d7-7ffc6712d7da 2035->2045 2046 7ffc6712d627 2035->2046 2047 7ffc6712d5d0-7ffc6712d5d9 2036->2047 2048 7ffc6712d5c9-7ffc6712d5ce 2036->2048 2050 7ffc6712d83f-7ffc6712d882 call 7ffc670ffca0 call 7ffc67123bb0 2045->2050 2051 7ffc6712d7dc-7ffc6712d7e4 2045->2051 2049 7ffc6712d630-7ffc6712d637 2046->2049 2052 7ffc6712d5e2-7ffc6712d5f3 call 7ffc670ffcc0 call 7ffc67100280 2047->2052 2053 7ffc6712d5db call 7ffc67100280 2047->2053 2048->2035 2048->2047 2055 7ffc6712d63d-7ffc6712d641 2049->2055 2056 7ffc6712d7c8-7ffc6712d7cc 2049->2056 2074 7ffc6712d894-7ffc6712d89d 2050->2074 2075 7ffc6712d884-7ffc6712d88f call 7ffc67121c30 call 7ffc671072a0 2050->2075 2051->2050 2057 7ffc6712d7e6 2051->2057 2052->2032 2065 7ffc6712d5e0 2053->2065 2055->2056 2063 7ffc6712d647-7ffc6712d670 call 7ffc67107360 2055->2063 2056->2045 2061 7ffc6712d7ce-7ffc6712d7d1 2056->2061 2064 7ffc6712d7f0-7ffc6712d803 call 7ffc67123af0 2057->2064 2061->2045 2061->2049 2076 7ffc6712d672-7ffc6712d684 call 7ffc67123af0 2063->2076 2077 7ffc6712d695-7ffc6712d69b 2063->2077 2078 7ffc6712d837-7ffc6712d83d 2064->2078 2079 7ffc6712d805-7ffc6712d80e 2064->2079 2065->2032 2075->2074 2091 7ffc6712d72a-7ffc6712d72d 2076->2091 2092 7ffc6712d68a-7ffc6712d68f 2076->2092 2081 7ffc6712d69d-7ffc6712d6a3 2077->2081 2082 7ffc6712d6a9-7ffc6712d6bc call 7ffc671072c0 2077->2082 2078->2050 2078->2064 2079->2078 2080 7ffc6712d810-7ffc6712d820 call 7ffc67123af0 2079->2080 2098 7ffc6712d822-7ffc6712d826 2080->2098 2099 7ffc6712d82a-7ffc6712d831 2080->2099 2081->2082 2087 7ffc6712d7c5 2081->2087 2100 7ffc6712d6c2-7ffc6712d728 call 7ffc67101a90 call 7ffc67101660 call 7ffc67100150 2082->2100 2101 7ffc6712d766 2082->2101 2087->2056 2095 7ffc6712d72f-7ffc6712d733 2091->2095 2096 7ffc6712d747-7ffc6712d74a 2091->2096 2092->2076 2097 7ffc6712d691 2092->2097 2102 7ffc6712d73d-7ffc6712d741 2095->2102 2103 7ffc6712d735-7ffc6712d738 call 7ffc6712d1e0 2095->2103 2105 7ffc6712d74e-7ffc6712d758 call 7ffc67123c50 2096->2105 2097->2077 2098->2080 2104 7ffc6712d828 2098->2104 2099->2078 2106 7ffc6712d833 2099->2106 2108 7ffc6712d769-7ffc6712d7c3 call 7ffc67105840 call 7ffc67102000 call 7ffc67100e20 call 7ffc67102340 call 7ffc671014d0 call 7ffc67100e20 2100->2108 2101->2108 2102->2096 2102->2097 2103->2102 2104->2078 2113 7ffc6712d75d-7ffc6712d764 2105->2113 2106->2078 2108->2105 2113->2056
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: InformationQuerySystem
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3562636166-0
                                                                                                                                          • Opcode ID: a86a9bd51dc2949cd05d03de92b4f4ab6bcf3bed1841e9c0a59ca0c779675c2d
                                                                                                                                          • Instruction ID: 9a5e857954b4feeee4f08983d38a76f9fd0217e54200d5ecd28978f74054b5dc
                                                                                                                                          • Opcode Fuzzy Hash: a86a9bd51dc2949cd05d03de92b4f4ab6bcf3bed1841e9c0a59ca0c779675c2d
                                                                                                                                          • Instruction Fuzzy Hash: 15B19C36A0C65ADAE750EF26D2612AE33B0FF44788F504836DA5D47B95DF38E464C720
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC671097D0 Relevance: 1.7, APIs: 1, Instructions: 185libraryloaderCOMMONLIBRARYCODE
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 2129 7ffc671097d0-7ffc671098ad call 7ffc67101a90 * 2 call 7ffc67109230 call 7ffc67102fa0 call 7ffc67100e20 call 7ffc67101ab0 call 7ffc67101b60 * 5 call 7ffc67102f50 call 7ffc6711ee80 2156 7ffc67109a7d-7ffc67109a8a call 7ffc67100e20 2129->2156 2157 7ffc671098b3-7ffc671098b9 2129->2157 2163 7ffc67109a8c-7ffc67109a93 2156->2163 2164 7ffc67109aa0-7ffc67109ab8 call 7ffc67100e20 * 2 2156->2164 2158 7ffc671098c0-7ffc671098f9 call 7ffc67102f50 call 7ffc671032a0 call 7ffc67106180 call 7ffc67100e20 2157->2158 2179 7ffc67109917-7ffc671099d2 call 7ffc67102f70 call 7ffc67101ab0 call 7ffc671011a0 call 7ffc67100150 call 7ffc670ffcb0 * 2 call 7ffc671011a0 call 7ffc671011d0 call 7ffc67109ad0 2158->2179 2180 7ffc671098fb-7ffc67109909 call 7ffc67100e20 call 7ffc6711ec70 2158->2180 2163->2164 2167 7ffc67109a95-7ffc67109a99 2163->2167 2177 7ffc67109aba-7ffc67109acd 2164->2177 2167->2164 2170 7ffc67109a9b call 7ffc6711ec40 2167->2170 2170->2164 2204 7ffc671099f2 2179->2204 2205 7ffc671099d4-7ffc671099f0 call 7ffc670ffcb0 LdrLoadDll 2179->2205 2187 7ffc6710990e-7ffc67109910 2180->2187 2187->2158 2189 7ffc67109912 2187->2189 2189->2156 2206 7ffc671099f5-7ffc671099fc 2204->2206 2205->2206 2208 7ffc671099fe-7ffc67109a00 2206->2208 2209 7ffc67109a5f-7ffc67109a78 call 7ffc670ffca0 call 7ffc67100e20 * 2 2206->2209 2208->2209 2211 7ffc67109a02-7ffc67109a2d call 7ffc670ffca0 call 7ffc67100e20 * 3 2208->2211 2209->2156 2225 7ffc67109a2f-7ffc67109a36 2211->2225 2226 7ffc67109a43-7ffc67109a5d call 7ffc67100e20 * 2 2211->2226 2225->2226 2228 7ffc67109a38-7ffc67109a3c 2225->2228 2226->2177 2228->2226 2230 7ffc67109a3e call 7ffc6711ec40 2228->2230 2230->2226
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: FileFindLoadNext
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 50669962-0
                                                                                                                                          • Opcode ID: 8ae045245011a34f88152a78bb84e1250efdef914e004368085cefc9dfb048a4
                                                                                                                                          • Instruction ID: 9e787faa0bceaf3dd038fc7c6bba84c78feb785c7cf1f997af0b5b8443798060
                                                                                                                                          • Opcode Fuzzy Hash: 8ae045245011a34f88152a78bb84e1250efdef914e004368085cefc9dfb048a4
                                                                                                                                          • Instruction Fuzzy Hash: A1819022A2C56AC5EA10EB62D4792FE6365FFC4744F804932EA4D17ACADF3CE505D720
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67109400 Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: NameUser
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 2645101109-0
                                                                                                                                          • Opcode ID: 61134290c5f0672a3f6bf35b943af87a7f429b15799ed0f7774ee38327f57094
                                                                                                                                          • Instruction ID: 4ed04fe3c232a77d106ef1f6eeafea0b8ba8b1b5eebf8b3c5c98a56db4f628cd
                                                                                                                                          • Opcode Fuzzy Hash: 61134290c5f0672a3f6bf35b943af87a7f429b15799ed0f7774ee38327f57094
                                                                                                                                          • Instruction Fuzzy Hash: 8E0175A1A1C55EC2EE10EB16E8751BE5321FFD4784F805833E98E4768BDE2CD115D7A0
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67107770 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMONLIBRARYCODE
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Close
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3535843008-0
                                                                                                                                          • Opcode ID: 860ba978492d36cdfe31f6537ec1931d4b76ea568ca190dfd252f9a33af48d82
                                                                                                                                          • Instruction ID: d2315f2b09073cab8a7b48e2db21e56e70bd14cd73f25228fe0c6df8c9263fa5
                                                                                                                                          • Opcode Fuzzy Hash: 860ba978492d36cdfe31f6537ec1931d4b76ea568ca190dfd252f9a33af48d82
                                                                                                                                          • Instruction Fuzzy Hash: 69D05E51A1D619C2FE2467A3A16D3B402909FD9744F084833CE8E0A3C7EE2C9891D332
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F5020 Relevance: 1.4, Strings: 1, Instructions: 170COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: -R+
                                                                                                                                          • API String ID: 0-215093852
                                                                                                                                          • Opcode ID: 757887669241c1ad3ea049100046a135482c7929ff5ed67d69c536cca754f35d
                                                                                                                                          • Instruction ID: cfd2632594f3b14d0885ed29eabad587f2242df14e5f678503668899f2f13ee1
                                                                                                                                          • Opcode Fuzzy Hash: 757887669241c1ad3ea049100046a135482c7929ff5ed67d69c536cca754f35d
                                                                                                                                          • Instruction Fuzzy Hash: A9718026B0C669C5FB10EB62E4642EE63A1FF84344F944836EE4D47A8ADF3CE445D720
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67113150 Relevance: .8, Instructions: 817COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: fd6ed765f5991ce6959c534cf14e9b84c91dc21dbee004d70060983254845f38
                                                                                                                                          • Instruction ID: d36a84fac0664f6c7ea9295053ee93fa180d5aa26e9f18f8e7904d6885240924
                                                                                                                                          • Opcode Fuzzy Hash: fd6ed765f5991ce6959c534cf14e9b84c91dc21dbee004d70060983254845f38
                                                                                                                                          • Instruction Fuzzy Hash: D172B262A0D7A9C5FA248B26D4603B927A1FF45F84F445833CA4E0BB99EF3CD546C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670FAA70 Relevance: .5, Instructions: 521COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: b52c0054d56aefd0f3e1567eddfd226f434cc3305f3d4ff0dfe5c57373c99d56
                                                                                                                                          • Instruction ID: 3930091d18e4b5c7b80d59364576c51df122a6521e4282c8fab08d426c491044
                                                                                                                                          • Opcode Fuzzy Hash: b52c0054d56aefd0f3e1567eddfd226f434cc3305f3d4ff0dfe5c57373c99d56
                                                                                                                                          • Instruction Fuzzy Hash: 0B22BF26A0C56AC6EA20EF22D2612BD6355BF84744F504936DE0E877D6EF3CE509C7B0
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67127650 Relevance: .2, Instructions: 183COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: e671008534e80604538bd923785f75ee5c173f21ecf6df136e96451e37028845
                                                                                                                                          • Instruction ID: 6261c5683c2b7ad42f8bc950de7bbb287c8f893c58f2face29e74a7d7b95ec00
                                                                                                                                          • Opcode Fuzzy Hash: e671008534e80604538bd923785f75ee5c173f21ecf6df136e96451e37028845
                                                                                                                                          • Instruction Fuzzy Hash: 4E61B531B1D26AC2FA54A623553557B51A1EF843A4F180A37EF7E427C5EF3CE441CA20
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F76E0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 217COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 0 7ffc670f76e0-7ffc670f7703 call 7ffc671084e0 3 7ffc670f7705-7ffc670f770a 0->3 4 7ffc670f7762-7ffc670f7795 call 7ffc671084f0 call 7ffc670f53a0 call 7ffc67101660 call 7ffc67109ad0 0->4 5 7ffc670f7753-7ffc670f7760 call 7ffc671086f0 3->5 6 7ffc670f770c-7ffc670f770f 3->6 25 7ffc670f7797-7ffc670f77a1 4->25 26 7ffc670f77a5-7ffc670f77b5 call 7ffc670f5020 4->26 5->4 8 7ffc670f7711-7ffc670f772c call 7ffc671084f0 5->8 6->8 9 7ffc670f772d-7ffc670f7752 call 7ffc670f4b50 call 7ffc671084f0 6->9 25->26 29 7ffc670f77b7-7ffc670f77ca call 7ffc67114530 26->29 30 7ffc670f77e2-7ffc670f77f4 26->30 29->30 42 7ffc670f77cc-7ffc670f77d6 29->42 31 7ffc670f784b-7ffc670f785d call 7ffc67109ad0 30->31 32 7ffc670f77f6-7ffc670f77f9 30->32 43 7ffc670f785f-7ffc670f7864 31->43 44 7ffc670f786d-7ffc670f7877 call 7ffc6711ddc0 31->44 34 7ffc670f77fb-7ffc670f780d call 7ffc67109ad0 32->34 35 7ffc670f7811-7ffc670f7814 32->35 34->35 50 7ffc670f780f FreeConsole 34->50 40 7ffc670f7816-7ffc670f7842 call 7ffc670f5cd0 call 7ffc67100e20 35->40 41 7ffc670f7843-7ffc670f7845 call 7ffc670f59f0 35->41 52 7ffc670f784a 41->52 42->30 48 7ffc670f77d8-7ffc670f77df 42->48 43->44 55 7ffc670f7879-7ffc670f7881 call 7ffc670f76e0 44->55 56 7ffc670f7886-7ffc670f78c8 call 7ffc670f1260 call 7ffc67106920 call 7ffc67100e20 call 7ffc67109ad0 44->56 48->30 50->35 52->31 55->56 67 7ffc670f78ca-7ffc670f78d6 call 7ffc67101310 56->67 68 7ffc670f78db-7ffc670f78f0 call 7ffc67109ad0 56->68 67->68 73 7ffc670f7906-7ffc670f791b call 7ffc67109ad0 68->73 74 7ffc670f78f2-7ffc670f7901 call 7ffc67101310 68->74 79 7ffc670f7931-7ffc670f7973 call 7ffc67102a60 call 7ffc67102000 call 7ffc67100e20 call 7ffc67100f10 73->79 80 7ffc670f791d-7ffc670f792c call 7ffc67101310 73->80 74->73 91 7ffc670f7975-7ffc670f797a 79->91 92 7ffc670f797e-7ffc670f79cc call 7ffc67100f40 call 7ffc67102340 call 7ffc671014d0 call 7ffc67100e20 79->92 80->79 91->92 101 7ffc670f7ae7-7ffc670f7af9 call 7ffc67109ad0 92->101 102 7ffc670f79d2-7ffc670f79e3 92->102 105 7ffc670f7afb-7ffc670f7b00 101->105 106 7ffc670f7b09-7ffc670f7b33 call 7ffc67103fd0 call 7ffc67100e20 101->106 102->101 105->106
                                                                                                                                          APIs
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ConsoleFree
                                                                                                                                          • String ID: )8GV$UsS$UsS$d
                                                                                                                                          • API String ID: 771614528-2529742583
                                                                                                                                          • Opcode ID: fe77994c02c4c18a5344a767264b09122eac9de7f449874fa6967c2ee9c58cdd
                                                                                                                                          • Instruction ID: 5666e4b1029d1c5707ca211272cee02bcbfc713ee7008d18883d2bca0ed3c8ef
                                                                                                                                          • Opcode Fuzzy Hash: fe77994c02c4c18a5344a767264b09122eac9de7f449874fa6967c2ee9c58cdd
                                                                                                                                          • Instruction Fuzzy Hash: F191E621B1C66AC2EA54EB22E1751BE5351FF84780F944936EE5E877C6DE2CD801C371
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67122E60 Relevance: 6.3, APIs: 4, Instructions: 289registryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 111 7ffc67122e60-7ffc67122e89 112 7ffc67122e95 111->112 113 7ffc67122e8b-7ffc67122e93 111->113 114 7ffc67122e9a-7ffc67122ec3 call 7ffc67101a90 112->114 113->112 113->114 117 7ffc67122ec5 114->117 118 7ffc67122ec8-7ffc67122eda call 7ffc67109ad0 114->118 117->118 121 7ffc6712312e 118->121 122 7ffc67122ee0-7ffc67122ef0 118->122 123 7ffc67123131-7ffc67123145 call 7ffc6710d730 call 7ffc67100e20 121->123 122->123 127 7ffc67122ef6-7ffc67122efa 122->127 132 7ffc67123147-7ffc6712314b 123->132 133 7ffc67123166-7ffc67123175 123->133 127->123 129 7ffc67122f00-7ffc67122f21 call 7ffc670ffcc0 127->129 136 7ffc671230b5-7ffc671230c1 129->136 137 7ffc67122f27-7ffc67122f2c 129->137 132->133 135 7ffc6712314d-7ffc6712315f call 7ffc67109ad0 132->135 138 7ffc67123181-7ffc67123199 call 7ffc670ffcb0 133->138 139 7ffc67123177-7ffc6712317b 133->139 135->133 152 7ffc67123161 135->152 144 7ffc671230f3-7ffc6712310d call 7ffc67100e20 136->144 145 7ffc671230c3-7ffc671230ca 136->145 141 7ffc67122f30-7ffc67122f3a 137->141 142 7ffc671232b9-7ffc671232d0 138->142 156 7ffc6712319f-7ffc671231ad 138->156 139->138 139->142 147 7ffc67122f3c-7ffc67122f40 141->147 148 7ffc67122f5f-7ffc67122f88 call 7ffc670ffcb0 141->148 144->133 160 7ffc6712310f-7ffc67123113 144->160 145->144 151 7ffc671230cc-7ffc671230d0 145->151 147->148 153 7ffc67122f42-7ffc67122f54 call 7ffc67109ad0 147->153 169 7ffc67122f90-7ffc67122fa2 call 7ffc67109ad0 148->169 151->144 157 7ffc671230d2-7ffc671230e4 call 7ffc67109ad0 151->157 158 7ffc67123164 RegCloseKey 152->158 173 7ffc67122f56-7ffc67122f59 RegCloseKey 153->173 174 7ffc67122f5b 153->174 162 7ffc671231af-7ffc671231b5 156->162 163 7ffc671231bb-7ffc671231cc call 7ffc670ffcc0 156->163 171 7ffc671230e6 157->171 172 7ffc671230eb 157->172 158->133 160->133 168 7ffc67123115-7ffc67123127 call 7ffc67109ad0 160->168 162->142 162->163 178 7ffc671231ce 163->178 179 7ffc671231f8-7ffc67123203 call 7ffc6711ddc0 163->179 168->133 185 7ffc67123129-7ffc6712312c 168->185 181 7ffc67122fc0-7ffc67122fea call 7ffc67103300 call 7ffc67106180 call 7ffc67100e20 169->181 182 7ffc67122fa4-7ffc67122fba RegEnumKeyW 169->182 171->172 172->144 173->174 174->148 183 7ffc671231d0-7ffc671231e5 call 7ffc670ffcb0 178->183 179->142 192 7ffc67123209-7ffc67123234 call 7ffc67100180 call 7ffc670ffcc0 call 7ffc67100280 179->192 205 7ffc67122fec-7ffc67122ff3 181->205 206 7ffc67122ff5-7ffc67123011 call 7ffc67109ad0 181->206 182->181 186 7ffc671230b2 182->186 194 7ffc671231ef-7ffc671231f2 183->194 195 7ffc671231e7-7ffc671231eb 183->195 185->158 186->136 209 7ffc67123236-7ffc67123263 call 7ffc670ffcb0 * 2 call 7ffc67106d80 192->209 210 7ffc67123268-7ffc671232b8 call 7ffc670ffcb0 call 7ffc67122e60 call 7ffc670ffca0 192->210 194->142 194->179 195->183 198 7ffc671231ed 195->198 198->179 205->169 214 7ffc6712303f 206->214 215 7ffc67123013-7ffc6712303d RegOpenKeyExW 206->215 209->210 218 7ffc67123041-7ffc67123059 call 7ffc67101180 214->218 215->218 225 7ffc67123071-7ffc6712308d call 7ffc67101ab0 218->225 226 7ffc6712305b-7ffc6712306c call 7ffc67101b60 218->226 225->136 233 7ffc6712308f-7ffc67123093 225->233 226->225 233->136 234 7ffc67123095-7ffc671230aa 233->234 234->141 235 7ffc671230b0 234->235 235->136
                                                                                                                                          APIs
                                                                                                                                          • RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00007FFC67122F59
                                                                                                                                          • RegEnumKeyW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00007FFC67122FB4
                                                                                                                                          • RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00007FFC67123039
                                                                                                                                          • RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002,?), ref: 00007FFC67123164
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Close$EnumOpen
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 138425441-0
                                                                                                                                          • Opcode ID: 9040a30d361a83406cf626564ceae3e4d7b26da50e6fb5ff6255cba964b20aea
                                                                                                                                          • Instruction ID: 17f2deafbfc04828739bba9b4cd114bcc09292585fa60eb428579f186d443f26
                                                                                                                                          • Opcode Fuzzy Hash: 9040a30d361a83406cf626564ceae3e4d7b26da50e6fb5ff6255cba964b20aea
                                                                                                                                          • Instruction Fuzzy Hash: 07C1A831B0D669C2EE649B66E46037D6361EFC5750F044A32EE6D477C5DE2CE846CB20
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 0000016B476E2264 Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280677728.0000016B476E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000016B476E0000, based on PE: true
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_16b476e0000_loaddll64.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ProtectVirtual$NodeRemove
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3879549435-0
                                                                                                                                          • Opcode ID: 998c333fcbc94d6503e1fd2d6b22b9b8446f434769f01d9b0eba9ba6cd5b82e5
                                                                                                                                          • Instruction ID: 3df77a88728f1cd9725476dce1071c58039c14a2edb71566679ec826ba88cf92
                                                                                                                                          • Opcode Fuzzy Hash: 998c333fcbc94d6503e1fd2d6b22b9b8446f434769f01d9b0eba9ba6cd5b82e5
                                                                                                                                          • Instruction Fuzzy Hash: 7EB14676618BC586D7708B1AE4407EAB7A1F7C9B80F108026DE8D97B59DF7AC891CF40
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6711F550 Relevance: 3.1, APIs: 2, Instructions: 141COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 1111 7ffc6711f550-7ffc6711f585 call 7ffc67103360 1114 7ffc6711f587-7ffc6711f5a4 call 7ffc67106bf0 call 7ffc67102fa0 call 7ffc67100e20 1111->1114 1115 7ffc6711f5a9-7ffc6711f5ab 1111->1115 1114->1115 1116 7ffc6711f5ad-7ffc6711f5b2 1115->1116 1117 7ffc6711f5cc-7ffc6711f5de call 7ffc67109ad0 1115->1117 1120 7ffc6711f5b4-7ffc6711f5b7 1116->1120 1121 7ffc6711f5c7 1116->1121 1128 7ffc6711f5ff 1117->1128 1129 7ffc6711f5e0-7ffc6711f5ee 1117->1129 1124 7ffc6711f5c0-7ffc6711f5c5 1120->1124 1125 7ffc6711f5b9-7ffc6711f5be 1120->1125 1121->1117 1124->1117 1125->1117 1131 7ffc6711f602-7ffc6711f610 1128->1131 1135 7ffc6711f5f0-7ffc6711f5f7 call 7ffc6710d730 1129->1135 1136 7ffc6711f5f9-7ffc6711f5fd 1129->1136 1132 7ffc6711f672-7ffc6711f67f 1131->1132 1133 7ffc6711f612-7ffc6711f624 1131->1133 1137 7ffc6711f691 1132->1137 1138 7ffc6711f681-7ffc6711f683 1132->1138 1133->1132 1135->1128 1135->1136 1136->1131 1142 7ffc6711f697-7ffc6711f6ad call 7ffc67109ad0 1137->1142 1140 7ffc6711f685-7ffc6711f687 1138->1140 1141 7ffc6711f689-7ffc6711f68f 1138->1141 1140->1142 1141->1142 1146 7ffc6711f6af-7ffc6711f6d1 CreateFileW 1142->1146 1147 7ffc6711f6d3 1142->1147 1148 7ffc6711f6d5-7ffc6711f6ef call 7ffc671077b0 call 7ffc671075b0 1146->1148 1147->1148 1153 7ffc6711f6f1-7ffc6711f6f9 call 7ffc6710d730 1148->1153 1154 7ffc6711f6fb-7ffc6711f702 1148->1154 1161 7ffc6711f75c-7ffc6711f77b 1153->1161 1156 7ffc6711f725-7ffc6711f749 call 7ffc67106d10 call 7ffc67109ad0 1154->1156 1157 7ffc6711f704-7ffc6711f716 call 7ffc67109ad0 1154->1157 1156->1161 1168 7ffc6711f74b-7ffc6711f75a SetFileTime 1156->1168 1157->1156 1166 7ffc6711f718-7ffc6711f721 1157->1166 1166->1156 1168->1161
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: aec0a7225e8e6c00049340723db4e1e7198fb52ab2bc5e590aae07ecbfda9d15
                                                                                                                                          • Instruction ID: ebddfab639dfa32e7a1e5b0fe1cdd0fa17d2988cd0fbadf6a6b926681fe21738
                                                                                                                                          • Opcode Fuzzy Hash: aec0a7225e8e6c00049340723db4e1e7198fb52ab2bc5e590aae07ecbfda9d15
                                                                                                                                          • Instruction Fuzzy Hash: 56512921B0D6AAC2F6649B23A4343BA2265FF84784F144937DAAE0B7C5DE3DD441DB20
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6711F7A0 Relevance: 3.1, APIs: 2, Instructions: 115fileCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: File$PointerRead
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3154509469-0
                                                                                                                                          • Opcode ID: db028594bc8b5677cbc4ad6c23936fd200019b0bac19abf828ee229ab7d43dc6
                                                                                                                                          • Instruction ID: a2d2bca99f1db04458628e36d8234714a147bffbd16d1f40bda1424cb3871bbe
                                                                                                                                          • Opcode Fuzzy Hash: db028594bc8b5677cbc4ad6c23936fd200019b0bac19abf828ee229ab7d43dc6
                                                                                                                                          • Instruction Fuzzy Hash: 1F41A521F1D6A9C3EA50AB26A06117E6399EF84784F140536EA9E4BBD5DF3CD402CF60
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67122810 Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          • RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFC6710961D), ref: 00007FFC67122885
                                                                                                                                          • RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFC6710961D), ref: 00007FFC671228E8
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: QueryValue
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3660427363-0
                                                                                                                                          • Opcode ID: 505d3e8216d65752d9c9970fe8de9b0105d3b943a84e5339b5d033298b12e6c9
                                                                                                                                          • Instruction ID: 456c83149d5d6734ef7f60e65f37fe2f4bc60ece843003f8ef6c619278681f33
                                                                                                                                          • Opcode Fuzzy Hash: 505d3e8216d65752d9c9970fe8de9b0105d3b943a84e5339b5d033298b12e6c9
                                                                                                                                          • Instruction Fuzzy Hash: 0B21D637B1E66982EA10DB56A42112EA3A1EF847A4F084536EE9C47BD8DF7CD481CB10
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67121850 Relevance: 1.6, APIs: 1, Instructions: 144synchronizationCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 2234 7ffc67121850-7ffc6712189e call 7ffc671216b0 call 7ffc67100ee0 2239 7ffc671218ec-7ffc671218fe call 7ffc67109ad0 2234->2239 2240 7ffc671218a0 2234->2240 2249 7ffc67121910 2239->2249 2250 7ffc67121900-7ffc6712190e 2239->2250 2241 7ffc671218a8-7ffc671218ac 2240->2241 2243 7ffc67121a31-7ffc67121a34 2241->2243 2244 7ffc671218b2-7ffc671218bd call 7ffc67100ee0 2241->2244 2247 7ffc67121a41 2243->2247 2248 7ffc67121a36-7ffc67121a3c call 7ffc671077b0 2243->2248 2256 7ffc6712197c-7ffc67121998 call 7ffc67121490 call 7ffc67109ad0 2244->2256 2257 7ffc671218c3-7ffc671218d5 call 7ffc67109ad0 2244->2257 2254 7ffc67121a44-7ffc67121a60 2247->2254 2248->2247 2251 7ffc67121913-7ffc6712191d call 7ffc6710d730 2249->2251 2250->2251 2251->2241 2263 7ffc6712191f-7ffc67121922 2251->2263 2270 7ffc671219b5 2256->2270 2271 7ffc6712199a-7ffc671219b3 CreateMutexA 2256->2271 2257->2247 2267 7ffc671218db-7ffc671218e7 2257->2267 2263->2243 2266 7ffc67121928 2263->2266 2269 7ffc67121930-7ffc67121949 call 7ffc67109ad0 2266->2269 2267->2243 2277 7ffc67121962-7ffc67121972 call 7ffc6710d730 2269->2277 2278 7ffc6712194b-7ffc6712195c 2269->2278 2274 7ffc671219b8-7ffc671219c2 call 7ffc6710d730 2270->2274 2271->2274 2281 7ffc67121a0f-7ffc67121a14 2274->2281 2282 7ffc671219c4-7ffc671219cf call 7ffc67100ee0 2274->2282 2277->2269 2287 7ffc67121974-7ffc67121977 2277->2287 2278->2248 2278->2277 2281->2243 2285 7ffc67121a16-7ffc67121a28 call 7ffc67109ad0 2281->2285 2282->2281 2291 7ffc671219d1-7ffc671219e3 call 7ffc67109ad0 2282->2291 2285->2243 2292 7ffc67121a2a 2285->2292 2287->2254 2295 7ffc67121a0d 2291->2295 2296 7ffc671219e5-7ffc67121a02 2291->2296 2292->2243 2295->2281 2297 7ffc67121a09-7ffc67121a0b 2296->2297 2297->2281
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CreateMutex
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 1964310414-0
                                                                                                                                          • Opcode ID: 2cf95efc385c725b9022cf8212db04d77c482d4e4406951c86c10693420f5340
                                                                                                                                          • Instruction ID: 69b3c109f16f0cc5d5709a9479b5e565b80d2b9a5a2cfdb242d2969dad9385d0
                                                                                                                                          • Opcode Fuzzy Hash: 2cf95efc385c725b9022cf8212db04d77c482d4e4406951c86c10693420f5340
                                                                                                                                          • Instruction Fuzzy Hash: BB51CD32A0D3A5C6EB94EB2250352BD2261EF84B84F580836EE9D07785DF3DD981D760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67121490 Relevance: 1.6, APIs: 1, Instructions: 57COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FFC671214EB
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: DescriptorSecurity$ConvertString
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3907675253-0
                                                                                                                                          • Opcode ID: 2eccd0c63b57d71c448d16ee564a8a11a0e937c987636d1f9c740f04a7ca8c8e
                                                                                                                                          • Instruction ID: f061e0582c38a4cef2ed241a95240ac0e5f974d12b7430faa73e6a2dbff61de4
                                                                                                                                          • Opcode Fuzzy Hash: 2eccd0c63b57d71c448d16ee564a8a11a0e937c987636d1f9c740f04a7ca8c8e
                                                                                                                                          • Instruction Fuzzy Hash: E821833670CB5AC2EA10EF5AA1640A973B0FF89784F944436DB9D07B45EF78E511CB50
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6711F629 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          • CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC6711F9E1), ref: 00007FFC6711F6CC
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CreateFile
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 823142352-0
                                                                                                                                          • Opcode ID: 9933a6296932c9aaeac43b8e72c576d6d43d9e66245f160a84ba2bfbc0e42396
                                                                                                                                          • Instruction ID: 71c5517bebf96a4f4d620ead332a71bfea0dd4ccca4f7b16b38fd6af7bb5c086
                                                                                                                                          • Opcode Fuzzy Hash: 9933a6296932c9aaeac43b8e72c576d6d43d9e66245f160a84ba2bfbc0e42396
                                                                                                                                          • Instruction Fuzzy Hash: 9A11E722A0D66AC2E6709B12A0243BB6394FF44784F580937DBAE0B791DF3DE441DB60
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6711F642 Relevance: 1.6, APIs: 1, Instructions: 51filetimeCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          • CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC6711F9E1), ref: 00007FFC6711F6CC
                                                                                                                                          • SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC6711F9E1), ref: 00007FFC6711F75A
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: File$CreateTime
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 1043708186-0
                                                                                                                                          • Opcode ID: ab920c4048ecd73485d9a24abe9911eec550e0ad73fe64493c44082e69fe9c96
                                                                                                                                          • Instruction ID: 0a12c22122c171aa0244ab060d558932ebdd2d787245e2a4df539d15c2f15a50
                                                                                                                                          • Opcode Fuzzy Hash: ab920c4048ecd73485d9a24abe9911eec550e0ad73fe64493c44082e69fe9c96
                                                                                                                                          • Instruction Fuzzy Hash: 4911C62260D66AC6E6609B1260243BA6395FF84784F580937DBDE0B791DF3CD441DB60
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6711EC70 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMONLIBRARYCODE
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 2352 7ffc6711ec70-7ffc6711ec7e 2353 7ffc6711ec80-7ffc6711ec92 call 7ffc67109ad0 2352->2353 2356 7ffc6711ecf1 2353->2356 2357 7ffc6711ec94-7ffc6711ec9f FindNextFileW 2353->2357 2360 7ffc6711ecf6-7ffc6711ed05 2356->2360 2358 7ffc6711eca1-7ffc6711eca8 call 7ffc6710d730 2357->2358 2359 7ffc6711ecaa-7ffc6711ecaf 2357->2359 2358->2359 2358->2360 2362 7ffc6711ecb1-7ffc6711ecb8 2359->2362 2363 7ffc6711ecc7-7ffc6711ecd5 2359->2363 2362->2353 2365 7ffc6711ecba-7ffc6711ecbe 2362->2365 2366 7ffc6711ecd7-7ffc6711ecd9 2363->2366 2367 7ffc6711ecdb-7ffc6711ecde 2363->2367 2365->2363 2368 7ffc6711ecc0-7ffc6711ecc5 2365->2368 2366->2367 2369 7ffc6711ece4-7ffc6711ecf0 2366->2369 2367->2353 2370 7ffc6711ece0-7ffc6711ece2 2367->2370 2368->2353 2368->2363 2370->2353 2370->2369
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: FileFindNext
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 2029273394-0
                                                                                                                                          • Opcode ID: 26ebda7149b16bce636ef64988408f2f4fd758443eccbcd7e202da9d4eacb6a9
                                                                                                                                          • Instruction ID: 56e2db17ffddd385ee355572dd9702f3e610bd673300856617fc73fb7469345b
                                                                                                                                          • Opcode Fuzzy Hash: 26ebda7149b16bce636ef64988408f2f4fd758443eccbcd7e202da9d4eacb6a9
                                                                                                                                          • Instruction Fuzzy Hash: 7511C621A2C26AC2FB644BA6952177913D1DF50789F041832DE4C4B6C5DF2CEA99C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6711F658 Relevance: 1.6, APIs: 1, Instructions: 50filetimeCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          • CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC6711F9E1), ref: 00007FFC6711F6CC
                                                                                                                                          • SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC6711F9E1), ref: 00007FFC6711F75A
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: File$CreateTime
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 1043708186-0
                                                                                                                                          • Opcode ID: e80f8483cf94c30f6301f3d3c985100ccdfca77954115487aecc5a17041d3c9f
                                                                                                                                          • Instruction ID: 493b0d88328c52f392fa653fae8f466e9db585727ea1320e62ef08666aec3be9
                                                                                                                                          • Opcode Fuzzy Hash: e80f8483cf94c30f6301f3d3c985100ccdfca77954115487aecc5a17041d3c9f
                                                                                                                                          • Instruction Fuzzy Hash: 4511E022A0D6AAC2E6709B1260243FA2394FF84780F180937DBAE0B790DF3CD441DB60
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6711F668 Relevance: 1.5, APIs: 1, Instructions: 47filetimeCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          • CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC6711F9E1), ref: 00007FFC6711F6CC
                                                                                                                                          • SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC6711F9E1), ref: 00007FFC6711F75A
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: File$CreateTime
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 1043708186-0
                                                                                                                                          • Opcode ID: 6e284fec9c092ab559da79d84b2b54fba405a3312493b2d376a7f6576a005246
                                                                                                                                          • Instruction ID: 6b2b77d80570fac13ad2bc04f73218479962fcb15e979423cdd825bc2a2a7bdc
                                                                                                                                          • Opcode Fuzzy Hash: 6e284fec9c092ab559da79d84b2b54fba405a3312493b2d376a7f6576a005246
                                                                                                                                          • Instruction Fuzzy Hash: 5D01A522A0D6AAC2E6709B12B0243BA6354FF84784F580937DB9E0B791DF3CD441DB60
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC671226A0 Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: EnumValue
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 2814608202-0
                                                                                                                                          • Opcode ID: af68b27f32d806152594ea98ebc8f2426a04b51a09888dca3b9f639ab6fe49d2
                                                                                                                                          • Instruction ID: 5668e3d75a2cd46fb618cca09badb813bdaffb4d24fec8b2e199cc41921c7ac7
                                                                                                                                          • Opcode Fuzzy Hash: af68b27f32d806152594ea98ebc8f2426a04b51a09888dca3b9f639ab6fe49d2
                                                                                                                                          • Instruction Fuzzy Hash: 59114F7660CB85C6D6209F02F45019AB7A4FB88B80F698526EF9D03B04DF38D591CB04
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC671070F0 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CreateHeap
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 10892065-0
                                                                                                                                          • Opcode ID: 7e47ca28742369fe6618816808a4c8b1d75f0f49f581dd722c821a23b829cda3
                                                                                                                                          • Instruction ID: d46c35bca76d3d9b640076a98c9a19b6a8855c95a10b86f20a1853828b930cb3
                                                                                                                                          • Opcode Fuzzy Hash: 7e47ca28742369fe6618816808a4c8b1d75f0f49f581dd722c821a23b829cda3
                                                                                                                                          • Instruction Fuzzy Hash: FB01F261A0CA69C2FA548B12F93466563A0FF89BC4F088836DACC0A795EE3CD420C710
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC671094A0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ComputerName
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3545744682-0
                                                                                                                                          • Opcode ID: 493c924839c8f486efe9302bf07efba55ae8e24e31a758d15e6e508aa6b42a41
                                                                                                                                          • Instruction ID: a94b1dd4c3dd42c6aed8a2fa1bdbe26a2b4b6b262399d2e264e00402d1e2fed2
                                                                                                                                          • Opcode Fuzzy Hash: 493c924839c8f486efe9302bf07efba55ae8e24e31a758d15e6e508aa6b42a41
                                                                                                                                          • Instruction Fuzzy Hash: 4E0171A1A2C56EC2EE10EB17E8791BA5321FFD8784F405833E98E4768BDE2CD115D760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67107190 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: BoundaryDeleteDescriptor
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3203483114-0
                                                                                                                                          • Opcode ID: 4cc1cfa08cb3aa26b208f28932105458a4a2f75863f8a1a8a56e0b8e89d82dcb
                                                                                                                                          • Instruction ID: 4a78a38863c437d914e34cfeb6b49a89ca47a7e84444b3898e8ee76d879d2d41
                                                                                                                                          • Opcode Fuzzy Hash: 4cc1cfa08cb3aa26b208f28932105458a4a2f75863f8a1a8a56e0b8e89d82dcb
                                                                                                                                          • Instruction Fuzzy Hash: 39F03440E0E26A82FE68A3A3583827101825F89740F1C8C37C85E4A3C6EE2CEA51E221
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 0000016B476E2060 Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          • VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000016B476E29A2), ref: 0000016B476E20B0
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280677728.0000016B476E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000016B476E0000, based on PE: true
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_16b476e0000_loaddll64.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: AllocVirtual
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 4275171209-0
                                                                                                                                          • Opcode ID: efef561593cea6ec73f14c0a970d655c71aa6a4b298494007811926080961454
                                                                                                                                          • Instruction ID: 81247a2d3b84d932a238603f52e13dca24148583c201f72aa6798e3078c68cd2
                                                                                                                                          • Opcode Fuzzy Hash: efef561593cea6ec73f14c0a970d655c71aa6a4b298494007811926080961454
                                                                                                                                          • Instruction Fuzzy Hash: 35312F76615A5086D790DF1AE49579A7BB1F389BD4F205026EF8D87B18DF3AC482CB00
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Non-executed Functions

                                                                                                                                          Function 00007FFC670EC030 Relevance: 9.5, Strings: 7, Instructions: 762COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: 0020$0020$3050$3050$4040$GNOP$UsS
                                                                                                                                          • API String ID: 0-786335679
                                                                                                                                          • Opcode ID: c7546b07cbe0d0cb54ac19bbcafac055524b476eec2706f5b751194a06c46227
                                                                                                                                          • Instruction ID: 12c5acca109651849dd426818243d7eb232cd29b6d41fe925ce48b6f9af37fde
                                                                                                                                          • Opcode Fuzzy Hash: c7546b07cbe0d0cb54ac19bbcafac055524b476eec2706f5b751194a06c46227
                                                                                                                                          • Instruction Fuzzy Hash: 6772852261C6AAD5EB20EF22C4A12FD2765FF94344F804532EA4D8769ADF3CE645C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F9990 Relevance: 7.1, Strings: 5, Instructions: 866COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: S4$D$vfoR$vfoR$vfoR
                                                                                                                                          • API String ID: 0-739406038
                                                                                                                                          • Opcode ID: 9f81d7648c501c679a01b7c8bfebcff3f359ab3110e0c3c4bcb0409a87ab8b81
                                                                                                                                          • Instruction ID: 58ae2a8a60a15cdeb28d529e7bbe9393820e073c2c8875083623161b0558e34f
                                                                                                                                          • Opcode Fuzzy Hash: 9f81d7648c501c679a01b7c8bfebcff3f359ab3110e0c3c4bcb0409a87ab8b81
                                                                                                                                          • Instruction Fuzzy Hash: 54828B22A2C666C5EA10DF22D6A05ED6364FF84754F804932EE5E837DADF3CE504CB60
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670FBAE0 Relevance: 6.9, Strings: 5, Instructions: 645COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: S4$vfoR$vfoR$vfoR$vfoR
                                                                                                                                          • API String ID: 0-2269768260
                                                                                                                                          • Opcode ID: ad1c61b5abb7709118fef60bedef370a1d41792bb72744018df3e1a3b7ec9870
                                                                                                                                          • Instruction ID: fd5ff133f42e9a29ad180b427ea5c4bfcd4e3709c5d3e922268ed9d2f560563b
                                                                                                                                          • Opcode Fuzzy Hash: ad1c61b5abb7709118fef60bedef370a1d41792bb72744018df3e1a3b7ec9870
                                                                                                                                          • Instruction Fuzzy Hash: 82422821B0C66AC1FA10EB6296712FE5251AF857A4F440A31DE1E877DAEF3CE505C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67134FF0 Relevance: 5.7, Strings: 4, Instructions: 682COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: ERCP$VUUU$VUUU$VUUU
                                                                                                                                          • API String ID: 0-2165971703
                                                                                                                                          • Opcode ID: 591c415930979aab0714090d7240fd92d9ed515d5c4c0def523605ced274e22d
                                                                                                                                          • Instruction ID: 56102c6ccfb2df1cf668b46486808a12c09e50bc58021d01f4686d380f25a98f
                                                                                                                                          • Opcode Fuzzy Hash: 591c415930979aab0714090d7240fd92d9ed515d5c4c0def523605ced274e22d
                                                                                                                                          • Instruction Fuzzy Hash: B7528072A0D6A9CAEB648A7694603BD37A1FF04B68F144937DB4E56E84DF3CE580C710
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E6FE0 Relevance: 4.3, Strings: 3, Instructions: 509COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: )8GV$)8GV$@
                                                                                                                                          • API String ID: 0-2802744955
                                                                                                                                          • Opcode ID: 81e940176c9cdf8373318ab9bdac5e965fb5dbb86a08c93e689229e17a67c758
                                                                                                                                          • Instruction ID: 3018f5046f41b2ecddc58344147b1175a6e39ca749fe0b26499fef83697f07a9
                                                                                                                                          • Opcode Fuzzy Hash: 81e940176c9cdf8373318ab9bdac5e965fb5dbb86a08c93e689229e17a67c758
                                                                                                                                          • Instruction Fuzzy Hash: B2326F22A2C66AD5EB10EF62D8712FD2365EF84384F805832EA4D87696DF3CE545C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670C6790 Relevance: 4.2, Strings: 3, Instructions: 406COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: */*$GET$POST
                                                                                                                                          • API String ID: 0-3233530491
                                                                                                                                          • Opcode ID: 6a5464faf8c14e7bbf553d431dd16a1925e01ededdcf9ee096d392032e91729e
                                                                                                                                          • Instruction ID: 67886a16fb9984d8a88fabcdf9b88730343aae8ada1157d8d1fa51cd1de77459
                                                                                                                                          • Opcode Fuzzy Hash: 6a5464faf8c14e7bbf553d431dd16a1925e01ededdcf9ee096d392032e91729e
                                                                                                                                          • Instruction Fuzzy Hash: 1512B436A1CA5AC5EB10DF62E8641EE7361FF84388F400832EA4D47B9ADF38D549D760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F91F0 Relevance: 4.1, Strings: 3, Instructions: 321COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: 0$vfoR$vfoR
                                                                                                                                          • API String ID: 0-4254161263
                                                                                                                                          • Opcode ID: d350fa5340abd046ea64996543aff13dccd632d370100e2343bf5d1d1fac6f85
                                                                                                                                          • Instruction ID: 91479274af5a788c8521a8e4f121a1d4c69fe43f54c7610bd74ecc6d1c669c35
                                                                                                                                          • Opcode Fuzzy Hash: d350fa5340abd046ea64996543aff13dccd632d370100e2343bf5d1d1fac6f85
                                                                                                                                          • Instruction Fuzzy Hash: 4FD1B122B1C666C5EA10EF62D5601FD2365EF84784F844832EE4D87B9AEE3CE505C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC671122C0 Relevance: 3.4, Strings: 2, Instructions: 875COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: $(
                                                                                                                                          • API String ID: 0-55695022
                                                                                                                                          • Opcode ID: 3e2b856d7d3a8f0ae5682c0587b3bcc00a6fd6a82b500f45648ef920e4746369
                                                                                                                                          • Instruction ID: 558a44d50961bc26a8e4bcfce2f95ca24eb363e6dc0fffe97ebb4fdc74cd2f2c
                                                                                                                                          • Opcode Fuzzy Hash: 3e2b856d7d3a8f0ae5682c0587b3bcc00a6fd6a82b500f45648ef920e4746369
                                                                                                                                          • Instruction Fuzzy Hash: 6E829061B0C7AAC5EB64CB2694643B963A1FF46B84F445833DA4D0B799EF3CE851C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670C2980 Relevance: 2.9, Strings: 2, Instructions: 387COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: UsS$UsS
                                                                                                                                          • API String ID: 0-3680756722
                                                                                                                                          • Opcode ID: 23b3fcce26cd67675d50db75c0cf96bdd3c5247b54bcd1dae220c95baa2cfd8f
                                                                                                                                          • Instruction ID: 8d7b2a37a702e7d7be68278803791370ee3951f281bd2b2722d4f3b7798a3864
                                                                                                                                          • Opcode Fuzzy Hash: 23b3fcce26cd67675d50db75c0cf96bdd3c5247b54bcd1dae220c95baa2cfd8f
                                                                                                                                          • Instruction Fuzzy Hash: 12025D22B2C5AAD5EB10EB62C4A52FD6325EF94344F800832EA0D87ADADF3CD545D730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670FB250 Relevance: 2.9, Strings: 2, Instructions: 387COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Close
                                                                                                                                          • String ID: vfoR$vfoR
                                                                                                                                          • API String ID: 3535843008-516101275
                                                                                                                                          • Opcode ID: e70ccd0b46facdcf3166a131d5e4bc0fa276d7f0aa9f1a61874d8124f207c8d6
                                                                                                                                          • Instruction ID: a5c9b2ce7b14c119a87610511f4a2d4f394b45a4e94e33a3bd8fb0b56ad780fc
                                                                                                                                          • Opcode Fuzzy Hash: e70ccd0b46facdcf3166a131d5e4bc0fa276d7f0aa9f1a61874d8124f207c8d6
                                                                                                                                          • Instruction Fuzzy Hash: E6F17022B1C56AD5EB10EB72D6711FD2365AF84344F844832EE0E97A9AEE3CE505C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670C18D0 Relevance: 2.8, Strings: 2, Instructions: 320COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: UsS$UsS
                                                                                                                                          • API String ID: 0-3680756722
                                                                                                                                          • Opcode ID: 7d587fa0f625cbfa3b7563032b3aa8ec30568e3b4734641fd00ec8f0f8d94bc2
                                                                                                                                          • Instruction ID: aaeda1d742bdbd2ee4cfb6c5eb1033a7b8805caeef10210fd1158b7e7d6b3254
                                                                                                                                          • Opcode Fuzzy Hash: 7d587fa0f625cbfa3b7563032b3aa8ec30568e3b4734641fd00ec8f0f8d94bc2
                                                                                                                                          • Instruction Fuzzy Hash: 71F14E22A2C5AAD5EB10EB72C8651FD6365FF94344F804832E64D879DAEF38E605D730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6713C590 Relevance: 2.7, Strings: 2, Instructions: 157COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: $
                                                                                                                                          • API String ID: 0-227171996
                                                                                                                                          • Opcode ID: 826032f99af1e45f3323206c5674498b31217282fc7c017b9907595b70bb6924
                                                                                                                                          • Instruction ID: 3636066956eb4614883ecaa2334c11b48a049b3acc3de6a496a32e5fe7ce1cd2
                                                                                                                                          • Opcode Fuzzy Hash: 826032f99af1e45f3323206c5674498b31217282fc7c017b9907595b70bb6924
                                                                                                                                          • Instruction Fuzzy Hash: 365179B3A086A9CAE7608F16D49876936A8FF44764F164A36DB4D87BD0DF78D440CB20
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67122CA0 Relevance: 2.6, Strings: 2, Instructions: 121COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: ,q,\$,q,\
                                                                                                                                          • API String ID: 0-1092452903
                                                                                                                                          • Opcode ID: da22d920ff5cc6227cc0f6e061e432e43b1ab4f4e1d95c9d1540ba4b916ccb75
                                                                                                                                          • Instruction ID: 728bf1e697fa5fdbf8b480067d7f2159b1b33f29c26ec3d7b75c7084f9cb4cd7
                                                                                                                                          • Opcode Fuzzy Hash: da22d920ff5cc6227cc0f6e061e432e43b1ab4f4e1d95c9d1540ba4b916ccb75
                                                                                                                                          • Instruction Fuzzy Hash: 85418222F2C57AD4FB10EB7298650FD1275AF98B84B844832EE1E57BCADE2CD441D320
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F6130 Relevance: 2.5, Strings: 1, Instructions: 1270COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: UsS
                                                                                                                                          • API String ID: 0-2967771648
                                                                                                                                          • Opcode ID: ca8ab2eaa58e68f626e0bd3fe2f5443d0bfce1d6699e45fb875e230c1eb9d738
                                                                                                                                          • Instruction ID: eae6867b03ca0f85d1566b23e02cc397555640d538292d707891a8dc8f71638c
                                                                                                                                          • Opcode Fuzzy Hash: ca8ab2eaa58e68f626e0bd3fe2f5443d0bfce1d6699e45fb875e230c1eb9d738
                                                                                                                                          • Instruction Fuzzy Hash: 1FD26222A1C5AAD5EB60EF22C5652FD2365EF94348F804832EA0D876D6DF3CE645C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670CC5A0 Relevance: 2.1, Strings: 1, Instructions: 865COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: GET
                                                                                                                                          • API String ID: 0-1805413626
                                                                                                                                          • Opcode ID: 1dfb2083978177327a3efa0d8a5fed058735e8857845f4be6ccedbbe9a0fe535
                                                                                                                                          • Instruction ID: a58c89a082b3d64e27f5b0ffb0108e3c41693290608d36287fe9b625fd844cb2
                                                                                                                                          • Opcode Fuzzy Hash: 1dfb2083978177327a3efa0d8a5fed058735e8857845f4be6ccedbbe9a0fe535
                                                                                                                                          • Instruction Fuzzy Hash: C982A122A1C66AC1FB50DB26D0B53BE6760EF95748F541932EA4E876C6CE3CE446C730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670D9D70 Relevance: 2.1, APIs: 1, Instructions: 609COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: a8c7e941e264df4391f837f471c4530af583cdd237315f41e6336cec395a03c1
                                                                                                                                          • Instruction ID: 0ffd8d342d86dbf3d99e8928ce982d6dc484cd37ea2a6307dce67871df34a543
                                                                                                                                          • Opcode Fuzzy Hash: a8c7e941e264df4391f837f471c4530af583cdd237315f41e6336cec395a03c1
                                                                                                                                          • Instruction Fuzzy Hash: E5527221A1C6AAC5FB20EB72C4753FD23A5EF90754F900832EA0D56ADADE2CE545C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670D5420 Relevance: 1.9, Strings: 1, Instructions: 680COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Close
                                                                                                                                          • String ID: ,q,\
                                                                                                                                          • API String ID: 3535843008-3313482636
                                                                                                                                          • Opcode ID: 279a58ebf584ed7ba7a6137754720abf4cd195921bddb2da9a4930e224aabd46
                                                                                                                                          • Instruction ID: 7e857828679d083ed1950952db561f2aca00d7d0785daf9808ab65ffc58192a1
                                                                                                                                          • Opcode Fuzzy Hash: 279a58ebf584ed7ba7a6137754720abf4cd195921bddb2da9a4930e224aabd46
                                                                                                                                          • Instruction Fuzzy Hash: 14627E22B1C66AD5EB10EB72D4651FD6361EF94348F804832EA0E47ACAEF3CE545D760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670D3CD0 Relevance: 1.8, Strings: 1, Instructions: 572COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CreateMutex
                                                                                                                                          • String ID: z
                                                                                                                                          • API String ID: 1964310414-1657960367
                                                                                                                                          • Opcode ID: dd11310e4e969feabe1950c7963c6dce303810d0ab3ef17bc16e70dc82ddfa45
                                                                                                                                          • Instruction ID: ac52ae59ea7ce7531bb0170aed2957083ec9be3533356cead8602f3d4c4897c3
                                                                                                                                          • Opcode Fuzzy Hash: dd11310e4e969feabe1950c7963c6dce303810d0ab3ef17bc16e70dc82ddfa45
                                                                                                                                          • Instruction Fuzzy Hash: 3F527E32B18AA9E6E748EB31C6652ED7365FF84344F804836E71D43686DF38E165C760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E5050 Relevance: 1.8, Strings: 1, Instructions: 566COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: !hMy
                                                                                                                                          • API String ID: 0-318797071
                                                                                                                                          • Opcode ID: 8b1187c18133ce5b7faad7b4676b2ffb1aaee7d6e49dd8e33e69b88e7ee9e1c4
                                                                                                                                          • Instruction ID: 74800c2cf9666f752bdee80f9087cf0d41a8e3bf48da489825fbb7d38372d95c
                                                                                                                                          • Opcode Fuzzy Hash: 8b1187c18133ce5b7faad7b4676b2ffb1aaee7d6e49dd8e33e69b88e7ee9e1c4
                                                                                                                                          • Instruction Fuzzy Hash: 88428236A1C66AC5EA24EB22D4652FE6360EF95344F804C32D79E822D6DF3CE585C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670EA310 Relevance: 1.7, Strings: 1, Instructions: 488COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CloseEnumValue
                                                                                                                                          • String ID: 'Q|
                                                                                                                                          • API String ID: 858281747-3964534801
                                                                                                                                          • Opcode ID: a7f88f11ebb2f20ff444be0074f6f7f4e2b2bd0c8388cc24e2b6011576de200b
                                                                                                                                          • Instruction ID: 49710ced281052175f2b811221368114e56309b9015018a14257e097a50769ca
                                                                                                                                          • Opcode Fuzzy Hash: a7f88f11ebb2f20ff444be0074f6f7f4e2b2bd0c8388cc24e2b6011576de200b
                                                                                                                                          • Instruction Fuzzy Hash: CE229D22B1C56AC5EA10EB62C1751FD2371EF88748F944932EA4E976CADF2CE506C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F4360 Relevance: 1.7, Strings: 1, Instructions: 455COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: U
                                                                                                                                          • API String ID: 0-3372436214
                                                                                                                                          • Opcode ID: 2cc168c4871c95d12501f34edc6984f15e3f5eb071fe1104ca5c8a2494e78bfa
                                                                                                                                          • Instruction ID: 6efd5cc19fe5c0eadf68b5a1c51cbd4c322ae67d1963a5af26f65f44ed17af42
                                                                                                                                          • Opcode Fuzzy Hash: 2cc168c4871c95d12501f34edc6984f15e3f5eb071fe1104ca5c8a2494e78bfa
                                                                                                                                          • Instruction Fuzzy Hash: 59227F21A2C6AAD5FB10EB62D5653FD2361AF81784F800832EE4D47ADADF2CE545C730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E4140 Relevance: 1.7, Strings: 1, Instructions: 430COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: Content-Type
                                                                                                                                          • API String ID: 0-2058190213
                                                                                                                                          • Opcode ID: cc7789c24dcbb59baa313f562ed9f0841053ccb7bb214165e6c015bb631d1140
                                                                                                                                          • Instruction ID: 0274278f8d0f04f26d262739beb19f3d9c67cd5785c390ea9bacf4bd2c0934cc
                                                                                                                                          • Opcode Fuzzy Hash: cc7789c24dcbb59baa313f562ed9f0841053ccb7bb214165e6c015bb631d1140
                                                                                                                                          • Instruction Fuzzy Hash: B5128322B1C66AD6EB24EB72D0652FD6365EF44744F804836EA4E87686DF3CE506C370
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E69C0 Relevance: 1.7, Strings: 1, Instructions: 401COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: 0
                                                                                                                                          • API String ID: 0-4108050209
                                                                                                                                          • Opcode ID: 603a1e6c89c621f90dbb0577f2ffc501f40dea9117a46ee29aeb04ead18e60eb
                                                                                                                                          • Instruction ID: 3fbc5e500207e3f01532df7f284404267e168748a6765321a07421263ee001cc
                                                                                                                                          • Opcode Fuzzy Hash: 603a1e6c89c621f90dbb0577f2ffc501f40dea9117a46ee29aeb04ead18e60eb
                                                                                                                                          • Instruction Fuzzy Hash: F0F1C632B0C769C2EB149B22A5602BA73A5FF85784F444836EE8D87B95DF3CD451C760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6713C0EB Relevance: 1.6, Strings: 1, Instructions: 372COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 0-3916222277
                                                                                                                                          • Opcode ID: d0fe163027e34e7fec8cb7a5ca1a9258698c9fba023c4617cc73a7ffd335cb98
                                                                                                                                          • Instruction ID: 38a4252b96209a9fba56950d001ba17a3dcae60514a7fe00d3066fbce678d3f2
                                                                                                                                          • Opcode Fuzzy Hash: d0fe163027e34e7fec8cb7a5ca1a9258698c9fba023c4617cc73a7ffd335cb98
                                                                                                                                          • Instruction Fuzzy Hash: 70F17E72A082A9CAE7948F1A8058B7E3AA9FF44B54F054A3ADF4D57BC1DF39D440C760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F3CF0 Relevance: 1.6, Strings: 1, Instructions: 364COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: -R+
                                                                                                                                          • API String ID: 0-215093852
                                                                                                                                          • Opcode ID: c2ebaee40d3443b75258207ad54ae9ef1b3727b9b2307a94eb29f165cfbdaf13
                                                                                                                                          • Instruction ID: fd580cdc981b5d90de083af007db4c004a95d279b0196e8dfadebe3f50b6d61e
                                                                                                                                          • Opcode Fuzzy Hash: c2ebaee40d3443b75258207ad54ae9ef1b3727b9b2307a94eb29f165cfbdaf13
                                                                                                                                          • Instruction Fuzzy Hash: 1902AF22A2C6AAD5EB10EF62D5601ED6325FF84344F804832EA4D97ADADF3CE545C730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E11B0 Relevance: 1.5, Strings: 1, Instructions: 271COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 0-3916222277
                                                                                                                                          • Opcode ID: 827202f5d2b5b2e60ad1ac815b4e038e1c503d1a990c37d258570859f0d0a253
                                                                                                                                          • Instruction ID: d20497ee8af466e685942b774c95954a53767f37ca84f4280dbcf7bb83641720
                                                                                                                                          • Opcode Fuzzy Hash: 827202f5d2b5b2e60ad1ac815b4e038e1c503d1a990c37d258570859f0d0a253
                                                                                                                                          • Instruction Fuzzy Hash: D0B1B421B1C66AC5EB14EB7280742FD2361AF85788F444836DE0E57BCADE3CE506D360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670EF6B0 Relevance: 1.5, Strings: 1, Instructions: 221COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 0-3916222277
                                                                                                                                          • Opcode ID: c52085b52813831b42183e47ad3d99a7f7d6d7082d4d86fa951259cb7f88e0df
                                                                                                                                          • Instruction ID: db939553db064fb8abe43f3537c556aedf40f029ca8da8953e24131fcdb306f8
                                                                                                                                          • Opcode Fuzzy Hash: c52085b52813831b42183e47ad3d99a7f7d6d7082d4d86fa951259cb7f88e0df
                                                                                                                                          • Instruction Fuzzy Hash: 4181C521B1D26AC2E954A763A43437E6256BFC5B80F444C35E98E877CADE3CE901DB31
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67140820 Relevance: 1.4, Strings: 1, Instructions: 195COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 0-3916222277
                                                                                                                                          • Opcode ID: 0862e3f9c1a049c60bd6644a5a9cac2d78c2248cef8693d182035f2e1037fa13
                                                                                                                                          • Instruction ID: eb67103c91652afad1b477778782e368288b9c9ea6cd6651157b735264a5f4ee
                                                                                                                                          • Opcode Fuzzy Hash: 0862e3f9c1a049c60bd6644a5a9cac2d78c2248cef8693d182035f2e1037fa13
                                                                                                                                          • Instruction Fuzzy Hash: AE716D737381B48BE7658B1FA420AAA7390F76634DFD56215EBCA47B41CA3DB900CB50
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E3D50 Relevance: 1.4, Strings: 1, Instructions: 195COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: `ngU
                                                                                                                                          • API String ID: 0-1771476526
                                                                                                                                          • Opcode ID: 99573f904c5d6b3ad7913296c3be0af2c30b65ad59d47746cb0cd9dafcb922a0
                                                                                                                                          • Instruction ID: ce3c12764ae9ac002fb95710383ad22d53b8a5e4d2d484e1568d7cd7dfbd075e
                                                                                                                                          • Opcode Fuzzy Hash: 99573f904c5d6b3ad7913296c3be0af2c30b65ad59d47746cb0cd9dafcb922a0
                                                                                                                                          • Instruction Fuzzy Hash: A191A522B1C56AC5FB14EB72D0A52FD6371AF54788F805833EA0D9769ADE2CE405D370
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6713B7A0 Relevance: 1.4, Strings: 1, Instructions: 149COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: ERCP
                                                                                                                                          • API String ID: 0-1384759551
                                                                                                                                          • Opcode ID: 5c0459b61386457cc212822abbe1eb74425903cd16e4a0cba1d06804f81f7a37
                                                                                                                                          • Instruction ID: 64ad6c8a474110177e59ba370b623202840fd983bf0eb553b37af5e9c105da6d
                                                                                                                                          • Opcode Fuzzy Hash: 5c0459b61386457cc212822abbe1eb74425903cd16e4a0cba1d06804f81f7a37
                                                                                                                                          • Instruction Fuzzy Hash: 7E41D667B244558BE3189F2998212BA2791F7E87817008838FBD7C3B89ED7CDE51C364
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67110650 Relevance: .9, Instructions: 875COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 02a739226de17ccc464195f0c11a586dc0e689c8a4ce4879c487f931ef600b5e
                                                                                                                                          • Instruction ID: a0fa98993a89aad90b4b4e9af561c4817a80df81c071596dbcc9d30c3dd1a0cc
                                                                                                                                          • Opcode Fuzzy Hash: 02a739226de17ccc464195f0c11a586dc0e689c8a4ce4879c487f931ef600b5e
                                                                                                                                          • Instruction Fuzzy Hash: 3B82C062B1C7AAC2FA248B1294643B963A1FF44F84F855833DA4D4B799EF3CD855C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67114BC0 Relevance: .8, Instructions: 806COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: fe943440eb55d8ace1a4f0b4e594e6dcceb577fc1d26ec84d65597700bc05909
                                                                                                                                          • Instruction ID: a26c6cdc347734a4f5b4582225890518bcb55d1bd5d551fe4b914abd61e6452c
                                                                                                                                          • Opcode Fuzzy Hash: fe943440eb55d8ace1a4f0b4e594e6dcceb577fc1d26ec84d65597700bc05909
                                                                                                                                          • Instruction Fuzzy Hash: 0372D061B0C7AEC5EB658B1694602B867A1FF95F84F854833CA4D0B795EF3CE981C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67115840 Relevance: .8, Instructions: 796COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: cca06bd7f2049d35bb73f0ad3582ff2a172ed3a9d9748a45a6c721c0f409364d
                                                                                                                                          • Instruction ID: c92f574b973ea68f3bbf2bfedba711c59c94211aefa7e300413914a967087d0b
                                                                                                                                          • Opcode Fuzzy Hash: cca06bd7f2049d35bb73f0ad3582ff2a172ed3a9d9748a45a6c721c0f409364d
                                                                                                                                          • Instruction Fuzzy Hash: 9B72F171B0C7AEC1EA648B1694642B867A5FF85B84F854833CA4D0B795EF3CE981C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670D7410 Relevance: .7, Instructions: 747COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Close
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3535843008-0
                                                                                                                                          • Opcode ID: 9a309b6559be776572afeeb754e3d6c3cc73aff03e68f9f8e21edbf3e8152795
                                                                                                                                          • Instruction ID: b4f24fcdc70ba3a5324f41fa9243f85a1d62b5a0174a7d845ed31bc8be3a86d8
                                                                                                                                          • Opcode Fuzzy Hash: 9a309b6559be776572afeeb754e3d6c3cc73aff03e68f9f8e21edbf3e8152795
                                                                                                                                          • Instruction Fuzzy Hash: 18723F21B2C66AD4EB00EF72C5A51ED6765EF94344FC04832EA4D87A9AEF2CE505C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6713C8B1 Relevance: .7, Instructions: 735COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 274968c8ba36a5bd2d21743935f1cb3ee72fd8aa297ca413f492129fefee32e3
                                                                                                                                          • Instruction ID: 6fc21b1351f91456d8824c4e49fd371a392e74310b3203dee9f9a7c8993d5c26
                                                                                                                                          • Opcode Fuzzy Hash: 274968c8ba36a5bd2d21743935f1cb3ee72fd8aa297ca413f492129fefee32e3
                                                                                                                                          • Instruction Fuzzy Hash: ED52C276A182B98BD7548E2AD068A7D3BA9FF44754F01463ADB4E47BC0DF39D844CB20
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6710F870 Relevance: .7, Instructions: 683COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: fea4f79aaad7fe9cbf46996f4e631aa0e68aa59668c00d258b2a964dad979c92
                                                                                                                                          • Instruction ID: 0a7c7a107c83f3880b626d8768647496cdc4893f51a4cd6cf2ca87ed5972a539
                                                                                                                                          • Opcode Fuzzy Hash: fea4f79aaad7fe9cbf46996f4e631aa0e68aa59668c00d258b2a964dad979c92
                                                                                                                                          • Instruction Fuzzy Hash: 2452F362B1CBA9C1EB648B12D4643B963A1FF84B84F445833DA5D07799EF3CE850D760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6713EF80 Relevance: .7, Instructions: 677COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: a27784a074e2bb7dca5615da6ac60503d5b4f0c137b04b5a13c1ab1661bc6fbb
                                                                                                                                          • Instruction ID: b6ee770ef54eb594334c14f5b9106140cfc050bba978a1939048bda9c8ba67a1
                                                                                                                                          • Opcode Fuzzy Hash: a27784a074e2bb7dca5615da6ac60503d5b4f0c137b04b5a13c1ab1661bc6fbb
                                                                                                                                          • Instruction Fuzzy Hash: 11626DB6618669CBD7648F26C09052C37B1FB58F68B255626CF1D43B89CF38E891CF60
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670DE9B0 Relevance: .7, Instructions: 675COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Close
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3535843008-0
                                                                                                                                          • Opcode ID: 42a198ccab95ff3d5507a2f7297670992f3d12e92f6fddfb7f5eacd0fe1112bf
                                                                                                                                          • Instruction ID: ab5d292c2c91365b361a6e7cb3dfceb476e60e1a879ab144fc4f141832bbbd1c
                                                                                                                                          • Opcode Fuzzy Hash: 42a198ccab95ff3d5507a2f7297670992f3d12e92f6fddfb7f5eacd0fe1112bf
                                                                                                                                          • Instruction Fuzzy Hash: 81628322A2C66AD5EB50EF32D5651FD6765EF84384F804832EA0D87696DF3CE508C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670C6E90 Relevance: .7, Instructions: 651COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 586b0c86dd539f38de0044fba9eaed018cb5e3f9552df3ce0dc7b389be7bca84
                                                                                                                                          • Instruction ID: 7e1ea8d7dc4ebc121c80d9d2ae168d1814de528a06c26ae26279bd4d699cb8f9
                                                                                                                                          • Opcode Fuzzy Hash: 586b0c86dd539f38de0044fba9eaed018cb5e3f9552df3ce0dc7b389be7bca84
                                                                                                                                          • Instruction Fuzzy Hash: 3352A121A2C66AC1FA40EB62E4755FE6361FF84784F805832EA4E87696DF3CE505C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670D8670 Relevance: .6, Instructions: 558COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 557c7400a35dc890cbd9c3821301a71d01a8831d2c5bcf8c7cf52b04ca6a0dcc
                                                                                                                                          • Instruction ID: a4e128f856a18f21fe7104dd9a64fdafbfb743df579255dcc0b7b1a7e42dbd58
                                                                                                                                          • Opcode Fuzzy Hash: 557c7400a35dc890cbd9c3821301a71d01a8831d2c5bcf8c7cf52b04ca6a0dcc
                                                                                                                                          • Instruction Fuzzy Hash: 76427B22A1C6AAC5EB10EB72C5612FD6365EF94354F804832EA0D87ADADF3CE545C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E4800 Relevance: .5, Instructions: 545COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: f90d669f03444080482cfb23dd3a86fad7c075120776a780245215426cd9e6d8
                                                                                                                                          • Instruction ID: c3119dc900060a2258a7744ccca3521d1bccf1347d73575b74ef8fd5d2c62505
                                                                                                                                          • Opcode Fuzzy Hash: f90d669f03444080482cfb23dd3a86fad7c075120776a780245215426cd9e6d8
                                                                                                                                          • Instruction Fuzzy Hash: 7E32C622B18666C5EB10EF77C4A52ED2765EF84B98F445436EE0E8778ADE3CE045C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670D23F0 Relevance: .5, Instructions: 542COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 7139bcd1ce5fdb58b7d546cb367074c75fbad7a78bf90e696654dd1ca0ba9ac0
                                                                                                                                          • Instruction ID: fc3fcc5221f96567d45d234464294515e189abecee0434864ca0c2b1c2bf13b4
                                                                                                                                          • Opcode Fuzzy Hash: 7139bcd1ce5fdb58b7d546cb367074c75fbad7a78bf90e696654dd1ca0ba9ac0
                                                                                                                                          • Instruction Fuzzy Hash: 33329022A1C66AD5EB10EF22D4A51FD2365EF94388F804832EA4D876DADF3CE505D770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670CB100 Relevance: .5, Instructions: 531COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 16dea1e3c739009a0f3e1ac8366c1456fe6298dd4187c04af5b77b77fa2332cb
                                                                                                                                          • Instruction ID: c7ea6904f67e342368346b2e6047d44150bdeff991847154cc68b6b342c999f2
                                                                                                                                          • Opcode Fuzzy Hash: 16dea1e3c739009a0f3e1ac8366c1456fe6298dd4187c04af5b77b77fa2332cb
                                                                                                                                          • Instruction Fuzzy Hash: 51428522A1C66AD5EB10EF62C4A56FD6365FF84384F804832EA0D8769ADF3CD549C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670DD890 Relevance: .5, Instructions: 528COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 996240fad6b35de64fc793b92b35b26cdcc948d61e990141f48373fa04fa355f
                                                                                                                                          • Instruction ID: 66c7a3c4f85a98af1703e26946281067a7bfaa6137727e29cb80e01b287d840d
                                                                                                                                          • Opcode Fuzzy Hash: 996240fad6b35de64fc793b92b35b26cdcc948d61e990141f48373fa04fa355f
                                                                                                                                          • Instruction Fuzzy Hash: 0E329222B18BAAC5EB10DF76D8642ED23A1FF84788F444836EA4D47B89DF38D545D720
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F89F0 Relevance: .5, Instructions: 525COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: bf3bbf9f7806764439d6e39547c55a4600bd87bd8b1462e0748042ecacfab7a1
                                                                                                                                          • Instruction ID: dad98fd040ba8d995ccba6e1cbfde44889339e88591aca3529012ce0722a9916
                                                                                                                                          • Opcode Fuzzy Hash: bf3bbf9f7806764439d6e39547c55a4600bd87bd8b1462e0748042ecacfab7a1
                                                                                                                                          • Instruction Fuzzy Hash: 9E228D22B0D66AC5EA10EF2286A52BD2358AF84B44F454D36DE0E877C6DF3CE505C7B0
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670D95C0 Relevance: .5, Instructions: 460COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: a56e5b9810e8218cc68cf3b2d17d9b0a65729533e7e14b0982b9244d7add9ffb
                                                                                                                                          • Instruction ID: 9f2b4694ade63ea6cac57ca9bda372ba5c32e430a78221a42bff268275b3b61b
                                                                                                                                          • Opcode Fuzzy Hash: a56e5b9810e8218cc68cf3b2d17d9b0a65729533e7e14b0982b9244d7add9ffb
                                                                                                                                          • Instruction Fuzzy Hash: 80128121A2C66AC5EB10EF72D4752FD63A5EF84744F800832EA4D96ADADE3CE545C730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712E400 Relevance: .5, Instructions: 458COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: d49b644cad6694cd14e8da8a75c2b99da55971c1b9b2318d785b08d65ed4a64b
                                                                                                                                          • Instruction ID: f423b98ff0a8c816ef990eedf1c062721b6238d2f4cc845a73532161272e1e28
                                                                                                                                          • Opcode Fuzzy Hash: d49b644cad6694cd14e8da8a75c2b99da55971c1b9b2318d785b08d65ed4a64b
                                                                                                                                          • Instruction Fuzzy Hash: A002017290C2BAC5FB658B3680293793BB1EF11704F154937DAAE425E5DE2CE688D730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670CDE20 Relevance: .5, Instructions: 456COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: a7a31171ef1d09154c8bb64f43a5a6c94ab0abf716ba086a025094ebfeb533d6
                                                                                                                                          • Instruction ID: 09471cd9e1873fcf24ff1c3c8780a26cf2ac3e9d7638eaf7129c85ccbcba7cc1
                                                                                                                                          • Opcode Fuzzy Hash: a7a31171ef1d09154c8bb64f43a5a6c94ab0abf716ba086a025094ebfeb533d6
                                                                                                                                          • Instruction Fuzzy Hash: D6225322B2C66AD5EB10EF72C5A51ED6365FF94344F804832EA4D8769AEF3CE105C760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670C5C20 Relevance: .4, Instructions: 450COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 50d2b93ebdf18556efae1baa4f9cd6940db842e628aaa6e187870812b7cc1f0b
                                                                                                                                          • Instruction ID: b52d9b7521ba978e4d22eac4cea1d8984fe40d0096c4a9f62fe16028b3d83a0d
                                                                                                                                          • Opcode Fuzzy Hash: 50d2b93ebdf18556efae1baa4f9cd6940db842e628aaa6e187870812b7cc1f0b
                                                                                                                                          • Instruction Fuzzy Hash: 3122B732A2C66AC1EB10EB62D4695FE2365FF94784F804832EA4D83696DF3CE545C730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC671282A0 Relevance: .4, Instructions: 448COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: f214e6889ff07b5cdff74ab9c3a83d51ae64ba2f67ed0e5182fd07676cd33270
                                                                                                                                          • Instruction ID: 08cb11feb0b256bfdcf4fee20eea164c5cfc94f9952e1680e77192d9b011c038
                                                                                                                                          • Opcode Fuzzy Hash: f214e6889ff07b5cdff74ab9c3a83d51ae64ba2f67ed0e5182fd07676cd33270
                                                                                                                                          • Instruction Fuzzy Hash: CC029131B0C66AC7FB20EB6290712F912A5AF94748F444936EE5D47BC6EF2CE541C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67129410 Relevance: .4, Instructions: 440COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 141879225045fb0130bba94e189b1d8bd3edad3111932d99e478955394790145
                                                                                                                                          • Instruction ID: 7640f7b16f42486e249dccc5514ef23db0b5af4abe0ab5b34affe6be69f292bc
                                                                                                                                          • Opcode Fuzzy Hash: 141879225045fb0130bba94e189b1d8bd3edad3111932d99e478955394790145
                                                                                                                                          • Instruction Fuzzy Hash: C2028D36B0C26ACAEB10DF26C1A51AD33A5EF84784F514836DE1E97786DE3CE845C760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670CBB20 Relevance: .4, Instructions: 438COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 81f12b039721c9f9441b328414c886d93419b1b5e6ea1361f51a92b464c44b6d
                                                                                                                                          • Instruction ID: 1e76f383a1bdf5c35fac8d14758ca447b3b671d8327a74596fc25c405298291a
                                                                                                                                          • Opcode Fuzzy Hash: 81f12b039721c9f9441b328414c886d93419b1b5e6ea1361f51a92b464c44b6d
                                                                                                                                          • Instruction Fuzzy Hash: 7E129621A2C66AD5EB10EF22D4A52FD6365FF84388F801832EA4D9768BDE7CD505D730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67118D20 Relevance: .4, Instructions: 425COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: ad044c472c29d2d325e1586ee8c46f59d785f533081c7cd73c132967cb7ee4b1
                                                                                                                                          • Instruction ID: 624a3d649205cdeecf09c2c4f3dab2d2b93a5b9590720332d750c4174bf2a7ad
                                                                                                                                          • Opcode Fuzzy Hash: ad044c472c29d2d325e1586ee8c46f59d785f533081c7cd73c132967cb7ee4b1
                                                                                                                                          • Instruction Fuzzy Hash: BD02D021B0C7AAC6EB549B1294642B977A1FF85F84F894837DA5D0B785EF3CE840C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712B260 Relevance: .4, Instructions: 422COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 1cd096a2520fd449fd2f8ed8bbd7dc8bfb964da9cbcf35daf852df9bd2801131
                                                                                                                                          • Instruction ID: e98392ad2b8ce95ee26113797a938f0ff2ca6338fdbb12aa5e1b662add5d6724
                                                                                                                                          • Opcode Fuzzy Hash: 1cd096a2520fd449fd2f8ed8bbd7dc8bfb964da9cbcf35daf852df9bd2801131
                                                                                                                                          • Instruction Fuzzy Hash: 1912A022B2C56AD5EB10EF72D8A51ED6365FF84788F804832EA0D57A9ADF3CD504D720
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E872B Relevance: .4, Instructions: 396COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: ecf9948244fb180f3218659b2276fec5f0e0b2484f239b0f5a362a7c94b9c646
                                                                                                                                          • Instruction ID: 57585f55a8db03dec92d6135a0f2ed82dfdaf98e9654cc7934269a7cf32d6272
                                                                                                                                          • Opcode Fuzzy Hash: ecf9948244fb180f3218659b2276fec5f0e0b2484f239b0f5a362a7c94b9c646
                                                                                                                                          • Instruction Fuzzy Hash: 1512A332B2CA9AD9EB10EF72C4612ED2761EF91344F800832E64D47ADADF38D645C760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F06A0 Relevance: .4, Instructions: 391COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 25436a7cbd74014a54dbca1e2ad640bb45033137a792dd7e05ffba4b7717c84d
                                                                                                                                          • Instruction ID: 18cd7f9f9221e42e79c478f65e313fb9273e70d62cede7a6ae4555716c4b6613
                                                                                                                                          • Opcode Fuzzy Hash: 25436a7cbd74014a54dbca1e2ad640bb45033137a792dd7e05ffba4b7717c84d
                                                                                                                                          • Instruction Fuzzy Hash: 7E028222B2C66AD5EA00EF62D5651ED6364EF94384F801832EE4D83A9ADF3CE545C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670D08B0 Relevance: .4, Instructions: 377COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: e5bd0618e608784adac2a6ccecd2ba7583a7e321574bdf58de7476e057eceed6
                                                                                                                                          • Instruction ID: 6eaae6e73936c35222299f277a5777423d5e39b34643cc7a6fdbc6b470ed79f2
                                                                                                                                          • Opcode Fuzzy Hash: e5bd0618e608784adac2a6ccecd2ba7583a7e321574bdf58de7476e057eceed6
                                                                                                                                          • Instruction Fuzzy Hash: 89024272728A66D9EB10DF72C0A12EE2724EF44748F805436EF0E57A8ADE39F505D760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670D8FC0 Relevance: .4, Instructions: 376COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 0b92677647bed7ff327017e43527478b9a79cad1f243ae3ae9f668c2885e425b
                                                                                                                                          • Instruction ID: ab145a3962ebb20f6dc051af5dfec07b2bd25fd7ca934c23e65385e99de3eab6
                                                                                                                                          • Opcode Fuzzy Hash: 0b92677647bed7ff327017e43527478b9a79cad1f243ae3ae9f668c2885e425b
                                                                                                                                          • Instruction Fuzzy Hash: E1F17421A2C66AD5EB10EB72D5751FD2365EF94358F840932EA0D866CADE3CE505C730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670DE110 Relevance: .4, Instructions: 370COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 4a010a916781879698f2e19ceb648617af44b790d6a98b2a48fbd400929ff3e5
                                                                                                                                          • Instruction ID: 50f5c9d40d457d3da788e1bbea24ce97efb37a49f590afbdae53ea85dcd0e414
                                                                                                                                          • Opcode Fuzzy Hash: 4a010a916781879698f2e19ceb648617af44b790d6a98b2a48fbd400929ff3e5
                                                                                                                                          • Instruction Fuzzy Hash: E9029122B2C56AD4EB10EB62D5752FD6365EF84784F804832EA0D97ACADF2CE505C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6713FC00 Relevance: .4, Instructions: 360COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 34e549e9e6f9381bdde19e3905a338851c9fa38214a788d33658dd8582749182
                                                                                                                                          • Instruction ID: eeeea92944d11800e664ce07cb5b527b313d95c6aebd4c586bb1532711a98b48
                                                                                                                                          • Opcode Fuzzy Hash: 34e549e9e6f9381bdde19e3905a338851c9fa38214a788d33658dd8582749182
                                                                                                                                          • Instruction Fuzzy Hash: FAD15733A1C6A98BD3188F2A941427D7BA4FB54794F004236EF9E83B89DE3DD944CB10
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712C780 Relevance: .4, Instructions: 359COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: cfa656bd85405484802945174f5bcfb23684b2d937a5203aa7dfb0011b340f73
                                                                                                                                          • Instruction ID: a690dda25ad177c8db0c2d060b7ad2d70ef8a078236f3302cb011094cd909d48
                                                                                                                                          • Opcode Fuzzy Hash: cfa656bd85405484802945174f5bcfb23684b2d937a5203aa7dfb0011b340f73
                                                                                                                                          • Instruction Fuzzy Hash: 1EF17F22A2C9AAD8EB10EF32D8A51FD6365EF94348F804833E60D569DADF3CD545D720
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670DA7D0 Relevance: .3, Instructions: 331COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: ec9b76e739d0b20bc514d5649fa6397f4267e8081a65911ffc1e4c9d184f3614
                                                                                                                                          • Instruction ID: ab560029adce1441b86e17ce04622b670c29b8a48488ef8a4b9e4e6c48a661a0
                                                                                                                                          • Opcode Fuzzy Hash: ec9b76e739d0b20bc514d5649fa6397f4267e8081a65911ffc1e4c9d184f3614
                                                                                                                                          • Instruction Fuzzy Hash: 79E1A122A1C66AC5FB10EB72D4752FD23A5EF90358F904832EA0D46ACADF2CE545C760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670ED550 Relevance: .3, Instructions: 331COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 623638aa73f52889be8d1c31f433fa6a904df7df3d8eb3ae4ee5af1cf35276be
                                                                                                                                          • Instruction ID: 2ff8c0364ec1172a08daf024994c57e3f09ed5e9b1bbb2f71caa4e52d07fcdf6
                                                                                                                                          • Opcode Fuzzy Hash: 623638aa73f52889be8d1c31f433fa6a904df7df3d8eb3ae4ee5af1cf35276be
                                                                                                                                          • Instruction Fuzzy Hash: F8E18522A2C56AD5EA00EF62D5651ED6364FF84384F900832EE4D93ADAEF3CE545C770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67125B50 Relevance: .3, Instructions: 304COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: e6c2437e9efd40f163505b5ee16583e4bba0e0d31fdf673491ef8b3244613bb6
                                                                                                                                          • Instruction ID: 2ed7e465eae8cdfc884531d99e60ca681b6c39e93a00bb9278011fb81c5a6514
                                                                                                                                          • Opcode Fuzzy Hash: e6c2437e9efd40f163505b5ee16583e4bba0e0d31fdf673491ef8b3244613bb6
                                                                                                                                          • Instruction Fuzzy Hash: D1C13B1352C1E08AD3558B3660A02BABEA0EF95388F580576DEDD96ADBCE1CD254CB70
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670EDAA0 Relevance: .3, Instructions: 298COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 019c3818e49e7492b17d3b444b1d0ddf21397838769942b4d133398172001bc0
                                                                                                                                          • Instruction ID: 91d02e037f77d31f36bcbf0510a94a1eab84b33982e925006638cc30fa7a8ae0
                                                                                                                                          • Opcode Fuzzy Hash: 019c3818e49e7492b17d3b444b1d0ddf21397838769942b4d133398172001bc0
                                                                                                                                          • Instruction Fuzzy Hash: 60D15222B2C56AD1EB00EF72D4651ED6365FF94344F904832EA4D87A9ADF3CD505CB60
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F0D10 Relevance: .3, Instructions: 295COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: cddc44d860aa59944bf5c23a4df4552e0da28415d8bd1abcc74885b13133f392
                                                                                                                                          • Instruction ID: c1c66901a3ca9efaa8bb5e420a7fef04a0c9a0dadaa219ea8f98005954e04677
                                                                                                                                          • Opcode Fuzzy Hash: cddc44d860aa59944bf5c23a4df4552e0da28415d8bd1abcc74885b13133f392
                                                                                                                                          • Instruction Fuzzy Hash: 25C19122B1C52AC5FB20EB7295603BE27A1AF84388F544836EE4D976D9DE3CE505C370
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670EAC80 Relevance: .3, Instructions: 290COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: FileFindNext
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 2029273394-0
                                                                                                                                          • Opcode ID: 6a1bd024c2c415626e3d26f25a7162ee42f270b7bb063cf94463ffc28699e898
                                                                                                                                          • Instruction ID: 4835f7b1e88634a7408c0b9bf2fde960d48d6a9092c513ac6f893ead99037e6b
                                                                                                                                          • Opcode Fuzzy Hash: 6a1bd024c2c415626e3d26f25a7162ee42f270b7bb063cf94463ffc28699e898
                                                                                                                                          • Instruction Fuzzy Hash: A9D1A022A2C66AD5EB00EB22D4652FD6365FF84384F804832EA5D47ACADF3CE505D770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67120770 Relevance: .3, Instructions: 287COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 78e42092f548368cb371c2b483d487d87f6b6e0d7345918813f4e9e68c14427a
                                                                                                                                          • Instruction ID: 2ef2d101904763483076f57c9cb1008731672eb547b9533a9eb45a0269ba53cf
                                                                                                                                          • Opcode Fuzzy Hash: 78e42092f548368cb371c2b483d487d87f6b6e0d7345918813f4e9e68c14427a
                                                                                                                                          • Instruction Fuzzy Hash: 63C19E22B1C62AC6FB10EBA2C0792BD2365EF54788F804932DE1D576D6EE3CE545D360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67120F30 Relevance: .3, Instructions: 281COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: b0f517ed78391c7fc8f6e750fc61c14f38bf71b43654d3e29c65c5cd78ea3ef9
                                                                                                                                          • Instruction ID: 5cc98f1726e3e5b6140ca79a022da008675f5a98d5ec42d4affbbe3fb359af16
                                                                                                                                          • Opcode Fuzzy Hash: b0f517ed78391c7fc8f6e750fc61c14f38bf71b43654d3e29c65c5cd78ea3ef9
                                                                                                                                          • Instruction Fuzzy Hash: D8C1C332B0C65AD6EB14EB72D4742FC23A1AF44758F440A32DA2D57AC6DF38E5A5D320
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E3910 Relevance: .3, Instructions: 281COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 307f0f14a74e58f75e681ef2cc5d2378040a00e8304d47f44f5e290cb001da96
                                                                                                                                          • Instruction ID: 645123d42902c3101faca9ad170dbeeb2f7eba78ee083b585b3e5c0209443e6e
                                                                                                                                          • Opcode Fuzzy Hash: 307f0f14a74e58f75e681ef2cc5d2378040a00e8304d47f44f5e290cb001da96
                                                                                                                                          • Instruction Fuzzy Hash: 12B16F25B1863AC4EB04EB62D8695FD2365AF49BC8F805836EE0D57B96DE3CD405D320
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712B960 Relevance: .3, Instructions: 281COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: e55de7ce1179f0f36ce485c2ca33088e433d153ca3a1ab5c59ce295e2ff2f528
                                                                                                                                          • Instruction ID: b754d2b278072cae76fd127c96c13b872dd16323b8acdd5c8e35198a53cbc173
                                                                                                                                          • Opcode Fuzzy Hash: e55de7ce1179f0f36ce485c2ca33088e433d153ca3a1ab5c59ce295e2ff2f528
                                                                                                                                          • Instruction Fuzzy Hash: 87C17022B1C56AD5EB20EB72D4652FD2375AF54788F800836DE0D57A8AEE3CE149D360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F1D30 Relevance: .3, Instructions: 272COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: d38a847d9370bba91ed3935733d594ce3305399c67660d5bb08561dfbf887e03
                                                                                                                                          • Instruction ID: 5c41e6a678bf4eab77527fa15608f020ae488bb8f1710fe525c8a8cbf4aa8419
                                                                                                                                          • Opcode Fuzzy Hash: d38a847d9370bba91ed3935733d594ce3305399c67660d5bb08561dfbf887e03
                                                                                                                                          • Instruction Fuzzy Hash: D8C17422B1C5AAD9FB10EB62D5642FD2365AF94348F804832DE0DA6ADADF3CD505D370
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F25C0 Relevance: .3, Instructions: 270COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 83c6439e09a40265a4e95b22acf488c3e8bcb13a6b9fe0244e0b503cf04d4d59
                                                                                                                                          • Instruction ID: 21dc1b9c2088620e0102393af8cd74af6787cfe143a409c5c6a58fea3cf34dda
                                                                                                                                          • Opcode Fuzzy Hash: 83c6439e09a40265a4e95b22acf488c3e8bcb13a6b9fe0244e0b503cf04d4d59
                                                                                                                                          • Instruction Fuzzy Hash: 5EB17022B2C5AAC2EA14EF22D5651FE6351EF94784F844832EE4D8779ADE3CE504C760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67124390 Relevance: .3, Instructions: 270COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 6932f466916dd60a901800d8cf2606beabf989d8d377ac7c79455be2081a79f4
                                                                                                                                          • Instruction ID: 469989dda8b39ca10d7265335b0b1ee740645f0fcd3224ee8cfe55fdad882ec0
                                                                                                                                          • Opcode Fuzzy Hash: 6932f466916dd60a901800d8cf2606beabf989d8d377ac7c79455be2081a79f4
                                                                                                                                          • Instruction Fuzzy Hash: CEA13B31A1C6BAC2EB619B2694343BA16F1AF84344F545932EE6E477C8EE3CDC41C760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712E48B Relevance: .3, Instructions: 258COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 3a38545368d800816d91fafedca056006431c0b1922fe48b29b4c2ab83955551
                                                                                                                                          • Instruction ID: b5923fcc0d6d826c02715e043479ff67e1b28dfb9e6be0d496d515169f30c60d
                                                                                                                                          • Opcode Fuzzy Hash: 3a38545368d800816d91fafedca056006431c0b1922fe48b29b4c2ab83955551
                                                                                                                                          • Instruction Fuzzy Hash: 56A1157280C2BAC5FB658A3280653797BF1EF11709F154433DAAE425D5DE2CEA89D730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67127AF0 Relevance: .3, Instructions: 255COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: c9aa67c4f42f0dc04bfc4c3fc88b13842e585507a9ff165ebfaf896c41a7855b
                                                                                                                                          • Instruction ID: 96e3b0afef3945bba5401bb06cec60a85f910f7996e330048cf88467e0277057
                                                                                                                                          • Opcode Fuzzy Hash: c9aa67c4f42f0dc04bfc4c3fc88b13842e585507a9ff165ebfaf896c41a7855b
                                                                                                                                          • Instruction Fuzzy Hash: E9A1BF32B0C66AD5EB10EB6294602BA22E5EF98784F440937DE5D537D5EF38E941C370
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670C7A40 Relevance: .3, Instructions: 255COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 416f41ac475a1bb2d945df44cd1e44e91a0a7360b86ad90bd37f89514c6d65ab
                                                                                                                                          • Instruction ID: b67bf4e4c0b4ca92fe8b7fc173992b9792a06436d6a81edae7ba75758e2f9517
                                                                                                                                          • Opcode Fuzzy Hash: 416f41ac475a1bb2d945df44cd1e44e91a0a7360b86ad90bd37f89514c6d65ab
                                                                                                                                          • Instruction Fuzzy Hash: A1B1A321B2C65AD1EA00EB22E4691FE6365FF94784F801832FA4E4769ADF3CE505D770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712E4AD Relevance: .2, Instructions: 250COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
                                                                                                                                          • Instruction ID: 5294df780cfba91cfe06979aab40d5e1b33e16349ab0bb0c888b0e7188b42704
                                                                                                                                          • Opcode Fuzzy Hash: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
                                                                                                                                          • Instruction Fuzzy Hash: C0A1367280C2BAC5FB658A32802537A3BB1EF11708F154433DAEE465D5DE2CEA89D730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712E49D Relevance: .2, Instructions: 248COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
                                                                                                                                          • Instruction ID: 74ba2630e6230bbd936a1decefbb181092ccd02935c5053fc779fc3082c0de49
                                                                                                                                          • Opcode Fuzzy Hash: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
                                                                                                                                          • Instruction Fuzzy Hash: A2A1367280C2BAC5FB658A32802537A7BF1EF11709F154433DAAE465D5DE2CEA89D730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712E4A6 Relevance: .2, Instructions: 248COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
                                                                                                                                          • Instruction ID: e0e9da7c3e9869cb0333a26431ac643db5d9525d82819a645906e64873d05359
                                                                                                                                          • Opcode Fuzzy Hash: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
                                                                                                                                          • Instruction Fuzzy Hash: 31A1267280C2BAC5FB658A32802537A7BB1EF11709F154433DAAE465D5DE2CEA89D730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712E4B6 Relevance: .2, Instructions: 248COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
                                                                                                                                          • Instruction ID: bd8021cbe37d2f6d0dabc166cd4f60138c8b0fc152884de69f09d8e1225c4239
                                                                                                                                          • Opcode Fuzzy Hash: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
                                                                                                                                          • Instruction Fuzzy Hash: 3FA1267280C2BAC5FB658A32802537A7BF1EF11705F154433DAAD465D5DE2CEA89DB30
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712E494 Relevance: .2, Instructions: 248COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
                                                                                                                                          • Instruction ID: 7a2e220692977701b417ff3be56bd98663de9707aa22b67a2a8d36ebf1f56f36
                                                                                                                                          • Opcode Fuzzy Hash: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
                                                                                                                                          • Instruction Fuzzy Hash: B7A1367280C2BAC5FB658A32802537A7BF1EF11709F154433DAAE465D5DE2CEA89D730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670C1010 Relevance: .2, Instructions: 229COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 4c0b3c74c90c8ebee581f861ac3507a9c6adabab669bf90753d4843c10547964
                                                                                                                                          • Instruction ID: c68592b63e5b3076dc9b7a7f157d5ba28381f570baffca0908ffa2234d77f27d
                                                                                                                                          • Opcode Fuzzy Hash: 4c0b3c74c90c8ebee581f861ac3507a9c6adabab669bf90753d4843c10547964
                                                                                                                                          • Instruction Fuzzy Hash: 60919136B0D66AC6EB50EB62D5742BD23A5AF84748F444832DE0E87B95EE3CE405C370
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670D65E0 Relevance: .2, Instructions: 218COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: d50560bdfbda826e81843fbf93004351cf64035d4d4cac07f969261b8185ab4f
                                                                                                                                          • Instruction ID: 58e6adaf04f4b18b863b11ab28f7770e31745f244224362a6ec96609ce38e199
                                                                                                                                          • Opcode Fuzzy Hash: d50560bdfbda826e81843fbf93004351cf64035d4d4cac07f969261b8185ab4f
                                                                                                                                          • Instruction Fuzzy Hash: 3BA16422B1C66AD9FB10EB72D5651FC2365AF94348F804932EA0D57ACAEF38E505D370
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670EF1F0 Relevance: .2, Instructions: 218COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 9870e55b1e5bf04e241743c4586011b4434590149557e7c254f0b1f56fdab86f
                                                                                                                                          • Instruction ID: 001343678d446d04201882c3837388923ae50b34d4d3df66cf78413a31a1a3df
                                                                                                                                          • Opcode Fuzzy Hash: 9870e55b1e5bf04e241743c4586011b4434590149557e7c254f0b1f56fdab86f
                                                                                                                                          • Instruction Fuzzy Hash: 0BA19E22A1C66AD5EA50EF22D4741FD2365EF94384F840832EA4D57A9ADF3CE506CB30
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670D8340 Relevance: .2, Instructions: 211COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: d7e81a262cda3168bcad7e7504a26cb2082127080fdf78040bff04c52d5a9599
                                                                                                                                          • Instruction ID: ca5011bcb9a503e4cd051b1944a73470f628b9bc4299dc10f8cde028ecc7d0c4
                                                                                                                                          • Opcode Fuzzy Hash: d7e81a262cda3168bcad7e7504a26cb2082127080fdf78040bff04c52d5a9599
                                                                                                                                          • Instruction Fuzzy Hash: 37913122F1C62AD9EB10EBB2C5651FC13659F94348F804836DD0D976CAEE2CE509D370
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670EE9A0 Relevance: .2, Instructions: 210COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Close
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3535843008-0
                                                                                                                                          • Opcode ID: abb5af3013fd6220e6665e7c4d856e09e457d9463e8ceb771b8041e35f9ca803
                                                                                                                                          • Instruction ID: 7edd39bd423bcd7ed2494c15ac87c4fa92519ffc8a892118dfa767b9ac05b3f5
                                                                                                                                          • Opcode Fuzzy Hash: abb5af3013fd6220e6665e7c4d856e09e457d9463e8ceb771b8041e35f9ca803
                                                                                                                                          • Instruction Fuzzy Hash: 0E91A122B2C56AD1EB00EB62D4695EE6365FF94784F801833EA4D43A9BDF3CD504CB60
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6713BF6F Relevance: .2, Instructions: 209COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 3bcda5f2e61e4c1def9d688b2f5660763abb74eff223fccdf401fc2a77c4feb5
                                                                                                                                          • Instruction ID: 6e5ed03eae513f3f001ba5eecf4b45f328a5982cdf5fe9e6da322c660c4ab47d
                                                                                                                                          • Opcode Fuzzy Hash: 3bcda5f2e61e4c1def9d688b2f5660763abb74eff223fccdf401fc2a77c4feb5
                                                                                                                                          • Instruction Fuzzy Hash: E9817076A182A9CBE764CF2A8058B6D36A8FF04754F11497ADF4D87B84DF39E840CB50
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670FF870 Relevance: .2, Instructions: 207COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: b85e566c5cd1b3efafa7de1cf7fdb180de4cf711e5ead7e0c2a340013c9006fe
                                                                                                                                          • Instruction ID: 3a1b889e16bcc08509788f1d13176ad25cebf2091a465961d1f8f3942883a97d
                                                                                                                                          • Opcode Fuzzy Hash: b85e566c5cd1b3efafa7de1cf7fdb180de4cf711e5ead7e0c2a340013c9006fe
                                                                                                                                          • Instruction Fuzzy Hash: 1381B962A0CA6AC6EB218B2BD66007D6B65FF85B90F184532CE8E87755CE3CF441C730
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E82E0 Relevance: .2, Instructions: 202COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: f1f3b5d1f381441116eef44686c6cbc86ac4360f19897277b7bf3a5d517a81fc
                                                                                                                                          • Instruction ID: dde992cd60c7d717485350bfd260ffbd8b66da1e6164a84abbf2e7da0e465343
                                                                                                                                          • Opcode Fuzzy Hash: f1f3b5d1f381441116eef44686c6cbc86ac4360f19897277b7bf3a5d517a81fc
                                                                                                                                          • Instruction Fuzzy Hash: 39917E22B1C56ACAF710EB62D4612FE23A0EF94748F845832DA4E876D6DF2CE445D770
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F0300 Relevance: .2, Instructions: 200COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: ce8bba41df0b631ae6b7206df5ab0a6277447c4f11eb6ec05468c548c9ecf811
                                                                                                                                          • Instruction ID: a701dd3ee7d457476a5bf1ab615e861c55e515390d5bb5e62fddeeeaee816f4b
                                                                                                                                          • Opcode Fuzzy Hash: ce8bba41df0b631ae6b7206df5ab0a6277447c4f11eb6ec05468c548c9ecf811
                                                                                                                                          • Instruction Fuzzy Hash: 80914E32B1C56AD6EB10EBB2D5612ED2361AF80358F800932DE1D979DADF3CE555C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67126950 Relevance: .2, Instructions: 194COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 6f8adc0b036d941ec198f692a244335db4514cc05e594f38ae55f616912a3bd7
                                                                                                                                          • Instruction ID: db80741e59f62828d35134157fef7e6361663c7e0c789090f681b1ea5a1fefaf
                                                                                                                                          • Opcode Fuzzy Hash: 6f8adc0b036d941ec198f692a244335db4514cc05e594f38ae55f616912a3bd7
                                                                                                                                          • Instruction Fuzzy Hash: 76817122B1C66AD5EB00EF72D5711FD23659F84788B844932EE1D87AC6EF38E505C760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F2E10 Relevance: .2, Instructions: 182COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: f4ab40f336fdfb1061e144a8cc54dd8d077ea0d8f8a68ce9c2a609d9519aa0c7
                                                                                                                                          • Instruction ID: 3ea768013565d162a61b8ddd2a238cb8e7b319b364739ed23abfeb19a90b33b3
                                                                                                                                          • Opcode Fuzzy Hash: f4ab40f336fdfb1061e144a8cc54dd8d077ea0d8f8a68ce9c2a609d9519aa0c7
                                                                                                                                          • Instruction Fuzzy Hash: 28719321B0D66AD5EB14EB72D2742BD5291DF88788F444836EE0D87BCAEE3CE505D321
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67127EC0 Relevance: .2, Instructions: 181COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 4dcde41e0a7583d518310dfbb963ee780db1660248ca706961fee8ac5049723c
                                                                                                                                          • Instruction ID: 3c4b9f7f2dd86e03d3a2c492313c7645135a8887e6ff404908b938808a703ce6
                                                                                                                                          • Opcode Fuzzy Hash: 4dcde41e0a7583d518310dfbb963ee780db1660248ca706961fee8ac5049723c
                                                                                                                                          • Instruction Fuzzy Hash: AC611521B1C66AC1EB50EB2395315BA52A0EF857D0F444A33EE6D877D6EF2CE441CB20
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712A6B0 Relevance: .2, Instructions: 174COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 90c36971f46e003a861835c282887fceece629fa51251a8ea25984ac83311837
                                                                                                                                          • Instruction ID: 501d39a54b2ef7533b12af3bdbe2dab0ad59bb3b8de8c2f7c0a40a5bfeceffd7
                                                                                                                                          • Opcode Fuzzy Hash: 90c36971f46e003a861835c282887fceece629fa51251a8ea25984ac83311837
                                                                                                                                          • Instruction Fuzzy Hash: 79715736B0CA2AC9EB14DB66D0712BD23A1EF84B48F544832DE0E47B89DE38D549C720
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6711F2C0 Relevance: .2, Instructions: 169COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 798e347792bcf9b81b96428d86b51cfbcdcb2c80bf44afc999fdb096d1e74fe6
                                                                                                                                          • Instruction ID: 9ac892af78273f6a22dcb2e7bb72484fa6067b4af3325719340a8486194df159
                                                                                                                                          • Opcode Fuzzy Hash: 798e347792bcf9b81b96428d86b51cfbcdcb2c80bf44afc999fdb096d1e74fe6
                                                                                                                                          • Instruction Fuzzy Hash: ED61A621B1D56AD5FB10EB72C0742FD1365AF88788F844833EA0D5BACAEE2CD501E761
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670C1620 Relevance: .2, Instructions: 166COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: b4dc2bfabc17449b75592575b237d49754ff1d7599ab7260522444cf79d2ee90
                                                                                                                                          • Instruction ID: bd216cceeabf8faf67b2f5684bec936890e3dd5d06c7de24641fe20e0585b771
                                                                                                                                          • Opcode Fuzzy Hash: b4dc2bfabc17449b75592575b237d49754ff1d7599ab7260522444cf79d2ee90
                                                                                                                                          • Instruction Fuzzy Hash: 2C61A722A2C66AC1FA20EB16D0756BE6361FF85784F805932FA5D47ACADF3CD504D720
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F21D0 Relevance: .2, Instructions: 155COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Close
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3535843008-0
                                                                                                                                          • Opcode ID: 879cfdad07db6dd87252a24be95836cbeb42ffab31f611b4c9adb5531f6bcd0b
                                                                                                                                          • Instruction ID: aa371db465e6a3eebc202bc9e40974dc834bf116b6b75f17401475df75ce5d30
                                                                                                                                          • Opcode Fuzzy Hash: 879cfdad07db6dd87252a24be95836cbeb42ffab31f611b4c9adb5531f6bcd0b
                                                                                                                                          • Instruction Fuzzy Hash: ED719B32A1C699D9EB10EF62D4642ED7761FF84348F844432EA4D47A8ADF7CE548CB20
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712AAA0 Relevance: .2, Instructions: 150COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Close
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3535843008-0
                                                                                                                                          • Opcode ID: 275f6da6b97318c83fb225dda8a1cf2de2bb796bd6b45b7edf39d740dbf5db77
                                                                                                                                          • Instruction ID: a71eb33b07153204e8a72bc6600ab81f7c7120c8a01e38ab7ca8b6f2a320d363
                                                                                                                                          • Opcode Fuzzy Hash: 275f6da6b97318c83fb225dda8a1cf2de2bb796bd6b45b7edf39d740dbf5db77
                                                                                                                                          • Instruction Fuzzy Hash: 4E517532A1C56AD6FB50EB62D4752FE6361FF84344F840832EA4D47A9ADE2CE544DB20
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670DE770 Relevance: .1, Instructions: 143COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 0cfd4d3a38dcc9c286a30951bdd9187095240217e9738b6b55d4f719d628df71
                                                                                                                                          • Instruction ID: 82ac3c10ca98d0d09637ed8355f4b5ab220335fcb4da00906bc4a41f9ca85301
                                                                                                                                          • Opcode Fuzzy Hash: 0cfd4d3a38dcc9c286a30951bdd9187095240217e9738b6b55d4f719d628df71
                                                                                                                                          • Instruction Fuzzy Hash: 8F51C232A1C79AC5EB10DB26D4A42BDA3A1FF85784F404936EA4D47BDADE3CD501CB20
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E3340 Relevance: .1, Instructions: 140COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: dde20b107614cf7f05154718f8ba7f9bd15b3d18a84ad2b0ec48881977a5ed00
                                                                                                                                          • Instruction ID: e63a974e16e48b22ef300a31934539b827998cf2d45591566448f5dc67f31cf6
                                                                                                                                          • Opcode Fuzzy Hash: dde20b107614cf7f05154718f8ba7f9bd15b3d18a84ad2b0ec48881977a5ed00
                                                                                                                                          • Instruction Fuzzy Hash: 14613932508B85C1E750DF32A454AED33A9FB48B88F984539EE9D4B35ADF398056E334
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC6712A490 Relevance: .1, Instructions: 138COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 9d04c4905bf18e0a6290439cd50923c1c84a3f6567b06c6e696e708ae0d6a31f
                                                                                                                                          • Instruction ID: 05b05996f8a2426751c498e914511c575ae22d3027ed914654adfc16f981c537
                                                                                                                                          • Opcode Fuzzy Hash: 9d04c4905bf18e0a6290439cd50923c1c84a3f6567b06c6e696e708ae0d6a31f
                                                                                                                                          • Instruction Fuzzy Hash: DC51722272C5AAD1EA50EB23D5656AE6365FF85BC0F805833EE4D43B86DE3CD404DB50
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F1B30 Relevance: .1, Instructions: 132COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: c88a559203c7cebfbd6855f8d2fd484b342d8cb8f626eff4b2b47ba49cdf8c80
                                                                                                                                          • Instruction ID: aa11da51afd0b857bbaa584026fa050e44764d5caa9f7f21b5103401461f73f4
                                                                                                                                          • Opcode Fuzzy Hash: c88a559203c7cebfbd6855f8d2fd484b342d8cb8f626eff4b2b47ba49cdf8c80
                                                                                                                                          • Instruction Fuzzy Hash: B4518122B1C55AD9FB10DB62D4716FD2365AF84788F844832EE0D96ACADE3CE505D360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670EE7B0 Relevance: .1, Instructions: 125COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 0ae699ce5c0bbda65b5b1ef91aada53cd0acd1d5adef34fe9746f0cfa28bcfde
                                                                                                                                          • Instruction ID: 2686e77250481ddc1aefde792cd29611379c958248e71f9e9655d3a39b1f9c3e
                                                                                                                                          • Opcode Fuzzy Hash: 0ae699ce5c0bbda65b5b1ef91aada53cd0acd1d5adef34fe9746f0cfa28bcfde
                                                                                                                                          • Instruction Fuzzy Hash: 0B51A222B1C56AD5FB50EB72D4653FE6361BF84348F840832EA4D4698ADF3CE549DB20
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F0020 Relevance: .1, Instructions: 125COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 93de49f56272cc95a8d74b98ed4d3cc6bbdaf70b6a689fecc50139941e1158ee
                                                                                                                                          • Instruction ID: 79f8dd94e3813cfb9124b726a28ced120187c219456e1079bc472f40f3eacc62
                                                                                                                                          • Opcode Fuzzy Hash: 93de49f56272cc95a8d74b98ed4d3cc6bbdaf70b6a689fecc50139941e1158ee
                                                                                                                                          • Instruction Fuzzy Hash: 8C51B132A1CA6AD2EA10DB22C5655BE6364FF98750F814932EE0D83792DF3CE155C720
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67122AE0 Relevance: .1, Instructions: 122COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: a0c5eff94ab1069691c4844bc6226e708b04ada7520549e9c415e38db7fabc1b
                                                                                                                                          • Instruction ID: 58f2c44165fd3c0acecf53169d14a9bdb0eef9b183e5b6a77f0c3d529a34d619
                                                                                                                                          • Opcode Fuzzy Hash: a0c5eff94ab1069691c4844bc6226e708b04ada7520549e9c415e38db7fabc1b
                                                                                                                                          • Instruction Fuzzy Hash: DC417F22F2C53AC5FB14EB7298651FD1261AF88784F854832EE1E57A9ADE2CD541D320
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E3610 Relevance: .1, Instructions: 118COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 20a67f7206456b2db2724d6fae160af65c8de3ea401ed3a1e642dae891dc2ed5
                                                                                                                                          • Instruction ID: 9084fd8b620d442859af02e8f1ad31bb6c8aa8fa693755aebda6e0ae5634f256
                                                                                                                                          • Opcode Fuzzy Hash: 20a67f7206456b2db2724d6fae160af65c8de3ea401ed3a1e642dae891dc2ed5
                                                                                                                                          • Instruction Fuzzy Hash: AD510632618BA4C5E744DF36E8542DD33A8FB48F88F58853AEA8D4B799DF348052D760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670F5CD0 Relevance: .1, Instructions: 117COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 8d5522483151d29cc1ab9e0e0eb5f9bdd0ac6375b7f5cd2107375de97b23ccdb
                                                                                                                                          • Instruction ID: 7f7e2a35a9c7d226aee8e6aef9966f9abd1dcac2b6e9d73ddd2415d1dc7a8aa8
                                                                                                                                          • Opcode Fuzzy Hash: 8d5522483151d29cc1ab9e0e0eb5f9bdd0ac6375b7f5cd2107375de97b23ccdb
                                                                                                                                          • Instruction Fuzzy Hash: A7511472709755CAE7649F71A0603AE3692EF84308F148939EA4E0BBC9DF3DC411C720
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E92C0 Relevance: .1, Instructions: 111COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CreateMutex
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 1964310414-0
                                                                                                                                          • Opcode ID: ed485ed79017828fa275668a6b240ee44ec333649149c50830fa5468da009089
                                                                                                                                          • Instruction ID: 0d2a502285d57ebc34fc421785ceaf53f410ae01ac71eae8710981951f9a23ff
                                                                                                                                          • Opcode Fuzzy Hash: ed485ed79017828fa275668a6b240ee44ec333649149c50830fa5468da009089
                                                                                                                                          • Instruction Fuzzy Hash: 52517A32718A96E2E708DB22D5A13E9B368FF48340F908426DB5C57655CF38E1B6D710
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670E2F50 Relevance: .1, Instructions: 108COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 329e3b8f024e1dd1533882e6a9b116661807d52ce56c67e8b288f43a3d04241f
                                                                                                                                          • Instruction ID: 25faf22ec587904ae01c65cff4c3d4824544fe37a83aebe7ffc93a729283a812
                                                                                                                                          • Opcode Fuzzy Hash: 329e3b8f024e1dd1533882e6a9b116661807d52ce56c67e8b288f43a3d04241f
                                                                                                                                          • Instruction Fuzzy Hash: 57511832618BA5C5E744DF35E8512DD33A8FB48F88F58453AEA8D4B799DF348052D360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC67125760 Relevance: .1, Instructions: 93COMMONLIBRARYCODE
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 5a3e9a54e1fe4ebffb9e64bf804787288841480151686f3b26699af22df9eaf9
                                                                                                                                          • Instruction ID: c083a88df49a69033581e0a1463ab54f4693d5f5c4adab289f5ad5f0932ea1ae
                                                                                                                                          • Opcode Fuzzy Hash: 5a3e9a54e1fe4ebffb9e64bf804787288841480151686f3b26699af22df9eaf9
                                                                                                                                          • Instruction Fuzzy Hash: 4F314872A0CA69C2F6549B07A4A127976A1EF88340F948577DBAD433C8DEBCD8C1C760
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670C5350 Relevance: .1, Instructions: 77COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 25f9d156710a96b2c26b0618203b3b02571b95e83806bfe28e8d5b0c11668b02
                                                                                                                                          • Instruction ID: bef1246b6bd62546e7d08921d2c2a35d93a2278047012230672b22c551db1aa6
                                                                                                                                          • Opcode Fuzzy Hash: 25f9d156710a96b2c26b0618203b3b02571b95e83806bfe28e8d5b0c11668b02
                                                                                                                                          • Instruction Fuzzy Hash: BD315C32624B54D1E248DF26D8942ED73A9FB88B88FA88436E38C07695DF79D063D310
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC670C7E80 Relevance: .1, Instructions: 72COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000000.00000002.280898080.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFC670C0000, based on PE: true
                                                                                                                                          • Associated: 00000000.00000002.280888844.00007FFC670C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281038615.00007FFC67143000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281053176.00007FFC67156000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          • Associated: 00000000.00000002.281057803.00007FFC67158000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_0_2_7ffc670c0000_loaddll64.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 288751330fbc12dfa7c57884471a2cf55a6adf9df6ede5974d900619b2209c55
                                                                                                                                          • Instruction ID: 4680ba70c6a3af8f97329cdf6f7b6a2c3e848f611ae0c9f168beba79b5b52dee
                                                                                                                                          • Opcode Fuzzy Hash: 288751330fbc12dfa7c57884471a2cf55a6adf9df6ede5974d900619b2209c55
                                                                                                                                          • Instruction Fuzzy Hash: 11311036614B44C0D740DF3599942ED72E9FF98B88FA88836D64C4A5A5DF79C057E320
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Execution Graph

                                                                                                                                          Execution Coverage:18.7%
                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                          Signature Coverage:0%
                                                                                                                                          Total number of Nodes:15
                                                                                                                                          Total number of Limit Nodes:1
                                                                                                                                          execution_graph 226 16bb42f2978 227 16bb42f2986 226->227 232 16bb42f2060 VirtualAlloc 227->232 229 16bb42f29a2 234 16bb42f2264 229->234 231 16bb42f29ba 233 16bb42f20c4 232->233 233->229 235 16bb42f230f 234->235 236 16bb42f238c VirtualProtect 234->236 235->236 237 16bb42f23ee 236->237 238 16bb42f244d VirtualProtect 237->238 239 16bb42f2507 VirtualProtect 238->239 240 16bb42f2544 238->240 239->240 242 16bb42f25c5 240->242 243 16bb42f258c RtlAvlRemoveNode 240->243 242->231 243->242

                                                                                                                                          Callgraph

                                                                                                                                          Executed Functions

                                                                                                                                          Function 0000016BB42F2264 Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000002.00000002.382570831.0000016BB42F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000016BB42F0000, based on PE: true
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_2_2_16bb42f0000_rundll32.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ProtectVirtual$NodeRemove
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3879549435-0
                                                                                                                                          • Opcode ID: 998c333fcbc94d6503e1fd2d6b22b9b8446f434769f01d9b0eba9ba6cd5b82e5
                                                                                                                                          • Instruction ID: 5ca31b123752109fed6dfc990a2c84b796dcea46d53c83c6776e3a80e7e81efd
                                                                                                                                          • Opcode Fuzzy Hash: 998c333fcbc94d6503e1fd2d6b22b9b8446f434769f01d9b0eba9ba6cd5b82e5
                                                                                                                                          • Instruction Fuzzy Hash: E5B146B6619BC586D770CB1AE4407DAB7A0F7C9B80F508026DE8D93B58DB7EC8918F40
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 0000016BB42F2060 Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          • VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000016BB42F29A2), ref: 0000016BB42F20B0
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000002.00000002.382570831.0000016BB42F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000016BB42F0000, based on PE: true
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_2_2_16bb42f0000_rundll32.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: AllocVirtual
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 4275171209-0
                                                                                                                                          • Opcode ID: efef561593cea6ec73f14c0a970d655c71aa6a4b298494007811926080961454
                                                                                                                                          • Instruction ID: ae7ab2af6aaaf4eea882d31288538f28078403b75ffac0795b8bf6b8cfb94fce
                                                                                                                                          • Opcode Fuzzy Hash: efef561593cea6ec73f14c0a970d655c71aa6a4b298494007811926080961454
                                                                                                                                          • Instruction Fuzzy Hash: B13145B6615B5086D790DF1AE45579A7BB0F389BD4F605026EF8D87B18DF3AC442CB00
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Execution Graph

                                                                                                                                          Execution Coverage:18.7%
                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                          Signature Coverage:0%
                                                                                                                                          Total number of Nodes:15
                                                                                                                                          Total number of Limit Nodes:1
                                                                                                                                          execution_graph 226 17f7c0b2978 227 17f7c0b2986 226->227 232 17f7c0b2060 VirtualAlloc 227->232 229 17f7c0b29a2 234 17f7c0b2264 229->234 231 17f7c0b29ba 233 17f7c0b20c4 232->233 233->229 235 17f7c0b238c VirtualProtect 234->235 236 17f7c0b230f 234->236 237 17f7c0b23ee 235->237 236->235 238 17f7c0b244d VirtualProtect 237->238 239 17f7c0b2507 VirtualProtect 238->239 240 17f7c0b2544 238->240 239->240 241 17f7c0b25c5 240->241 243 17f7c0b258c RtlAvlRemoveNode 240->243 241->231 243->241

                                                                                                                                          Callgraph

                                                                                                                                          Executed Functions

                                                                                                                                          Function 0000017F7C0B2264 Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000003.00000002.260779016.0000017F7C0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000017F7C0B0000, based on PE: true
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_3_2_17f7c0b0000_rundll32.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ProtectVirtual$NodeRemove
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3879549435-0
                                                                                                                                          • Opcode ID: 998c333fcbc94d6503e1fd2d6b22b9b8446f434769f01d9b0eba9ba6cd5b82e5
                                                                                                                                          • Instruction ID: e719557f0ef0e3437d2ec4e387c8b40f73434386ceea93628adf7f00931d7e6c
                                                                                                                                          • Opcode Fuzzy Hash: 998c333fcbc94d6503e1fd2d6b22b9b8446f434769f01d9b0eba9ba6cd5b82e5
                                                                                                                                          • Instruction Fuzzy Hash: 10B14276618BC586D770CF1AE4407DAB7A1F789B80F10812AEE8D97B58DB79C852CF40
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 0000017F7C0B2060 Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          • VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000017F7C0B29A2), ref: 0000017F7C0B20B0
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000003.00000002.260779016.0000017F7C0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000017F7C0B0000, based on PE: true
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_3_2_17f7c0b0000_rundll32.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: AllocVirtual
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 4275171209-0
                                                                                                                                          • Opcode ID: efef561593cea6ec73f14c0a970d655c71aa6a4b298494007811926080961454
                                                                                                                                          • Instruction ID: 7a537a4debf569a3a6e8b95bb188fe87d85134cd4551affd1cc852f0a2e120db
                                                                                                                                          • Opcode Fuzzy Hash: efef561593cea6ec73f14c0a970d655c71aa6a4b298494007811926080961454
                                                                                                                                          • Instruction Fuzzy Hash: 4F316D72619B8086D790CF1AE45479A7BB5F389BC4F204026EF8D87B18DF39C442CB00
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Execution Graph

                                                                                                                                          Execution Coverage:18.7%
                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                          Signature Coverage:0%
                                                                                                                                          Total number of Nodes:15
                                                                                                                                          Total number of Limit Nodes:1
                                                                                                                                          execution_graph 226 28586ab2978 227 28586ab2986 226->227 232 28586ab2060 VirtualAlloc 227->232 229 28586ab29a2 234 28586ab2264 229->234 231 28586ab29ba 233 28586ab20c4 232->233 233->229 235 28586ab230f 234->235 236 28586ab238c VirtualProtect 234->236 235->236 237 28586ab23ee 236->237 238 28586ab244d VirtualProtect 237->238 239 28586ab2544 238->239 240 28586ab2507 VirtualProtect 238->240 242 28586ab25c5 239->242 243 28586ab258c RtlAvlRemoveNode 239->243 240->239 242->231 243->242

                                                                                                                                          Callgraph

                                                                                                                                          Executed Functions

                                                                                                                                          Function 0000028586AB2264 Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.267231227.0000028586AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028586AB0000, based on PE: true
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_28586ab0000_rundll32.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ProtectVirtual$NodeRemove
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3879549435-0
                                                                                                                                          • Opcode ID: 998c333fcbc94d6503e1fd2d6b22b9b8446f434769f01d9b0eba9ba6cd5b82e5
                                                                                                                                          • Instruction ID: fd1a52e41380e52db3b08651ed09dd0c757b1c1ed48366bd9bbe19f53a1a7662
                                                                                                                                          • Opcode Fuzzy Hash: 998c333fcbc94d6503e1fd2d6b22b9b8446f434769f01d9b0eba9ba6cd5b82e5
                                                                                                                                          • Instruction Fuzzy Hash: 39B15576619BD48AE7308B1AE44079AB7A0F7C9B80F108126DE8D57B59DF7DC8918F40
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 0000028586AB2060 Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          • VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000028586AB29A2), ref: 0000028586AB20B0
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.267231227.0000028586AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028586AB0000, based on PE: true
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_28586ab0000_rundll32.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: AllocVirtual
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 4275171209-0
                                                                                                                                          • Opcode ID: efef561593cea6ec73f14c0a970d655c71aa6a4b298494007811926080961454
                                                                                                                                          • Instruction ID: 1f60db79b2323e68ca107062d3cd1dafe3a2fc7688294d88ad32c2db47cd93f6
                                                                                                                                          • Opcode Fuzzy Hash: efef561593cea6ec73f14c0a970d655c71aa6a4b298494007811926080961454
                                                                                                                                          • Instruction Fuzzy Hash: 04313C76615B90C6D790DF1AE45579A7BB0F389BD4F205026EF8D87B18DF39C4928B00
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Execution Graph

                                                                                                                                          Execution Coverage:18.7%
                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                          Signature Coverage:0%
                                                                                                                                          Total number of Nodes:15
                                                                                                                                          Total number of Limit Nodes:1
                                                                                                                                          execution_graph 226 2541e152978 227 2541e152986 226->227 232 2541e152060 VirtualAlloc 227->232 229 2541e1529a2 234 2541e152264 229->234 231 2541e1529ba 233 2541e1520c4 232->233 233->229 235 2541e15238c VirtualProtect 234->235 236 2541e15230f 234->236 237 2541e1523ee 235->237 236->235 238 2541e15244d VirtualProtect 237->238 239 2541e152544 238->239 240 2541e152507 VirtualProtect 238->240 242 2541e1525c5 239->242 243 2541e15258c RtlAvlRemoveNode 239->243 240->239 242->231 243->242

                                                                                                                                          Callgraph

                                                                                                                                          Executed Functions

                                                                                                                                          Function 000002541E152264 Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000008.00000002.274411537.000002541E150000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002541E150000, based on PE: true
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_8_2_2541e150000_rundll32.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ProtectVirtual$NodeRemove
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3879549435-0
                                                                                                                                          • Opcode ID: 998c333fcbc94d6503e1fd2d6b22b9b8446f434769f01d9b0eba9ba6cd5b82e5
                                                                                                                                          • Instruction ID: 65178579c813a73490c4558726b051dd2e145203941277cfc54773149d0ef565
                                                                                                                                          • Opcode Fuzzy Hash: 998c333fcbc94d6503e1fd2d6b22b9b8446f434769f01d9b0eba9ba6cd5b82e5
                                                                                                                                          • Instruction Fuzzy Hash: 50B152B7618BC486D7708B1AE4407DEBBA0F789B84F108126EE8D57B58DB79C891CF40
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 000002541E152060 Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          • VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000002541E1529A2), ref: 000002541E1520B0
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000008.00000002.274411537.000002541E150000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002541E150000, based on PE: true
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_8_2_2541e150000_rundll32.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: AllocVirtual
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 4275171209-0
                                                                                                                                          • Opcode ID: efef561593cea6ec73f14c0a970d655c71aa6a4b298494007811926080961454
                                                                                                                                          • Instruction ID: 138e2dda3d538cdbc352a54361c6ed647ea653878e19b56facb592d8b3b90fed
                                                                                                                                          • Opcode Fuzzy Hash: efef561593cea6ec73f14c0a970d655c71aa6a4b298494007811926080961454
                                                                                                                                          • Instruction Fuzzy Hash: 43314B76615F9086D790DF1AE45479A7BB0F789BC4F204026EF8D87B18DF7AC4928B04
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Execution Graph

                                                                                                                                          Execution Coverage:2.8%
                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                          Signature Coverage:0%
                                                                                                                                          Total number of Nodes:399
                                                                                                                                          Total number of Limit Nodes:49
                                                                                                                                          execution_graph 79057 7ffc74c67200 79058 7ffc74c6725f 79057->79058 79059 7ffc74c67215 79057->79059 79063 7ffc74c67229 79059->79063 79072 7ffc74c69ad0 79059->79072 79062 7ffc74c67252 79063->79062 79064 7ffc74c67190 79063->79064 79065 7ffc74c671ee 79064->79065 79066 7ffc74c67195 79064->79066 79065->79062 79066->79065 79067 7ffc74c69ad0 _RunAllParam 2 API calls 79066->79067 79068 7ffc74c671b5 79067->79068 79068->79065 79069 7ffc74c69ad0 _RunAllParam 2 API calls 79068->79069 79070 7ffc74c671db 79069->79070 79070->79065 79071 7ffc74c671e0 RtlReleasePrivilege 79070->79071 79071->79065 79074 7ffc74c69ae5 _RunAllParam 79072->79074 79073 7ffc74c69af2 79073->79063 79074->79073 79082 7ffc74c686f0 79074->79082 79076 7ffc74c69b06 79077 7ffc74c69b1d 79076->79077 79088 7ffc74c697d0 79076->79088 79077->79073 79106 7ffc74c68a60 79077->79106 79080 7ffc74c69b12 79080->79073 79081 7ffc74c686f0 _RunAllParam 2 API calls 79080->79081 79081->79077 79084 7ffc74c68728 79082->79084 79083 7ffc74c68796 _RunAllParam 79083->79076 79084->79083 79086 7ffc74c688a3 _RunAllParam 79084->79086 79112 7ffc74c85760 79084->79112 79086->79083 79087 7ffc74c69ad0 _RunAllParam 2 API calls 79086->79087 79087->79083 79089 7ffc74c697f6 _RunAllParam 79088->79089 79116 7ffc74c69230 79089->79116 79092 7ffc74c7ec40 _RunAllParam FindNextFileW 79105 7ffc74c69a43 _RunAllParam 79092->79105 79093 7ffc74c6980c _RunAllParam 79095 7ffc74c69917 _RunAllParam 79093->79095 79102 7ffc74c69912 _RunAllParam 79093->79102 79120 7ffc74c66180 79093->79120 79125 7ffc74c7ec70 79093->79125 79131 7ffc74c60150 79095->79131 79097 7ffc74c69960 _RunAllParam 79098 7ffc74c69ad0 _RunAllParam FindNextFileW 79097->79098 79099 7ffc74c699c4 _RunAllParam 79098->79099 79100 7ffc74c699f2 79099->79100 79101 7ffc74c699e0 LdrLoadDll 79099->79101 79100->79102 79103 7ffc74c69a02 _RunAllParam 79100->79103 79101->79100 79102->79092 79102->79105 79103->79105 79134 7ffc74c7ec40 79103->79134 79105->79080 79108 7ffc74c68a78 _RunAllParam 79106->79108 79107 7ffc74c68b72 _RunAllParam 79110 7ffc74c69ad0 _RunAllParam 2 API calls 79107->79110 79111 7ffc74c68a8b _RunAllParam 79107->79111 79108->79107 79108->79108 79109 7ffc74c85760 _RunAllParam 2 API calls 79108->79109 79108->79111 79109->79108 79110->79111 79111->79073 79111->79111 79114 7ffc74c8580c 79112->79114 79115 7ffc74c85792 79112->79115 79113 7ffc74c69ad0 _RunAllParam 2 API calls 79113->79115 79114->79084 79115->79113 79115->79114 79117 7ffc74c6923e _RunAllParam 79116->79117 79118 7ffc74c69ad0 _RunAllParam 2 API calls 79117->79118 79119 7ffc74c69270 _RunAllParam 79117->79119 79118->79119 79119->79093 79137 7ffc74c655b0 79120->79137 79122 7ffc74c85760 _RunAllParam 2 API calls 79123 7ffc74c661ca 79122->79123 79123->79093 79124 7ffc74c6619a 79124->79122 79129 7ffc74c7ec80 79125->79129 79126 7ffc74c69ad0 _RunAllParam LdrLoadDll 79126->79129 79127 7ffc74c7ece4 79127->79093 79128 7ffc74c7ec94 FindNextFileW 79128->79129 79129->79126 79129->79127 79129->79128 79143 7ffc74c6d730 79129->79143 79157 7ffc74c600b0 79131->79157 79133 7ffc74c60170 79133->79097 79135 7ffc74c69ad0 _RunAllParam 2 API calls 79134->79135 79136 7ffc74c7ec58 79135->79136 79136->79105 79138 7ffc74c655dc 79137->79138 79142 7ffc74c6566c _RunAllParam 79137->79142 79139 7ffc74c69ad0 _RunAllParam 2 API calls 79138->79139 79138->79142 79140 7ffc74c65619 _RunAllParam 79139->79140 79141 7ffc74c69ad0 _RunAllParam 2 API calls 79140->79141 79141->79142 79142->79124 79145 7ffc74c6d771 79143->79145 79144 7ffc74c6dd82 79144->79129 79145->79144 79146 7ffc74c85760 _RunAllParam 2 API calls 79145->79146 79150 7ffc74c6d928 _RunAllParam 79145->79150 79153 7ffc74c6d917 _RunAllParam 79145->79153 79146->79145 79147 7ffc74c68a60 _RunAllParam 2 API calls 79147->79144 79148 7ffc74c697d0 _RunAllParam 2 API calls 79149 7ffc74c6daba 79148->79149 79149->79144 79151 7ffc74c85760 _RunAllParam 2 API calls 79149->79151 79154 7ffc74c6dc05 _RunAllParam 79149->79154 79156 7ffc74c6dbf4 _RunAllParam 79149->79156 79152 7ffc74c69ad0 _RunAllParam 2 API calls 79150->79152 79150->79153 79151->79149 79152->79153 79153->79148 79153->79156 79154->79144 79155 7ffc74c69ad0 _RunAllParam 2 API calls 79154->79155 79154->79156 79155->79156 79156->79144 79156->79147 79158 7ffc74c600ce 79157->79158 79161 7ffc74c600de 79157->79161 79163 7ffc74c66d80 LdrLoadDll FindNextFileW _RunAllParam 79158->79163 79160 7ffc74c60123 79160->79133 79161->79160 79164 7ffc74c66df0 79161->79164 79163->79161 79165 7ffc74c66e0d 79164->79165 79166 7ffc74c66e26 79164->79166 79165->79166 79167 7ffc74c69ad0 _RunAllParam 2 API calls 79165->79167 79166->79160 79167->79166 79168 7ffc74c670f0 79169 7ffc74c67110 79168->79169 79170 7ffc74c67146 79168->79170 79171 7ffc74c69ad0 _RunAllParam 2 API calls 79169->79171 79172 7ffc74c69ad0 _RunAllParam 2 API calls 79170->79172 79174 7ffc74c6711f 79171->79174 79173 7ffc74c67155 79172->79173 79174->79170 79175 7ffc74c67128 RtlCreateHeap 79174->79175 79175->79170 79176 7ffc74c7ed10 79190 7ffc74c7ddc0 79176->79190 79179 7ffc74c69ad0 _RunAllParam 2 API calls 79180 7ffc74c7ed4e 79179->79180 79181 7ffc74c7ed53 FindFirstFileExW 79180->79181 79183 7ffc74c7eda4 79180->79183 79182 7ffc74c7ed78 79181->79182 79188 7ffc74c7ed95 79181->79188 79186 7ffc74c69ad0 _RunAllParam 2 API calls 79182->79186 79182->79188 79184 7ffc74c69ad0 _RunAllParam 2 API calls 79183->79184 79183->79188 79184->79188 79185 7ffc74c6d730 _RunAllParam 2 API calls 79187 7ffc74c7ee52 79185->79187 79186->79188 79188->79185 79189 7ffc74c7edea 79188->79189 79191 7ffc74c7ddeb 79190->79191 79192 7ffc74c7eb83 79191->79192 79229 7ffc74c66d10 79191->79229 79192->79179 79194 7ffc74c85760 _RunAllParam 2 API calls 79195 7ffc74c7de4c 79194->79195 79195->79194 79198 7ffc74c7e47a 79195->79198 79206 7ffc74c7e027 _RunAllParam 79195->79206 79211 7ffc74c7e016 _RunAllParam 79195->79211 79196 7ffc74c697d0 _RunAllParam 2 API calls 79209 7ffc74c7e1ab 79196->79209 79197 7ffc74c68a60 _RunAllParam 2 API calls 79197->79198 79233 7ffc74c69540 79198->79233 79200 7ffc74c7e4e0 79275 7ffc74c6ca50 79200->79275 79203 7ffc74c7e51f 79378 7ffc74c79410 NtClose LdrLoadDll FindNextFileW _RunAllParam 79203->79378 79204 7ffc74c7e54c 79303 7ffc74c6a2c0 79204->79303 79210 7ffc74c69ad0 _RunAllParam 2 API calls 79206->79210 79206->79211 79208 7ffc74c85760 _RunAllParam 2 API calls 79208->79209 79209->79198 79209->79208 79215 7ffc74c7e2f7 _RunAllParam 79209->79215 79220 7ffc74c7e2e6 _RunAllParam 79209->79220 79210->79211 79211->79196 79211->79220 79212 7ffc74c7eb7c GetSystemInfo 79212->79192 79213 7ffc74c7e524 79213->79212 79214 7ffc74c85760 _RunAllParam 2 API calls 79213->79214 79222 7ffc74c7e727 _RunAllParam 79213->79222 79225 7ffc74c7e716 _RunAllParam 79213->79225 79214->79213 79216 7ffc74c69ad0 _RunAllParam 2 API calls 79215->79216 79215->79220 79216->79220 79217 7ffc74c68a60 _RunAllParam 2 API calls 79219 7ffc74c7eb70 79217->79219 79218 7ffc74c697d0 _RunAllParam 2 API calls 79221 7ffc74c7e8ab 79218->79221 79219->79192 79219->79212 79220->79197 79220->79198 79221->79192 79223 7ffc74c85760 _RunAllParam 2 API calls 79221->79223 79226 7ffc74c7e9f4 _RunAllParam 79221->79226 79228 7ffc74c7e9e3 _RunAllParam 79221->79228 79224 7ffc74c69ad0 _RunAllParam 2 API calls 79222->79224 79222->79225 79223->79221 79224->79225 79225->79218 79225->79228 79226->79192 79227 7ffc74c69ad0 _RunAllParam 2 API calls 79226->79227 79226->79228 79227->79228 79228->79192 79228->79217 79230 7ffc74c66d41 79229->79230 79231 7ffc74c66d2d 79229->79231 79230->79195 79231->79230 79232 7ffc74c69ad0 _RunAllParam 2 API calls 79231->79232 79232->79230 79234 7ffc74c7ddc0 14 API calls 79233->79234 79235 7ffc74c69553 79234->79235 79236 7ffc74c69558 79235->79236 79237 7ffc74c60150 _RunAllParam 2 API calls 79235->79237 79236->79200 79239 7ffc74c695a3 _RunAllParam 79237->79239 79240 7ffc74c695de 79239->79240 79379 7ffc74c60280 79239->79379 79382 7ffc74c835d0 79240->79382 79242 7ffc74c695f5 _RunAllParam 79386 7ffc74c82750 79242->79386 79244 7ffc74c69611 79389 7ffc74c82a70 79244->79389 79246 7ffc74c6961d _RunAllParam 79247 7ffc74c69664 79246->79247 79251 7ffc74c6962c _RunAllParam 79246->79251 79248 7ffc74c82750 3 API calls 79247->79248 79249 7ffc74c6967f 79248->79249 79252 7ffc74c82a70 4 API calls 79249->79252 79250 7ffc74c6964e 79250->79200 79251->79250 79254 7ffc74c4d410 _RunAllParam 2 API calls 79251->79254 79253 7ffc74c6968b _RunAllParam 79252->79253 79255 7ffc74c82750 3 API calls 79253->79255 79254->79250 79256 7ffc74c696a9 79255->79256 79257 7ffc74c82a70 4 API calls 79256->79257 79258 7ffc74c696b5 _RunAllParam 79257->79258 79259 7ffc74c696f8 79258->79259 79260 7ffc74c696c4 79258->79260 79261 7ffc74c6975c 79259->79261 79262 7ffc74c696fd 79259->79262 79266 7ffc74c69790 _RunAllParam 79260->79266 79267 7ffc74c696cc _RunAllParam 79260->79267 79264 7ffc74c69766 _RunAllParam 79261->79264 79261->79266 79263 7ffc74c6972d 79262->79263 79268 7ffc74c69701 _RunAllParam 79262->79268 79263->79266 79271 7ffc74c69732 _RunAllParam 79263->79271 79265 7ffc74c696ee 79264->79265 79274 7ffc74c4d410 _RunAllParam 2 API calls 79264->79274 79265->79200 79266->79265 79270 7ffc74c4d410 _RunAllParam 2 API calls 79266->79270 79267->79265 79396 7ffc74c4d410 79267->79396 79268->79265 79272 7ffc74c4d410 _RunAllParam 2 API calls 79268->79272 79270->79265 79271->79265 79273 7ffc74c4d410 _RunAllParam 2 API calls 79271->79273 79272->79265 79273->79265 79274->79265 79278 7ffc74c6cab0 79275->79278 79276 7ffc74c85760 _RunAllParam 2 API calls 79276->79278 79277 7ffc74c6d700 79277->79203 79277->79204 79278->79276 79279 7ffc74c6d099 79278->79279 79284 7ffc74c6cc37 _RunAllParam 79278->79284 79286 7ffc74c6ccc3 _RunAllParam 79278->79286 79279->79277 79282 7ffc74c6d6d6 GetTokenInformation 79279->79282 79283 7ffc74c85760 _RunAllParam 2 API calls 79279->79283 79292 7ffc74c6d277 _RunAllParam 79279->79292 79294 7ffc74c6d303 _RunAllParam 79279->79294 79280 7ffc74c697d0 _RunAllParam 2 API calls 79287 7ffc74c6cdba 79280->79287 79281 7ffc74c68a60 _RunAllParam 2 API calls 79281->79279 79282->79277 79283->79279 79285 7ffc74c69ad0 _RunAllParam 2 API calls 79284->79285 79284->79286 79285->79286 79286->79280 79300 7ffc74c6cef6 _RunAllParam 79286->79300 79287->79277 79289 7ffc74c85760 _RunAllParam 2 API calls 79287->79289 79297 7ffc74c6cf07 _RunAllParam 79287->79297 79287->79300 79288 7ffc74c68a60 _RunAllParam 2 API calls 79291 7ffc74c6d6d1 79288->79291 79289->79287 79290 7ffc74c697d0 _RunAllParam 2 API calls 79296 7ffc74c6d403 79290->79296 79291->79277 79291->79282 79293 7ffc74c69ad0 _RunAllParam 2 API calls 79292->79293 79292->79294 79293->79294 79294->79290 79302 7ffc74c6d544 _RunAllParam 79294->79302 79295 7ffc74c85760 _RunAllParam 2 API calls 79295->79296 79296->79277 79296->79295 79299 7ffc74c6d555 _RunAllParam 79296->79299 79296->79302 79298 7ffc74c69ad0 _RunAllParam 2 API calls 79297->79298 79297->79300 79298->79300 79299->79277 79301 7ffc74c69ad0 _RunAllParam 2 API calls 79299->79301 79299->79302 79300->79277 79300->79281 79301->79302 79302->79277 79302->79288 79305 7ffc74c6a31e 79303->79305 79304 7ffc74c6a8fa 79465 7ffc74c675b0 79304->79465 79305->79304 79306 7ffc74c85760 _RunAllParam 2 API calls 79305->79306 79309 7ffc74c6a4a7 _RunAllParam 79305->79309 79322 7ffc74c6a533 _RunAllParam 79305->79322 79306->79305 79308 7ffc74c6a92b 79310 7ffc74c6c326 _RunAllParam 79308->79310 79314 7ffc74c6aaeb 79308->79314 79315 7ffc74c85760 _RunAllParam 2 API calls 79308->79315 79326 7ffc74c6ab0d _RunAllParam 79308->79326 79333 7ffc74c6aaf6 _RunAllParam 79308->79333 79316 7ffc74c69ad0 _RunAllParam 2 API calls 79309->79316 79309->79322 79313 7ffc74c67770 _RunAllParam 3 API calls 79310->79313 79363 7ffc74c6c321 79310->79363 79311 7ffc74c697d0 _RunAllParam 2 API calls 79321 7ffc74c6a62b 79311->79321 79312 7ffc74c68a60 _RunAllParam 2 API calls 79312->79304 79313->79363 79317 7ffc74c6af7f GetTokenInformation 79314->79317 79318 7ffc74c6af9c 79314->79318 79315->79308 79316->79322 79317->79318 79318->79310 79324 7ffc74c60150 _RunAllParam 2 API calls 79318->79324 79319 7ffc74c68a60 _RunAllParam 2 API calls 79319->79314 79320 7ffc74c697d0 _RunAllParam 2 API calls 79325 7ffc74c6aca3 79320->79325 79321->79304 79323 7ffc74c85760 _RunAllParam 2 API calls 79321->79323 79331 7ffc74c6a777 _RunAllParam 79321->79331 79340 7ffc74c6a766 _RunAllParam 79321->79340 79322->79311 79322->79340 79323->79321 79332 7ffc74c6afb9 _RunAllParam 79324->79332 79325->79318 79327 7ffc74c85760 _RunAllParam 2 API calls 79325->79327 79335 7ffc74c6adf7 _RunAllParam 79325->79335 79350 7ffc74c6ade6 _RunAllParam 79325->79350 79328 7ffc74c69ad0 _RunAllParam 2 API calls 79326->79328 79326->79333 79327->79325 79328->79333 79329 7ffc74c6b608 GetTokenInformation 79329->79310 79342 7ffc74c6b632 79329->79342 79330 7ffc74c85760 _RunAllParam 2 API calls 79330->79332 79334 7ffc74c69ad0 _RunAllParam 2 API calls 79331->79334 79331->79340 79332->79329 79332->79330 79343 7ffc74c6b197 _RunAllParam 79332->79343 79346 7ffc74c6b223 _RunAllParam 79332->79346 79333->79320 79333->79350 79334->79340 79339 7ffc74c69ad0 _RunAllParam 2 API calls 79335->79339 79335->79350 79336 7ffc74c68a60 _RunAllParam 2 API calls 79341 7ffc74c6b5ee 79336->79341 79337 7ffc74c697d0 _RunAllParam 2 API calls 79348 7ffc74c6b31b 79337->79348 79338 7ffc74c85760 _RunAllParam 2 API calls 79338->79342 79339->79350 79340->79304 79340->79312 79341->79310 79341->79329 79342->79338 79352 7ffc74c6bc3e 79342->79352 79354 7ffc74c6b7e7 _RunAllParam 79342->79354 79358 7ffc74c6b873 _RunAllParam 79342->79358 79344 7ffc74c69ad0 _RunAllParam 2 API calls 79343->79344 79343->79346 79344->79346 79345 7ffc74c697d0 _RunAllParam 2 API calls 79359 7ffc74c6b96b 79345->79359 79346->79337 79371 7ffc74c6b456 _RunAllParam 79346->79371 79347 7ffc74c68a60 _RunAllParam 2 API calls 79347->79352 79348->79310 79349 7ffc74c85760 _RunAllParam 2 API calls 79348->79349 79362 7ffc74c6b467 _RunAllParam 79348->79362 79348->79371 79349->79348 79350->79318 79350->79319 79351 7ffc74c6c27a 79351->79310 79361 7ffc74c6c29e _RunAllParam 79351->79361 79352->79310 79352->79351 79353 7ffc74c85760 _RunAllParam 2 API calls 79352->79353 79367 7ffc74c6be25 _RunAllParam 79352->79367 79373 7ffc74c6be14 _RunAllParam 79352->79373 79353->79352 79355 7ffc74c69ad0 _RunAllParam 2 API calls 79354->79355 79354->79358 79355->79358 79356 7ffc74c68a60 _RunAllParam 2 API calls 79356->79351 79357 7ffc74c697d0 _RunAllParam 2 API calls 79369 7ffc74c6bfab 79357->79369 79358->79345 79376 7ffc74c6baa6 _RunAllParam 79358->79376 79359->79310 79360 7ffc74c85760 _RunAllParam 2 API calls 79359->79360 79370 7ffc74c6bab7 _RunAllParam 79359->79370 79359->79376 79360->79359 79361->79363 79473 7ffc74c67770 79361->79473 79366 7ffc74c69ad0 _RunAllParam 2 API calls 79362->79366 79362->79371 79363->79213 79364 7ffc74c85760 _RunAllParam 2 API calls 79364->79369 79366->79371 79368 7ffc74c69ad0 _RunAllParam 2 API calls 79367->79368 79367->79373 79368->79373 79369->79310 79369->79364 79374 7ffc74c6c0f7 _RunAllParam 79369->79374 79377 7ffc74c6c0e6 _RunAllParam 79369->79377 79372 7ffc74c69ad0 _RunAllParam 2 API calls 79370->79372 79370->79376 79371->79310 79371->79336 79372->79376 79373->79357 79373->79377 79374->79310 79375 7ffc74c69ad0 _RunAllParam 2 API calls 79374->79375 79374->79377 79375->79377 79376->79310 79376->79347 79377->79310 79377->79356 79378->79213 79380 7ffc74c600b0 _RunAllParam 2 API calls 79379->79380 79381 7ffc74c60294 79380->79381 79381->79239 79383 7ffc74c83607 _RunAllParam 79382->79383 79399 7ffc74c82e60 79383->79399 79385 7ffc74c83618 79385->79242 79437 7ffc74c826a0 79386->79437 79388 7ffc74c8277a _RunAllParam 79388->79244 79390 7ffc74c60150 _RunAllParam 2 API calls 79389->79390 79391 7ffc74c82a94 79390->79391 79450 7ffc74c82810 79391->79450 79393 7ffc74c82aa4 79394 7ffc74c82abb _RunAllParam 79393->79394 79464 7ffc74c60330 LdrLoadDll FindNextFileW _RunAllParam 79393->79464 79394->79246 79397 7ffc74c69ad0 _RunAllParam 2 API calls 79396->79397 79398 7ffc74c4d428 79397->79398 79398->79265 79400 7ffc74c82e8b _RunAllParam 79399->79400 79401 7ffc74c69ad0 _RunAllParam 2 API calls 79400->79401 79404 7ffc74c82ed7 79401->79404 79402 7ffc74c8312e 79403 7ffc74c6d730 _RunAllParam 2 API calls 79402->79403 79405 7ffc74c83136 _RunAllParam 79403->79405 79404->79402 79420 7ffc74c82f00 _RunAllParam 79404->79420 79407 7ffc74c69ad0 _RunAllParam 2 API calls 79405->79407 79418 7ffc74c83166 _RunAllParam 79405->79418 79406 7ffc74c832b9 79406->79385 79416 7ffc74c83124 79407->79416 79408 7ffc74c830b0 79409 7ffc74c830e1 _RunAllParam 79408->79409 79411 7ffc74c69ad0 _RunAllParam 2 API calls 79408->79411 79412 7ffc74c69ad0 _RunAllParam 2 API calls 79409->79412 79409->79418 79410 7ffc74c83164 RegCloseKey 79410->79418 79411->79409 79412->79416 79413 7ffc74c82f56 RegCloseKey 79413->79420 79414 7ffc74c69ad0 LdrLoadDll FindNextFileW _RunAllParam 79414->79420 79415 7ffc74c7ddc0 10 API calls 79419 7ffc74c831ff 79415->79419 79416->79410 79416->79418 79417 7ffc74c82fa4 RegEnumKeyW 79417->79408 79417->79420 79418->79406 79418->79415 79419->79406 79431 7ffc74c60180 79419->79431 79420->79408 79420->79413 79420->79414 79420->79417 79422 7ffc74c66180 _RunAllParam 2 API calls 79420->79422 79426 7ffc74c83013 RegOpenKeyExW 79420->79426 79422->79420 79423 7ffc74c83216 79424 7ffc74c60280 2 API calls 79423->79424 79427 7ffc74c8322f _RunAllParam 79424->79427 79425 7ffc74c83268 _RunAllParam 79428 7ffc74c82e60 10 API calls 79425->79428 79426->79420 79427->79425 79436 7ffc74c66d80 LdrLoadDll FindNextFileW _RunAllParam 79427->79436 79429 7ffc74c8329f _RunAllParam 79428->79429 79429->79385 79432 7ffc74c600b0 _RunAllParam 2 API calls 79431->79432 79433 7ffc74c601a3 79432->79433 79434 7ffc74c66df0 _RunAllParam 2 API calls 79433->79434 79435 7ffc74c601b7 79434->79435 79435->79423 79436->79425 79439 7ffc74c826d0 79437->79439 79438 7ffc74c69ad0 _RunAllParam 2 API calls 79438->79439 79439->79438 79440 7ffc74c826ef RegEnumValueA 79439->79440 79443 7ffc74c64310 79439->79443 79440->79439 79441 7ffc74c82730 79440->79441 79441->79388 79444 7ffc74c6434b 79443->79444 79447 7ffc74c64385 79443->79447 79446 7ffc74c66df0 _RunAllParam 2 API calls 79444->79446 79446->79447 79448 7ffc74c643b9 _RunAllParam 79447->79448 79449 7ffc74c66d80 LdrLoadDll FindNextFileW _RunAllParam 79447->79449 79448->79439 79449->79448 79451 7ffc74c8283a 79450->79451 79452 7ffc74c8282a 79450->79452 79451->79393 79452->79451 79453 7ffc74c69ad0 _RunAllParam 2 API calls 79452->79453 79454 7ffc74c82862 79453->79454 79455 7ffc74c82867 RegQueryValueExA 79454->79455 79457 7ffc74c82887 79454->79457 79455->79457 79456 7ffc74c8288f 79456->79393 79457->79456 79458 7ffc74c60280 2 API calls 79457->79458 79459 7ffc74c828a6 79458->79459 79460 7ffc74c69ad0 _RunAllParam 2 API calls 79459->79460 79461 7ffc74c828b5 _RunAllParam 79460->79461 79462 7ffc74c828ea 79461->79462 79463 7ffc74c828cb RegQueryValueExA 79461->79463 79462->79393 79463->79462 79464->79394 79466 7ffc74c675c1 79465->79466 79467 7ffc74c6762c 79465->79467 79466->79467 79468 7ffc74c69ad0 _RunAllParam 2 API calls 79466->79468 79467->79308 79470 7ffc74c675db 79468->79470 79469 7ffc74c675f0 79469->79308 79470->79469 79471 7ffc74c6d730 _RunAllParam 2 API calls 79470->79471 79472 7ffc74c67607 79471->79472 79472->79308 79474 7ffc74c675b0 _RunAllParam 2 API calls 79473->79474 79475 7ffc74c6777e 79474->79475 79476 7ffc74c69ad0 _RunAllParam 2 API calls 79475->79476 79478 7ffc74c6779b 79475->79478 79477 7ffc74c67791 79476->79477 79477->79478 79479 7ffc74c67796 NtClose 79477->79479 79478->79363 79479->79478 79480 2953cdf2978 79481 2953cdf2986 79480->79481 79486 2953cdf2060 VirtualAlloc 79481->79486 79483 2953cdf29a2 79488 2953cdf2264 79483->79488 79485 2953cdf29ba 79487 2953cdf20c4 79486->79487 79487->79483 79489 2953cdf230f 79488->79489 79490 2953cdf238c VirtualProtect 79488->79490 79489->79490 79491 2953cdf23ee 79490->79491 79492 2953cdf244d VirtualProtect 79491->79492 79493 2953cdf2544 79492->79493 79494 2953cdf2507 VirtualProtect 79492->79494 79496 2953cdf25c5 79493->79496 79497 2953cdf258c RtlAvlRemoveNode 79493->79497 79494->79493 79496->79485 79497->79496

                                                                                                                                          Executed Functions

                                                                                                                                          Function 00007FFC74C45F40 Relevance: 7.6, APIs: 5, Instructions: 146nativeCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Section$DuplicateObjectView$CreateUnmap
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 1515463610-0
                                                                                                                                          • Opcode ID: 97397e7d40928cd0d5b9b3652568a259d3e0dc23511567da45a542a92ecf9865
                                                                                                                                          • Instruction ID: 5859a8184a9344e2c6a5d2cd470c68e4127c239c755685c7f6c21e195c7e706d
                                                                                                                                          • Opcode Fuzzy Hash: 97397e7d40928cd0d5b9b3652568a259d3e0dc23511567da45a542a92ecf9865
                                                                                                                                          • Instruction Fuzzy Hash: B651D173B247A58AEB10CF6495802AE3AA4FB453A8F144236EF6E17BD9DF38D440C750
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C5C4D0 Relevance: 7.6, APIs: 5, Instructions: 136nativeCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          • CreateFileMappingW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FFC74C5C543
                                                                                                                                          • NtMapViewOfSection.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FFC74C5C5D5
                                                                                                                                          • NtUnmapViewOfSection.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FFC74C5C61F
                                                                                                                                          • NtDuplicateObject.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FFC74C5C65B
                                                                                                                                          • NtDuplicateObject.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FFC74C5C6B5
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: DuplicateObjectSectionView$CreateFileMappingUnmap
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 640117302-0
                                                                                                                                          • Opcode ID: 670f384008056c7cc93a1ca92abb5e2d1eaf97c9022006726f08d491f91b699f
                                                                                                                                          • Instruction ID: fbeb3e28d1b98ef5722cc68096ecd486ade50c06c2e1fa0169e247f353113da1
                                                                                                                                          • Opcode Fuzzy Hash: 670f384008056c7cc93a1ca92abb5e2d1eaf97c9022006726f08d491f91b699f
                                                                                                                                          • Instruction Fuzzy Hash: 7551C273618795C1EA209B55A4812AEBBA1EB857B4F144736EAAE077D9DF3CD000C721
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C55CD0 Relevance: 7.6, APIs: 5, Instructions: 117memorynativethreadCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ProtectVirtual$CloseContinueCreateHandlerThreadUserVectored
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 238847861-0
                                                                                                                                          • Opcode ID: 05735a28f3e0b71d633d86495be0ff456b8aca840665f888ab55937f3f5ee976
                                                                                                                                          • Instruction ID: 8a9d40a72f03e44d7ba9058b8d423f67047967e4a92ba9bcfcf0683ef3eeee7c
                                                                                                                                          • Opcode Fuzzy Hash: 05735a28f3e0b71d633d86495be0ff456b8aca840665f888ab55937f3f5ee976
                                                                                                                                          • Instruction Fuzzy Hash: 8351EF73719765CAE7649F70A0803AE36E2EB85348F54813AEA4E0BB9ADF3DD401C711
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C6A2C0 Relevance: 5.0, APIs: 2, Instructions: 2002COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: ee7fddd203a8e558f35a9e2d5444ceda48a0d6c28115a6dd4b832a9e3b433bc2
                                                                                                                                          • Instruction ID: 04ce9d5607f9be03514e3476240780cbdb00e9d251f0c834be8ef49b146f8ff6
                                                                                                                                          • Opcode Fuzzy Hash: ee7fddd203a8e558f35a9e2d5444ceda48a0d6c28115a6dd4b832a9e3b433bc2
                                                                                                                                          • Instruction Fuzzy Hash: AF03B227B28BAAC1EB149B25D5802B977A1FF45B88F488037CA0D47795EF3CE545C362
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C5CB00 Relevance: 4.6, APIs: 3, Instructions: 110processthreadCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CreateFirstProcessSnapshotThread32Toolhelp32
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3863306361-0
                                                                                                                                          • Opcode ID: b47dcf69268d21a52e3390d85a6bf023463a9f72fecd0d4c9e4fe7e291b6d81b
                                                                                                                                          • Instruction ID: e5df8b06fb5a826ca1646d3e6a00ca192a6d26d93fbfecbe3f496fe87cfda986
                                                                                                                                          • Opcode Fuzzy Hash: b47dcf69268d21a52e3390d85a6bf023463a9f72fecd0d4c9e4fe7e291b6d81b
                                                                                                                                          • Instruction Fuzzy Hash: 5A41B223A3C66AC1EA64DB14D4C02BEA6A1EFD4740F648032EA4E477DADF2CE504C771
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C7ED10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 1515 7ffc74c7ed10-7ffc74c7ed37 call 7ffc74c7ddc0 1518 7ffc74c7ed3f-7ffc74c7ed51 call 7ffc74c69ad0 1515->1518 1519 7ffc74c7ed39-7ffc74c7ed3c 1515->1519 1522 7ffc74c7ed53-7ffc74c7ed76 FindFirstFileExW 1518->1522 1523 7ffc74c7eda4-7ffc74c7eda8 1518->1523 1519->1518 1526 7ffc74c7ed9f-7ffc74c7eda2 1522->1526 1527 7ffc74c7ed78-7ffc74c7ed7e 1522->1527 1524 7ffc74c7edd1 1523->1524 1525 7ffc74c7edaa-7ffc74c7edb0 1523->1525 1528 7ffc74c7edd8-7ffc74c7ede2 1524->1528 1525->1524 1529 7ffc74c7edb2-7ffc74c7edb6 1525->1529 1526->1528 1527->1526 1530 7ffc74c7ed80-7ffc74c7ed84 1527->1530 1532 7ffc74c7ee4d-7ffc74c7ee58 call 7ffc74c6d730 1528->1532 1533 7ffc74c7ede4-7ffc74c7ede8 1528->1533 1529->1524 1531 7ffc74c7edb8-7ffc74c7edca call 7ffc74c69ad0 1529->1531 1530->1526 1534 7ffc74c7ed86-7ffc74c7ed98 call 7ffc74c69ad0 1530->1534 1531->1524 1546 7ffc74c7edcc 1531->1546 1547 7ffc74c7ee61-7ffc74c7ee72 1532->1547 1548 7ffc74c7ee5a 1532->1548 1533->1532 1537 7ffc74c7edea-7ffc74c7edef 1533->1537 1534->1526 1551 7ffc74c7ed9a 1534->1551 1541 7ffc74c7edf1-7ffc74c7edf8 1537->1541 1542 7ffc74c7ee1e-7ffc74c7ee2c 1537->1542 1549 7ffc74c7edfa-7ffc74c7edfe 1541->1549 1550 7ffc74c7ee07-7ffc74c7ee18 1541->1550 1544 7ffc74c7ee32-7ffc74c7ee35 1542->1544 1545 7ffc74c7ee2e-7ffc74c7ee30 1542->1545 1544->1550 1553 7ffc74c7ee37-7ffc74c7ee39 1544->1553 1545->1544 1552 7ffc74c7ee3b-7ffc74c7ee4c 1545->1552 1546->1524 1548->1547 1549->1542 1554 7ffc74c7ee00-7ffc74c7ee05 1549->1554 1550->1542 1551->1526 1553->1550 1553->1552 1554->1542 1554->1550
                                                                                                                                          APIs
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: FileFindFirst
                                                                                                                                          • String ID: .
                                                                                                                                          • API String ID: 1974802433-248832578
                                                                                                                                          • Opcode ID: ff81af2d261303690ea493e3242ce8d1552905d18e62b81d1f6e499c765c4368
                                                                                                                                          • Instruction ID: dde3f0e9e854dfc23df065d3db19c428d98a13067f515db1a2c359eaa8f0701a
                                                                                                                                          • Opcode Fuzzy Hash: ff81af2d261303690ea493e3242ce8d1552905d18e62b81d1f6e499c765c4368
                                                                                                                                          • Instruction Fuzzy Hash: 3541D733A18665C3FB664B34D1803792791DB54BA8F184636CA6C073D9DF7CE892C361
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C5AA70 Relevance: 3.5, APIs: 2, Instructions: 521COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 1584 7ffc74c5aa70-7ffc74c5aaa5 call 7ffc74c5cb00 call 7ffc74c5fcd0 1589 7ffc74c5aaa7-7ffc74c5aac5 call 7ffc74c5fca0 1584->1589 1590 7ffc74c5aac6-7ffc74c5ab0e call 7ffc74c5fcc0 1584->1590 1595 7ffc74c5acbf-7ffc74c5acd4 call 7ffc74c5fcc0 1590->1595 1596 7ffc74c5ab14-7ffc74c5ab21 1590->1596 1601 7ffc74c5adf9-7ffc74c5ae07 call 7ffc74c5fca0 1595->1601 1602 7ffc74c5acda-7ffc74c5acdd 1595->1602 1598 7ffc74c5ab25-7ffc74c5ab48 call 7ffc74c5fcb0 call 7ffc74c5fcc0 1596->1598 1613 7ffc74c5ab7b-7ffc74c5ab86 call 7ffc74c5fcc0 1598->1613 1614 7ffc74c5ab4a 1598->1614 1610 7ffc74c5ae0d-7ffc74c5ae21 call 7ffc74c5fcc0 1601->1610 1611 7ffc74c5af94-7ffc74c5afdf call 7ffc74c60150 * 2 call 7ffc74c5fcc0 1601->1611 1605 7ffc74c5ace0-7ffc74c5ad03 call 7ffc74c5fcb0 call 7ffc74c5fcc0 1602->1605 1630 7ffc74c5ad38-7ffc74c5ad4d call 7ffc74c69ad0 1605->1630 1631 7ffc74c5ad05 1605->1631 1610->1611 1629 7ffc74c5ae27 1610->1629 1666 7ffc74c5afe5 1611->1666 1667 7ffc74c5b167-7ffc74c5b17c call 7ffc74c69ad0 1611->1667 1626 7ffc74c5abdd-7ffc74c5abf2 call 7ffc74c69ad0 1613->1626 1627 7ffc74c5ab88-7ffc74c5ab93 call 7ffc74c5fcc0 1613->1627 1619 7ffc74c5ab50-7ffc74c5ab68 call 7ffc74c5fcb0 1614->1619 1632 7ffc74c5ab72-7ffc74c5ab75 1619->1632 1633 7ffc74c5ab6a-7ffc74c5ab6e 1619->1633 1652 7ffc74c5ac05-7ffc74c5ac11 call 7ffc74c5fcc0 1626->1652 1653 7ffc74c5abf4-7ffc74c5ac00 call 7ffc74c5fcb0 1626->1653 1654 7ffc74c5abca-7ffc74c5abd8 call 7ffc74c5fcc0 call 7ffc74c60280 1627->1654 1655 7ffc74c5ab95-7ffc74c5abc5 call 7ffc74c5fcc0 call 7ffc74c5fcb0 * 2 call 7ffc74c66d80 1627->1655 1638 7ffc74c5ae30-7ffc74c5ae45 call 7ffc74c5fcb0 1629->1638 1650 7ffc74c5ad53-7ffc74c5ad71 call 7ffc74c5fcb0 1630->1650 1651 7ffc74c5add9-7ffc74c5adf3 call 7ffc74c5fcc0 1630->1651 1639 7ffc74c5ad10-7ffc74c5ad25 call 7ffc74c5fcb0 1631->1639 1632->1613 1642 7ffc74c5ac89 1632->1642 1633->1619 1641 7ffc74c5ab70 1633->1641 1668 7ffc74c5ae54-7ffc74c5ae58 1638->1668 1669 7ffc74c5ae47-7ffc74c5ae4d 1638->1669 1659 7ffc74c5ad2f-7ffc74c5ad32 1639->1659 1660 7ffc74c5ad27-7ffc74c5ad2b 1639->1660 1641->1613 1649 7ffc74c5ac8c-7ffc74c5acb6 call 7ffc74c5fcc0 1642->1649 1649->1598 1686 7ffc74c5acbc 1649->1686 1650->1651 1704 7ffc74c5ad73-7ffc74c5add7 call 7ffc74c5fcc0 call 7ffc74c60280 call 7ffc74c5fcc0 call 7ffc74c5fcb0 * 2 call 7ffc74c5fcc0 call 7ffc74c60280 call 7ffc74c5fcc0 call 7ffc74c5fcb0 1650->1704 1651->1601 1651->1605 1683 7ffc74c5ac13-7ffc74c5ac21 call 7ffc74c5fcc0 1652->1683 1684 7ffc74c5ac6e-7ffc74c5ac87 1652->1684 1653->1652 1654->1626 1655->1654 1659->1630 1659->1651 1660->1639 1672 7ffc74c5ad2d 1660->1672 1675 7ffc74c5aff0-7ffc74c5b006 call 7ffc74c69ad0 1666->1675 1696 7ffc74c5b1d1-7ffc74c5b213 call 7ffc74c5fcb0 * 2 call 7ffc74c5cf00 * 2 1667->1696 1697 7ffc74c5b17e-7ffc74c5b1b0 call 7ffc74c5fcb0 call 7ffc74c5fcc0 1667->1697 1668->1611 1677 7ffc74c5ae5e-7ffc74c5ae72 call 7ffc74c5fcc0 1668->1677 1669->1638 1676 7ffc74c5ae4f 1669->1676 1672->1630 1698 7ffc74c5b00c-7ffc74c5b020 1675->1698 1699 7ffc74c5b1b9-7ffc74c5b1cf call 7ffc74c5cf00 * 2 1675->1699 1676->1611 1701 7ffc74c5aed0-7ffc74c5aedf call 7ffc74c5fcc0 1677->1701 1702 7ffc74c5ae74-7ffc74c5ae83 call 7ffc74c5fcc0 1677->1702 1707 7ffc74c5ac23-7ffc74c5ac54 call 7ffc74c5fcc0 call 7ffc74c5fcb0 * 2 call 7ffc74c66d80 1683->1707 1708 7ffc74c5ac59-7ffc74c5ac69 call 7ffc74c5fcc0 call 7ffc74c60280 1683->1708 1684->1649 1686->1595 1751 7ffc74c5b216-7ffc74c5b24f 1696->1751 1697->1699 1759 7ffc74c5b1b2-7ffc74c5b1b7 1697->1759 1698->1699 1734 7ffc74c5b026-7ffc74c5b02a 1698->1734 1699->1751 1728 7ffc74c5aee1-7ffc74c5aef0 call 7ffc74c5fcc0 1701->1728 1729 7ffc74c5af38-7ffc74c5af92 call 7ffc74c5fcc0 call 7ffc74c60280 call 7ffc74c5fcc0 call 7ffc74c5fcb0 call 7ffc74c5fcc0 call 7ffc74c60280 call 7ffc74c5fcc0 call 7ffc74c5fcb0 1701->1729 1735 7ffc74c5aebb-7ffc74c5aecb call 7ffc74c5fcc0 call 7ffc74c60280 1702->1735 1736 7ffc74c5ae85-7ffc74c5aeb6 call 7ffc74c5fcc0 call 7ffc74c5fcb0 * 2 call 7ffc74c66d80 1702->1736 1704->1651 1707->1708 1708->1684 1764 7ffc74c5aef2-7ffc74c5af20 call 7ffc74c5fcc0 call 7ffc74c5fcb0 * 2 call 7ffc74c66d80 1728->1764 1765 7ffc74c5af25-7ffc74c5af33 call 7ffc74c5fcc0 call 7ffc74c60280 1728->1765 1729->1611 1734->1699 1738 7ffc74c5b030-7ffc74c5b06f call 7ffc74c5fcc0 call 7ffc74c60280 call 7ffc74c5fcc0 call 7ffc74c5fcb0 call 7ffc74c69ad0 1734->1738 1735->1701 1736->1735 1810 7ffc74c5b071-7ffc74c5b095 NtDuplicateObject 1738->1810 1811 7ffc74c5b09b-7ffc74c5b0a2 1738->1811 1759->1696 1759->1699 1764->1765 1765->1729 1810->1699 1810->1811 1811->1699 1813 7ffc74c5b0a8-7ffc74c5b0ac 1811->1813 1813->1699 1816 7ffc74c5b0b2-7ffc74c5b0e8 call 7ffc74c5fcc0 call 7ffc74c60280 call 7ffc74c5fcc0 call 7ffc74c5fcb0 1813->1816 1816->1675 1829 7ffc74c5b0ee-7ffc74c5b0f1 1816->1829 1829->1667 1830 7ffc74c5b0f3-7ffc74c5b0f9 1829->1830 1831 7ffc74c5b100-7ffc74c5b142 call 7ffc74c5fcb0 * 2 call 7ffc74c69ad0 * 2 1830->1831 1840 7ffc74c5b144-7ffc74c5b155 RtlQueueApcWow64Thread 1831->1840 1841 7ffc74c5b157-7ffc74c5b15d 1831->1841 1840->1841 1841->1831 1842 7ffc74c5b15f-7ffc74c5b163 1841->1842 1842->1667
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CreateFirstProcessSnapshotThread32Toolhelp32
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3863306361-0
                                                                                                                                          • Opcode ID: 277ce45b2216b12cefbf83b438674a130952188f23bbf01386831949dd88dbfb
                                                                                                                                          • Instruction ID: 110ca32751cc3f73f37d8e03f9ec21883175659bff7e40befdcc937a36ae1ce6
                                                                                                                                          • Opcode Fuzzy Hash: 277ce45b2216b12cefbf83b438674a130952188f23bbf01386831949dd88dbfb
                                                                                                                                          • Instruction Fuzzy Hash: 5522C027B2852AC6EA24EB21D0D12BEAB65BF84740F644137DA1E477D6EE3CF505C360
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C7DDC0 Relevance: 2.4, APIs: 1, Instructions: 882COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: InfoSystem
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 31276548-0
                                                                                                                                          • Opcode ID: d865aafef4abeeda741963791a5c8816191fe4801083d7ca403ac3fcd0a015d3
                                                                                                                                          • Instruction ID: bb7e1cca93b4b5cdf135848572aa380b3d6dacb99a52bde289810076a28ce7ed
                                                                                                                                          • Opcode Fuzzy Hash: d865aafef4abeeda741963791a5c8816191fe4801083d7ca403ac3fcd0a015d3
                                                                                                                                          • Instruction Fuzzy Hash: D382C163B287AAC2EB669B35D4802B977A1FB45B84F484437CA4D0779ADF3CE540C361
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C6CA50 Relevance: 2.3, APIs: 1, Instructions: 784COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 5bccb5b6955ed9ec30ef0630396ab279aebbaaecab2cfa1876175928a4d7afc1
                                                                                                                                          • Instruction ID: ebf0ed9d54a735bb9d5d01d075771e083f5ca9ca24441187bdfaf684af3577f3
                                                                                                                                          • Opcode Fuzzy Hash: 5bccb5b6955ed9ec30ef0630396ab279aebbaaecab2cfa1876175928a4d7afc1
                                                                                                                                          • Instruction Fuzzy Hash: C472B163B287AAC1EB158B25D4803B977A1FB45B84F888437CA1D07799DF3CE951C362
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C8D520 Relevance: 1.7, APIs: 1, Instructions: 237nativeCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: InformationQuerySystem
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3562636166-0
                                                                                                                                          • Opcode ID: ed208b4a2a7bacdb4c5f30ed80db816c0f4e91369da1132ce030e5105a6ffa5e
                                                                                                                                          • Instruction ID: 78053cf7905b944b315d098d278c65dae420b109b03fdefbff20ca7941958342
                                                                                                                                          • Opcode Fuzzy Hash: ed208b4a2a7bacdb4c5f30ed80db816c0f4e91369da1132ce030e5105a6ffa5e
                                                                                                                                          • Instruction Fuzzy Hash: 85B16B37A2565ADAE714EF26D1802AE33A8FB44788F444436DB5E47B99DF38E424C720
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C697D0 Relevance: 1.7, APIs: 1, Instructions: 185libraryloaderCOMMONLIBRARYCODE
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: FileFindLoadNext
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 50669962-0
                                                                                                                                          • Opcode ID: 0d34ce97f68ac5289fb971ae0a429462904370c38f5bf85b33eb1a6d885584d5
                                                                                                                                          • Instruction ID: eeaebbbed2a62424aafd04473e2d85a79dc5c29bd6fa3dd1997289740e231ab9
                                                                                                                                          • Opcode Fuzzy Hash: 0d34ce97f68ac5289fb971ae0a429462904370c38f5bf85b33eb1a6d885584d5
                                                                                                                                          • Instruction Fuzzy Hash: 13817023A3856AC2FB14EB21D4912FE6365EF95354F808172EA8D47ACBDE3CE505C721
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C67770 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMONLIBRARYCODE
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Close
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3535843008-0
                                                                                                                                          • Opcode ID: 860ba978492d36cdfe31f6537ec1931d4b76ea568ca190dfd252f9a33af48d82
                                                                                                                                          • Instruction ID: 72ed8d3d9af2847b2398ad6ccae687d48c2cd243c3cf94c5b6924fe3d37706e1
                                                                                                                                          • Opcode Fuzzy Hash: 860ba978492d36cdfe31f6537ec1931d4b76ea568ca190dfd252f9a33af48d82
                                                                                                                                          • Instruction Fuzzy Hash: 9CD05E52A36619C1FE2567A2A1823B402908F99704F0884B2CE8D0A3D7EE2CA885C333
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C82E60 Relevance: 6.3, APIs: 4, Instructions: 289registryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 448 7ffc74c82e60-7ffc74c82e89 449 7ffc74c82e8b-7ffc74c82e93 448->449 450 7ffc74c82e95 448->450 449->450 451 7ffc74c82e9a-7ffc74c82ec3 call 7ffc74c61a90 449->451 450->451 454 7ffc74c82ec8-7ffc74c82eda call 7ffc74c69ad0 451->454 455 7ffc74c82ec5 451->455 458 7ffc74c82ee0-7ffc74c82ef0 454->458 459 7ffc74c8312e 454->459 455->454 460 7ffc74c83131-7ffc74c83145 call 7ffc74c6d730 call 7ffc74c60e20 458->460 463 7ffc74c82ef6-7ffc74c82efa 458->463 459->460 470 7ffc74c83147-7ffc74c8314b 460->470 471 7ffc74c83166-7ffc74c83175 460->471 463->460 465 7ffc74c82f00-7ffc74c82f21 call 7ffc74c5fcc0 463->465 474 7ffc74c82f27-7ffc74c82f2c 465->474 475 7ffc74c830b5-7ffc74c830c1 465->475 470->471 476 7ffc74c8314d-7ffc74c8315f call 7ffc74c69ad0 470->476 472 7ffc74c83181-7ffc74c83199 call 7ffc74c5fcb0 471->472 473 7ffc74c83177-7ffc74c8317b 471->473 477 7ffc74c832b9-7ffc74c832d0 472->477 490 7ffc74c8319f-7ffc74c831ad 472->490 473->472 473->477 481 7ffc74c82f30-7ffc74c82f3a 474->481 479 7ffc74c830f3-7ffc74c8310d call 7ffc74c60e20 475->479 480 7ffc74c830c3-7ffc74c830ca 475->480 476->471 494 7ffc74c83161 476->494 479->471 495 7ffc74c8310f-7ffc74c83113 479->495 480->479 484 7ffc74c830cc-7ffc74c830d0 480->484 486 7ffc74c82f5f-7ffc74c82f88 call 7ffc74c5fcb0 481->486 487 7ffc74c82f3c-7ffc74c82f40 481->487 484->479 491 7ffc74c830d2-7ffc74c830e4 call 7ffc74c69ad0 484->491 504 7ffc74c82f90-7ffc74c82fa2 call 7ffc74c69ad0 486->504 487->486 493 7ffc74c82f42-7ffc74c82f54 call 7ffc74c69ad0 487->493 499 7ffc74c831af-7ffc74c831b5 490->499 500 7ffc74c831bb-7ffc74c831cc call 7ffc74c5fcc0 490->500 512 7ffc74c830eb 491->512 513 7ffc74c830e6 491->513 508 7ffc74c82f5b 493->508 509 7ffc74c82f56-7ffc74c82f59 RegCloseKey 493->509 497 7ffc74c83164 RegCloseKey 494->497 495->471 502 7ffc74c83115-7ffc74c83127 call 7ffc74c69ad0 495->502 497->471 499->477 499->500 516 7ffc74c831ce 500->516 517 7ffc74c831f8-7ffc74c83203 call 7ffc74c7ddc0 500->517 502->471 519 7ffc74c83129-7ffc74c8312c 502->519 520 7ffc74c82fc0-7ffc74c82fea call 7ffc74c63300 call 7ffc74c66180 call 7ffc74c60e20 504->520 521 7ffc74c82fa4-7ffc74c82fba RegEnumKeyW 504->521 508->486 509->508 512->479 513->512 522 7ffc74c831d0-7ffc74c831e5 call 7ffc74c5fcb0 516->522 517->477 527 7ffc74c83209-7ffc74c83234 call 7ffc74c60180 call 7ffc74c5fcc0 call 7ffc74c60280 517->527 519->497 541 7ffc74c82fec-7ffc74c82ff3 520->541 542 7ffc74c82ff5-7ffc74c83011 call 7ffc74c69ad0 520->542 521->520 524 7ffc74c830b2 521->524 532 7ffc74c831ef-7ffc74c831f2 522->532 533 7ffc74c831e7-7ffc74c831eb 522->533 524->475 547 7ffc74c83268-7ffc74c832b8 call 7ffc74c5fcb0 call 7ffc74c82e60 call 7ffc74c5fca0 527->547 548 7ffc74c83236-7ffc74c83263 call 7ffc74c5fcb0 * 2 call 7ffc74c66d80 527->548 532->477 532->517 533->522 534 7ffc74c831ed 533->534 534->517 541->504 550 7ffc74c83013-7ffc74c8303d RegOpenKeyExW 542->550 551 7ffc74c8303f 542->551 548->547 554 7ffc74c83041-7ffc74c83059 call 7ffc74c61180 550->554 551->554 564 7ffc74c83071-7ffc74c8308d call 7ffc74c61ab0 554->564 565 7ffc74c8305b-7ffc74c8306c call 7ffc74c61b60 554->565 564->475 570 7ffc74c8308f-7ffc74c83093 564->570 565->564 570->475 571 7ffc74c83095-7ffc74c830aa 570->571 571->481 572 7ffc74c830b0 571->572 572->475
                                                                                                                                          APIs
                                                                                                                                          • RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00007FFC74C82F59
                                                                                                                                          • RegEnumKeyW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00007FFC74C82FB4
                                                                                                                                          • RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00007FFC74C83039
                                                                                                                                          • RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002,?), ref: 00007FFC74C83164
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Close$EnumOpen
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 138425441-0
                                                                                                                                          • Opcode ID: 70ade09d1917b73a1c0b0a587b97ca231d341992035ac4f1723fae1abeb74924
                                                                                                                                          • Instruction ID: 946b3befe0e55c1d712fb0f0e6655864ded854ddfec1efbcfc97cfa9ca622a90
                                                                                                                                          • Opcode Fuzzy Hash: 70ade09d1917b73a1c0b0a587b97ca231d341992035ac4f1723fae1abeb74924
                                                                                                                                          • Instruction Fuzzy Hash: 14C1A623B2D669C2EE609B56E4803B9A394EF85760F444233EA6D477D6DF3CE805C721
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C5C970 Relevance: 4.6, APIs: 3, Instructions: 107COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Module$BaseEnumInformationModulesNameProcess
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 2890305978-0
                                                                                                                                          • Opcode ID: 0a8ac744251672cff66e4c1f40cbe235c77a46854590e8273bcd534dfa9c016b
                                                                                                                                          • Instruction ID: e7d26fd8c6c2fbfef0c062d2644fc482969ba9f6ca3c4d46d6554180346d9366
                                                                                                                                          • Opcode Fuzzy Hash: 0a8ac744251672cff66e4c1f40cbe235c77a46854590e8273bcd534dfa9c016b
                                                                                                                                          • Instruction Fuzzy Hash: 0E419C22B28665C6EB18EBB198912FD6761BB84788F904033EE4D57B8ADF38D405C361
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C8CF10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 1555 7ffc74c8cf10-7ffc74c8cf60 call 7ffc74c67770 1558 7ffc74c8cf66-7ffc74c8cf7b call 7ffc74c69ad0 1555->1558 1559 7ffc74c8cf62 1555->1559 1562 7ffc74c8cf9c-7ffc74c8cfb5 call 7ffc74c69ad0 1558->1562 1563 7ffc74c8cf7d-7ffc74c8cf95 1558->1563 1559->1558 1568 7ffc74c8cff6-7ffc74c8d008 call 7ffc74c69ad0 1562->1568 1569 7ffc74c8cfb7-7ffc74c8cfcb GetExitCodeProcess 1562->1569 1563->1562 1567 7ffc74c8cf97-7ffc74c8cf9a 1563->1567 1570 7ffc74c8d017-7ffc74c8d034 call 7ffc74c675b0 1567->1570 1578 7ffc74c8d014 1568->1578 1579 7ffc74c8d00a 1568->1579 1571 7ffc74c8cfd6-7ffc74c8cfe1 1569->1571 1572 7ffc74c8cfcd-7ffc74c8cfd4 call 7ffc74c6d730 1569->1572 1571->1568 1577 7ffc74c8cfe3-7ffc74c8cff4 call 7ffc74c677b0 1571->1577 1572->1568 1572->1571 1577->1578 1578->1570 1579->1578
                                                                                                                                          APIs
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CloseCodeExitProcess
                                                                                                                                          • String ID: 0
                                                                                                                                          • API String ID: 1252061823-4108050209
                                                                                                                                          • Opcode ID: 09e40f488223bff79dcad3cacf0ebd6f00734bf62418731ffb97b5ac32de472a
                                                                                                                                          • Instruction ID: 47330c4f6e7b56ab81c2fe970ecffcf548b71adb41833562d8e665ddc9770765
                                                                                                                                          • Opcode Fuzzy Hash: 09e40f488223bff79dcad3cacf0ebd6f00734bf62418731ffb97b5ac32de472a
                                                                                                                                          • Instruction Fuzzy Hash: C6319533628796C6EA709F11E0802BE76A4FB84340F548036EB8E47A9ADF3CD845CB11
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C7F550 Relevance: 3.1, APIs: 2, Instructions: 141COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 1843 7ffc74c7f550-7ffc74c7f585 call 7ffc74c63360 1846 7ffc74c7f5a9-7ffc74c7f5ab 1843->1846 1847 7ffc74c7f587-7ffc74c7f5a4 call 7ffc74c66bf0 call 7ffc74c62fa0 call 7ffc74c60e20 1843->1847 1849 7ffc74c7f5ad-7ffc74c7f5b2 1846->1849 1850 7ffc74c7f5cc-7ffc74c7f5de call 7ffc74c69ad0 1846->1850 1847->1846 1851 7ffc74c7f5c7 1849->1851 1852 7ffc74c7f5b4-7ffc74c7f5b7 1849->1852 1859 7ffc74c7f5e0-7ffc74c7f5ee 1850->1859 1860 7ffc74c7f5ff 1850->1860 1851->1850 1855 7ffc74c7f5c0-7ffc74c7f5c5 1852->1855 1856 7ffc74c7f5b9-7ffc74c7f5be 1852->1856 1855->1850 1856->1850 1869 7ffc74c7f5f0-7ffc74c7f5f7 call 7ffc74c6d730 1859->1869 1870 7ffc74c7f5f9-7ffc74c7f5fd 1859->1870 1863 7ffc74c7f602-7ffc74c7f610 1860->1863 1864 7ffc74c7f672-7ffc74c7f67f 1863->1864 1865 7ffc74c7f612-7ffc74c7f624 1863->1865 1867 7ffc74c7f691 1864->1867 1868 7ffc74c7f681-7ffc74c7f683 1864->1868 1865->1864 1873 7ffc74c7f697-7ffc74c7f6ad call 7ffc74c69ad0 1867->1873 1871 7ffc74c7f689-7ffc74c7f68f 1868->1871 1872 7ffc74c7f685-7ffc74c7f687 1868->1872 1869->1860 1869->1870 1870->1863 1871->1873 1872->1873 1878 7ffc74c7f6d3 1873->1878 1879 7ffc74c7f6af-7ffc74c7f6d1 CreateFileW 1873->1879 1880 7ffc74c7f6d5-7ffc74c7f6ef call 7ffc74c677b0 call 7ffc74c675b0 1878->1880 1879->1880 1885 7ffc74c7f6f1-7ffc74c7f6f9 call 7ffc74c6d730 1880->1885 1886 7ffc74c7f6fb-7ffc74c7f702 1880->1886 1893 7ffc74c7f75c-7ffc74c7f77b 1885->1893 1888 7ffc74c7f725-7ffc74c7f749 call 7ffc74c66d10 call 7ffc74c69ad0 1886->1888 1889 7ffc74c7f704-7ffc74c7f716 call 7ffc74c69ad0 1886->1889 1888->1893 1900 7ffc74c7f74b-7ffc74c7f75a SetFileTime 1888->1900 1889->1888 1897 7ffc74c7f718-7ffc74c7f721 1889->1897 1897->1888 1900->1893
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 2f6d19f31b6694c0a71228a85886c7f0685ab46206413fc2dbfe68e670c2c6b7
                                                                                                                                          • Instruction ID: 6adf4e3497699958c5f57353ea78d8b55eda702ac36b2e8dd3d0528d431f0d9a
                                                                                                                                          • Opcode Fuzzy Hash: 2f6d19f31b6694c0a71228a85886c7f0685ab46206413fc2dbfe68e670c2c6b7
                                                                                                                                          • Instruction Fuzzy Hash: E451E423B286AAC2F6A59B31A4D03BA6295BF88784F148437DA5E077D5DF3DD405C321
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C7F7A0 Relevance: 3.1, APIs: 2, Instructions: 115fileCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: File$PointerRead
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3154509469-0
                                                                                                                                          • Opcode ID: b116437d9c020b1ea1b9c9643b01bd8b4a4effd594b6bd5f05ce2173e7f7b903
                                                                                                                                          • Instruction ID: b800a1ce99223b4ec4db60dbdda236022a63f6f64923b06642155eb31fc4f5c1
                                                                                                                                          • Opcode Fuzzy Hash: b116437d9c020b1ea1b9c9643b01bd8b4a4effd594b6bd5f05ce2173e7f7b903
                                                                                                                                          • Instruction Fuzzy Hash: 8341A423F286A9C3EA51AB35A0C017E6399EF85784F144137EA4D4779ADF3CE406CB61
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C82810 Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          • RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFC74C6961D), ref: 00007FFC74C82885
                                                                                                                                          • RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFC74C6961D), ref: 00007FFC74C828E8
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: QueryValue
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3660427363-0
                                                                                                                                          • Opcode ID: 505d3e8216d65752d9c9970fe8de9b0105d3b943a84e5339b5d033298b12e6c9
                                                                                                                                          • Instruction ID: c23c2f274dc92b2e5cd66ba3ee73c6176e08ccb96d5b38b028b6de6dfff07fe8
                                                                                                                                          • Opcode Fuzzy Hash: 505d3e8216d65752d9c9970fe8de9b0105d3b943a84e5339b5d033298b12e6c9
                                                                                                                                          • Instruction Fuzzy Hash: 2A21B527B2966986EE54CB55A44013AE795EF857F4F084132EE9C07BD8DF7CD481CB10
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C81850 Relevance: 1.6, APIs: 1, Instructions: 144synchronizationCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CreateMutex
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 1964310414-0
                                                                                                                                          • Opcode ID: 29a8f4c580aae3d34eae2ad777ff7b887acb7bd556e13acb8744778cb3517a5c
                                                                                                                                          • Instruction ID: b601fb2bde07c7fa8330ebd121d779b2cf6c299beb493da2bac88abf7d957a21
                                                                                                                                          • Opcode Fuzzy Hash: 29a8f4c580aae3d34eae2ad777ff7b887acb7bd556e13acb8744778cb3517a5c
                                                                                                                                          • Instruction Fuzzy Hash: 9751CA33A29365C6EB64EB2290812BD22D5EF84780F584536EE5D0778ADF3CE941C761
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C8D1E0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: Process$CodeExitFullImageNameQuery
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 2650637187-0
                                                                                                                                          • Opcode ID: 28ec5ec08ee7c2c3a7cdc96954312a46c15a8a1eb4e126f65de35e9e27a46c18
                                                                                                                                          • Instruction ID: f348c3e1ac13fcd1f2234917b4c1df07e009b563495fc0c697820627272e0a5d
                                                                                                                                          • Opcode Fuzzy Hash: 28ec5ec08ee7c2c3a7cdc96954312a46c15a8a1eb4e126f65de35e9e27a46c18
                                                                                                                                          • Instruction Fuzzy Hash: A5418133A2866AC2EB50EF22E0912B92365EF94748F404037EA4E476DEDF3CD841C790
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C81490 Relevance: 1.6, APIs: 1, Instructions: 57COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FFC74C814EB
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: DescriptorSecurity$ConvertString
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3907675253-0
                                                                                                                                          • Opcode ID: 512f313be00f819fec3ec57203f9621932ce3d26650fa1bd96bd1172d00ec909
                                                                                                                                          • Instruction ID: 64bce95fb62afe292313e633f1438b4dc9023b09ffc3d2f0a5929778c8f89feb
                                                                                                                                          • Opcode Fuzzy Hash: 512f313be00f819fec3ec57203f9621932ce3d26650fa1bd96bd1172d00ec909
                                                                                                                                          • Instruction Fuzzy Hash: 58215073A18B5AC2EA109F66A1801AA73A4FB85784F844036DB9D07B49EF78E515CB50
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C7F629 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          • CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC74C7F9E1), ref: 00007FFC74C7F6CC
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CreateFile
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 823142352-0
                                                                                                                                          • Opcode ID: 9933a6296932c9aaeac43b8e72c576d6d43d9e66245f160a84ba2bfbc0e42396
                                                                                                                                          • Instruction ID: 3db03c29b6514684a77569e3c7a331ff7512a9c6a7c15c7840c1b12cfc32ec26
                                                                                                                                          • Opcode Fuzzy Hash: 9933a6296932c9aaeac43b8e72c576d6d43d9e66245f160a84ba2bfbc0e42396
                                                                                                                                          • Instruction Fuzzy Hash: 9911C123A2826AC3EA729B21A0C13BA6399FB48780F144537CB9E07795DF3DE445C761
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C7F642 Relevance: 1.6, APIs: 1, Instructions: 51filetimeCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          • CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC74C7F9E1), ref: 00007FFC74C7F6CC
                                                                                                                                          • SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC74C7F9E1), ref: 00007FFC74C7F75A
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: File$CreateTime
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 1043708186-0
                                                                                                                                          • Opcode ID: ab920c4048ecd73485d9a24abe9911eec550e0ad73fe64493c44082e69fe9c96
                                                                                                                                          • Instruction ID: 7a4cf0b017ffbe9deefbdd8a919ab2f6a12684716bbe659b144adb7043ed7436
                                                                                                                                          • Opcode Fuzzy Hash: ab920c4048ecd73485d9a24abe9911eec550e0ad73fe64493c44082e69fe9c96
                                                                                                                                          • Instruction Fuzzy Hash: E911C223A2866AC7E6619B21A0C13BA6395FB88780F194137DB8E07795DF3CE441C761
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C7F658 Relevance: 1.6, APIs: 1, Instructions: 50filetimeCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          • CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC74C7F9E1), ref: 00007FFC74C7F6CC
                                                                                                                                          • SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC74C7F9E1), ref: 00007FFC74C7F75A
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: File$CreateTime
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 1043708186-0
                                                                                                                                          • Opcode ID: e80f8483cf94c30f6301f3d3c985100ccdfca77954115487aecc5a17041d3c9f
                                                                                                                                          • Instruction ID: 2966542c8b8f9139e591d1da5a8a8b441365e12a6cfb03abb33ea567296876db
                                                                                                                                          • Opcode Fuzzy Hash: e80f8483cf94c30f6301f3d3c985100ccdfca77954115487aecc5a17041d3c9f
                                                                                                                                          • Instruction Fuzzy Hash: 2A11E523A2826AC3E6719B2160C17BA6395FB88780F184137DB9E07795DF3CE441C771
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C7F668 Relevance: 1.5, APIs: 1, Instructions: 47filetimeCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          • CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC74C7F9E1), ref: 00007FFC74C7F6CC
                                                                                                                                          • SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,-0000006C,00007FFC74C7F9E1), ref: 00007FFC74C7F75A
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: File$CreateTime
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 1043708186-0
                                                                                                                                          • Opcode ID: 6e284fec9c092ab559da79d84b2b54fba405a3312493b2d376a7f6576a005246
                                                                                                                                          • Instruction ID: eb5c718e5b608dacf8cff331b80f2d72114f4326320d4982bb8b074279278101
                                                                                                                                          • Opcode Fuzzy Hash: 6e284fec9c092ab559da79d84b2b54fba405a3312493b2d376a7f6576a005246
                                                                                                                                          • Instruction Fuzzy Hash: 80010823A2826AC2E6729B21B0C13BA6394FB88780F184137DB8D07795DF3CD441C761
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C826A0 Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: EnumValue
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 2814608202-0
                                                                                                                                          • Opcode ID: af68b27f32d806152594ea98ebc8f2426a04b51a09888dca3b9f639ab6fe49d2
                                                                                                                                          • Instruction ID: 538f25a3226573fa40108d4c52006088ed136fd11336cd61861760cb59ac8a4a
                                                                                                                                          • Opcode Fuzzy Hash: af68b27f32d806152594ea98ebc8f2426a04b51a09888dca3b9f639ab6fe49d2
                                                                                                                                          • Instruction Fuzzy Hash: DF113377618B85C6D7209F52F44459AB7A8F788B80F588136EF9D43B04DF38D591CB04
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C670F0 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CreateHeap
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 10892065-0
                                                                                                                                          • Opcode ID: 7e47ca28742369fe6618816808a4c8b1d75f0f49f581dd722c821a23b829cda3
                                                                                                                                          • Instruction ID: cb60625c1c6331a805617c32946329ea287646cfd49c95da0a5be674574e5cde
                                                                                                                                          • Opcode Fuzzy Hash: 7e47ca28742369fe6618816808a4c8b1d75f0f49f581dd722c821a23b829cda3
                                                                                                                                          • Instruction Fuzzy Hash: 6101A726B28669C2E6518B10F99156573A1EF853C4F08C436DA8D067A5EE3CD461CB12
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C694A0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ComputerName
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3545744682-0
                                                                                                                                          • Opcode ID: dae9426cc7fa4538d72034ffd323e9bcfc8febbe287244ac524ecd089ce4f1d2
                                                                                                                                          • Instruction ID: d6b55ccc380c98f59ddf2881fef9f94f627782ddc65d1e281e8fa85900beb355
                                                                                                                                          • Opcode Fuzzy Hash: dae9426cc7fa4538d72034ffd323e9bcfc8febbe287244ac524ecd089ce4f1d2
                                                                                                                                          • Instruction Fuzzy Hash: CB011262B3856AC2EA10EB55E8D11BA6311FFC4784F409432E98E4769BCE6CD105C762
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%

                                                                                                                                          Function 00007FFC74C67190 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.430869317.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFC74C20000, based on PE: true
                                                                                                                                          • Associated: 00000014.00000002.430856191.00007FFC74C20000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431055475.00007FFC74CA3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431094839.00007FFC74CB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          • Associated: 00000014.00000002.431113098.00007FFC74CB8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffc74c20000_CloudNotifications.jbxd
                                                                                                                                          Yara matches
                                                                                                                                          Similarity
                                                                                                                                          • API ID: PrivilegeRelease
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 113639715-0
                                                                                                                                          • Opcode ID: 4cc1cfa08cb3aa26b208f28932105458a4a2f75863f8a1a8a56e0b8e89d82dcb
                                                                                                                                          • Instruction ID: 6cfc7acca6b6db3f5260eeb6931b1524535783d686285622ad8f9e5f49851f1d
                                                                                                                                          • Opcode Fuzzy Hash: 4cc1cfa08cb3aa26b208f28932105458a4a2f75863f8a1a8a56e0b8e89d82dcb
                                                                                                                                          • Instruction Fuzzy Hash: BFF05E0AF2A26A81FD6853E1589127102C25FC5340F1CC877C81D4A396ED2CEA46C633
                                                                                                                                          Uniqueness

                                                                                                                                          Uniqueness Score: -1.00%