Edit tour

Windows Analysis Report
libmmd.dll.dll

Overview

General Information

Sample name:	libmmd.dll.dll (renamed file extension from exe to dll)
Original sample name:	libmmd.dll.exe
Analysis ID:	1483413
MD5:	19c31c58313c58fc88cf27e77befb0c3
SHA1:	b0711e10ef98b86e76ad28665285598d8809ae36
SHA256:	c2684b143c3417c588a3c0ae0a9c4329e71a04fc304aa3a69eae61ede1d0b290
Tags:	exe
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6324 cmdline: loaddll64.exe "C:\Users\user\Desktop\libmmd.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 6372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3084 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 5180 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 5220 cmdline: C:\Windows\system32\WerFault.exe -u -p 5180 -s 328 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 5572 cmdline: rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,_LIB_VERSIONIMF MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 1016 cmdline: C:\Windows\system32\WerFault.exe -u -p 5572 -s 328 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7212 cmdline: rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,__acosdq MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7248 cmdline: C:\Windows\system32\WerFault.exe -u -p 7212 -s 328 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7360 cmdline: rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,__acoshq MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7396 cmdline: C:\Windows\system32\WerFault.exe -u -p 7360 -s 320 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7456 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",_LIB_VERSIONIMF MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7464 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",__acosdq MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7472 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",__acoshq MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7492 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynl MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7504 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynf16 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7512 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynf MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7520 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",yn MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7528 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1l MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7536 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1f16 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7544 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1f MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7552 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7560 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0l MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7568 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0f16 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7580 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0f MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7596 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7608 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncl MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7688 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncf16 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7708 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncf MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7724 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",trunc MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7740 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammal MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7768 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammaf16 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7784 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammaf MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7816 cmdline: rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgamma MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T11:34:16.927782+0200
SID:	2022930
Source Port:	443
Destination Port:	49746
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T11:34:54.490258+0200
SID:	2022930
Source Port:	443
Destination Port:	49754
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: libmmd.dll.dll	Virustotal: Detection: 59%			Perma Link
Source: libmmd.dll.dll	ReversingLabs: Detection: 55%

Source: libmmd.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: libmmd.pdb source: loaddll64.exe, 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1848304264.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1873710881.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.1885773523.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.1862393694.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.1747347794.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.1747087759.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.1750013302.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.1749039897.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.1749032696.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.1752058510.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.1751496469.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.1749543583.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.1749536241.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1750742280.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.1752568515.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.1752624679.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.1754625176.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.1750788043.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.1748228081.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.1749140606.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.1755733861.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.1754466954.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.1752953424.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000024.00000002.1754615312.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000026.00000002.1755501845.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000027.00000002.1753539233.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000029.00000002.1755439685.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmp, libmmd.dll.dll

Source: libmmd.dll.dll	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: libmmd.dll.dll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: libmmd.dll.dll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: libmmd.dll.dll	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: libmmd.dll.dll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: libmmd.dll.dll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: libmmd.dll.dll	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: libmmd.dll.dll	String found in binary or memory: http://ocsp.comodoca.com0
Source: libmmd.dll.dll	String found in binary or memory: http://ocsp.sectigo.com0
Source: libmmd.dll.dll	String found in binary or memory: http://ocsp.sectigo.com0.
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: libmmd.dll.dll	String found in binary or memory: https://sectigo.com/CPS0

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB51F3D0	0_2_00007FFDFB51F3D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4C8BD0	0_2_00007FFDFB4C8BD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B8BC0	0_2_00007FFDFB4B8BC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB54C390	0_2_00007FFDFB54C390
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB506360	0_2_00007FFDFB506360
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B3C30	0_2_00007FFDFB4B3C30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4CA450	0_2_00007FFDFB4CA450
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4D13F0	0_2_00007FFDFB4D13F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4EEC00	0_2_00007FFDFB4EEC00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4D8AB0	0_2_00007FFDFB4D8AB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB54BAA0	0_2_00007FFDFB54BAA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB54D2A0	0_2_00007FFDFB54D2A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B4AD0	0_2_00007FFDFB4B4AD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B52D0	0_2_00007FFDFB4B52D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B4AC0	0_2_00007FFDFB4B4AC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4CAA80	0_2_00007FFDFB4CAA80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB553B40	0_2_00007FFDFB553B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4CC330	0_2_00007FFDFB4CC330
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4CCB50	0_2_00007FFDFB4CCB50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB537B30	0_2_00007FFDFB537B30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4BCB40	0_2_00007FFDFB4BCB40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB591300	0_2_00007FFDFB591300
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4BBAE0	0_2_00007FFDFB4BBAE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB504AE0	0_2_00007FFDFB504AE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4E0B10	0_2_00007FFDFB4E0B10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4CD310	0_2_00007FFDFB4CD310
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B5300	0_2_00007FFDFB4B5300
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4C9300	0_2_00007FFDFB4C9300
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4C71B0	0_2_00007FFDFB4C71B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4EE1C0	0_2_00007FFDFB4EE1C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB51E980	0_2_00007FFDFB51E980
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB54A960	0_2_00007FFDFB54A960
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB592170	0_2_00007FFDFB592170
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B4A50	0_2_00007FFDFB4B4A50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4DC250	0_2_00007FFDFB4DC250
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B9240	0_2_00007FFDFB4B9240
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB591A10	0_2_00007FFDFB591A10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB503A10	0_2_00007FFDFB503A10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4D0210	0_2_00007FFDFB4D0210
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4E1200	0_2_00007FFDFB4E1200
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B58B0	0_2_00007FFDFB4B58B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB527080	0_2_00007FFDFB527080
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB531890	0_2_00007FFDFB531890
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4EC930	0_2_00007FFDFB4EC930
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4F2130	0_2_00007FFDFB4F2130
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B6120	0_2_00007FFDFB4B6120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB53A120	0_2_00007FFDFB53A120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB54B120	0_2_00007FFDFB54B120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B98F0	0_2_00007FFDFB4B98F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B60E0	0_2_00007FFDFB4B60E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B6110	0_2_00007FFDFB4B6110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B6100	0_2_00007FFDFB4B6100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB591FC0	0_2_00007FFDFB591FC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B37A0	0_2_00007FFDFB4B37A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB502FD0	0_2_00007FFDFB502FD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4ECFD0	0_2_00007FFDFB4ECFD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4C0F60	0_2_00007FFDFB4C0F60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4D1760	0_2_00007FFDFB4D1760
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4FD030	0_2_00007FFDFB4FD030
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4BD020	0_2_00007FFDFB4BD020
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4CF7E0	0_2_00007FFDFB4CF7E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4D5FE0	0_2_00007FFDFB4D5FE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4DA010	0_2_00007FFDFB4DA010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB505000	0_2_00007FFDFB505000
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4F16B0	0_2_00007FFDFB4F16B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4C9EB0	0_2_00007FFDFB4C9EB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4D0EB0	0_2_00007FFDFB4D0EB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB591EA0	0_2_00007FFDFB591EA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB52F6B0	0_2_00007FFDFB52F6B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB51EEB0	0_2_00007FFDFB51EEB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB54D6B0	0_2_00007FFDFB54D6B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5526B0	0_2_00007FFDFB5526B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4EE6C0	0_2_00007FFDFB4EE6C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4D0EC0	0_2_00007FFDFB4D0EC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4ED670	0_2_00007FFDFB4ED670
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4F4690	0_2_00007FFDFB4F4690
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB512E70	0_2_00007FFDFB512E70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4D8E80	0_2_00007FFDFB4D8E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B8F30	0_2_00007FFDFB4B8F30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4F0F10	0_2_00007FFDFB4F0F10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4CBF10	0_2_00007FFDFB4CBF10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4BB700	0_2_00007FFDFB4BB700
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4C7DA0	0_2_00007FFDFB4C7DA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4F1DD0	0_2_00007FFDFB4F1DD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5915B0	0_2_00007FFDFB5915B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4DE590	0_2_00007FFDFB4DE590
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B4630	0_2_00007FFDFB4B4630
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB58CE40	0_2_00007FFDFB58CE40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4BA620	0_2_00007FFDFB4BA620
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB58FE20	0_2_00007FFDFB58FE20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4D2650	0_2_00007FFDFB4D2650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B4640	0_2_00007FFDFB4B4640
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4BE4B0	0_2_00007FFDFB4BE4B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB54CCB0	0_2_00007FFDFB54CCB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4BC4C0	0_2_00007FFDFB4BC4C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4B9CC0	0_2_00007FFDFB4B9CC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4C84F0	0_2_00007FFDFB4C84F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB592510	0_2_00007FFDFB592510
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4EDCE0	0_2_00007FFDFB4EDCE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4BDD10	0_2_00007FFDFB4BDD10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4C0510	0_2_00007FFDFB4C0510
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB504510	0_2_00007FFDFB504510
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB591FC0	3_2_00007FFDFB591FC0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB51F3D0	3_2_00007FFDFB51F3D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB502FD0	3_2_00007FFDFB502FD0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4ECFD0	3_2_00007FFDFB4ECFD0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4C8BD0	3_2_00007FFDFB4C8BD0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B8BC0	3_2_00007FFDFB4B8BC0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB54C390	3_2_00007FFDFB54C390
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4C0F60	3_2_00007FFDFB4C0F60
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB506360	3_2_00007FFDFB506360
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4D1760	3_2_00007FFDFB4D1760
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B3796	3_2_00007FFDFB4B3796
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B3C30	3_2_00007FFDFB4B3C30
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4FD030	3_2_00007FFDFB4FD030
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4BD020	3_2_00007FFDFB4BD020
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4CA450	3_2_00007FFDFB4CA450
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4D13F0	3_2_00007FFDFB4D13F0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4CF7E0	3_2_00007FFDFB4CF7E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4D5FE0	3_2_00007FFDFB4D5FE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4DA010	3_2_00007FFDFB4DA010
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB505000	3_2_00007FFDFB505000
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4EEC00	3_2_00007FFDFB4EEC00
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4F16B0	3_2_00007FFDFB4F16B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4D8AB0	3_2_00007FFDFB4D8AB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4C9EB0	3_2_00007FFDFB4C9EB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4D0EB0	3_2_00007FFDFB4D0EB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB54BAA0	3_2_00007FFDFB54BAA0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB54D2A0	3_2_00007FFDFB54D2A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B52D0	3_2_00007FFDFB4B52D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B4AD0	3_2_00007FFDFB4B4AD0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB591EA0	3_2_00007FFDFB591EA0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB52F6B0	3_2_00007FFDFB52F6B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB51EEB0	3_2_00007FFDFB51EEB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB54D6B0	3_2_00007FFDFB54D6B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB5526B0	3_2_00007FFDFB5526B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B4AC0	3_2_00007FFDFB4B4AC0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4EE6C0	3_2_00007FFDFB4EE6C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4D0EC0	3_2_00007FFDFB4D0EC0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4ED670	3_2_00007FFDFB4ED670
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4F4690	3_2_00007FFDFB4F4690
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB512E70	3_2_00007FFDFB512E70
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4D8E80	3_2_00007FFDFB4D8E80
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4CAA80	3_2_00007FFDFB4CAA80
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB553B40	3_2_00007FFDFB553B40
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B8F30	3_2_00007FFDFB4B8F30
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4CC330	3_2_00007FFDFB4CC330
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4CCB50	3_2_00007FFDFB4CCB50
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB537B30	3_2_00007FFDFB537B30
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4BCB40	3_2_00007FFDFB4BCB40
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB591300	3_2_00007FFDFB591300
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4BBAE0	3_2_00007FFDFB4BBAE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB504AE0	3_2_00007FFDFB504AE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4F0F10	3_2_00007FFDFB4F0F10
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4E0B10	3_2_00007FFDFB4E0B10
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4CBF10	3_2_00007FFDFB4CBF10
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4CD310	3_2_00007FFDFB4CD310
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4BB700	3_2_00007FFDFB4BB700
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B5300	3_2_00007FFDFB4B5300
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4C9300	3_2_00007FFDFB4C9300
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4C71B0	3_2_00007FFDFB4C71B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4C7DA0	3_2_00007FFDFB4C7DA0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4F1DD0	3_2_00007FFDFB4F1DD0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB5915B0	3_2_00007FFDFB5915B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4EE1C0	3_2_00007FFDFB4EE1C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB51E980	3_2_00007FFDFB51E980
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB54A960	3_2_00007FFDFB54A960
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4DE590	3_2_00007FFDFB4DE590
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB592170	3_2_00007FFDFB592170
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B4630	3_2_00007FFDFB4B4630
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB58CE40	3_2_00007FFDFB58CE40
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4BA620	3_2_00007FFDFB4BA620
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B4A50	3_2_00007FFDFB4B4A50
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB58FE20	3_2_00007FFDFB58FE20
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4DC250	3_2_00007FFDFB4DC250
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4D2650	3_2_00007FFDFB4D2650
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B9240	3_2_00007FFDFB4B9240
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B4640	3_2_00007FFDFB4B4640
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB591A10	3_2_00007FFDFB591A10
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB503A10	3_2_00007FFDFB503A10
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4D0210	3_2_00007FFDFB4D0210
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4E1200	3_2_00007FFDFB4E1200
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4BE4B0	3_2_00007FFDFB4BE4B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B58B0	3_2_00007FFDFB4B58B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB54CCB0	3_2_00007FFDFB54CCB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B9CC0	3_2_00007FFDFB4B9CC0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4BC4C0	3_2_00007FFDFB4BC4C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB527080	3_2_00007FFDFB527080
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB531890	3_2_00007FFDFB531890
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4EC930	3_2_00007FFDFB4EC930
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4F2130	3_2_00007FFDFB4F2130
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B6120	3_2_00007FFDFB4B6120
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB53A120	3_2_00007FFDFB53A120
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB54B120	3_2_00007FFDFB54B120
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B98F0	3_2_00007FFDFB4B98F0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4C84F0	3_2_00007FFDFB4C84F0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B60E0	3_2_00007FFDFB4B60E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB592510	3_2_00007FFDFB592510
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4EDCE0	3_2_00007FFDFB4EDCE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4BDD10	3_2_00007FFDFB4BDD10
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4C0510	3_2_00007FFDFB4C0510
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B6110	3_2_00007FFDFB4B6110
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB504510	3_2_00007FFDFB504510
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB4B6100	3_2_00007FFDFB4B6100
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB51F3D0	10_2_00007FFDFB51F3D0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4C8BD0	10_2_00007FFDFB4C8BD0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B8BC0	10_2_00007FFDFB4B8BC0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB54C390	10_2_00007FFDFB54C390
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB506360	10_2_00007FFDFB506360
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B3C30	10_2_00007FFDFB4B3C30
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4CA450	10_2_00007FFDFB4CA450
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4D13F0	10_2_00007FFDFB4D13F0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4EEC00	10_2_00007FFDFB4EEC00
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4D8AB0	10_2_00007FFDFB4D8AB0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB54BAA0	10_2_00007FFDFB54BAA0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB54D2A0	10_2_00007FFDFB54D2A0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B52D0	10_2_00007FFDFB4B52D0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B4AD0	10_2_00007FFDFB4B4AD0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B4AC0	10_2_00007FFDFB4B4AC0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4CAA80	10_2_00007FFDFB4CAA80
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB553B40	10_2_00007FFDFB553B40
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4CC330	10_2_00007FFDFB4CC330
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4CCB50	10_2_00007FFDFB4CCB50
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB537B30	10_2_00007FFDFB537B30
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4BCB40	10_2_00007FFDFB4BCB40
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB591300	10_2_00007FFDFB591300
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4BBAE0	10_2_00007FFDFB4BBAE0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB504AE0	10_2_00007FFDFB504AE0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4E0B10	10_2_00007FFDFB4E0B10
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4CD310	10_2_00007FFDFB4CD310
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B5300	10_2_00007FFDFB4B5300
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4C9300	10_2_00007FFDFB4C9300
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4C71B0	10_2_00007FFDFB4C71B0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4EE1C0	10_2_00007FFDFB4EE1C0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB51E980	10_2_00007FFDFB51E980
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB54A960	10_2_00007FFDFB54A960
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB592170	10_2_00007FFDFB592170
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B4A50	10_2_00007FFDFB4B4A50
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4DC250	10_2_00007FFDFB4DC250
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B9240	10_2_00007FFDFB4B9240
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB591A10	10_2_00007FFDFB591A10
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB503A10	10_2_00007FFDFB503A10
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4D0210	10_2_00007FFDFB4D0210
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4E1200	10_2_00007FFDFB4E1200
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B58B0	10_2_00007FFDFB4B58B0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB527080	10_2_00007FFDFB527080
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB531890	10_2_00007FFDFB531890
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4EC930	10_2_00007FFDFB4EC930
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4F2130	10_2_00007FFDFB4F2130
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B6120	10_2_00007FFDFB4B6120
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB53A120	10_2_00007FFDFB53A120
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB54B120	10_2_00007FFDFB54B120
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B98F0	10_2_00007FFDFB4B98F0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B60E0	10_2_00007FFDFB4B60E0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B6110	10_2_00007FFDFB4B6110
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B6100	10_2_00007FFDFB4B6100
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB591FC0	10_2_00007FFDFB591FC0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B37A0	10_2_00007FFDFB4B37A0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB502FD0	10_2_00007FFDFB502FD0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4ECFD0	10_2_00007FFDFB4ECFD0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4C0F60	10_2_00007FFDFB4C0F60
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4D1760	10_2_00007FFDFB4D1760
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4FD030	10_2_00007FFDFB4FD030
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4BD020	10_2_00007FFDFB4BD020
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4CF7E0	10_2_00007FFDFB4CF7E0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4D5FE0	10_2_00007FFDFB4D5FE0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4DA010	10_2_00007FFDFB4DA010
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB505000	10_2_00007FFDFB505000
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4F16B0	10_2_00007FFDFB4F16B0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4C9EB0	10_2_00007FFDFB4C9EB0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4D0EB0	10_2_00007FFDFB4D0EB0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB591EA0	10_2_00007FFDFB591EA0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB52F6B0	10_2_00007FFDFB52F6B0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB51EEB0	10_2_00007FFDFB51EEB0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB54D6B0	10_2_00007FFDFB54D6B0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB5526B0	10_2_00007FFDFB5526B0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4EE6C0	10_2_00007FFDFB4EE6C0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4D0EC0	10_2_00007FFDFB4D0EC0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4ED670	10_2_00007FFDFB4ED670
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4F4690	10_2_00007FFDFB4F4690
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB512E70	10_2_00007FFDFB512E70
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4D8E80	10_2_00007FFDFB4D8E80
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B8F30	10_2_00007FFDFB4B8F30
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4F0F10	10_2_00007FFDFB4F0F10
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4CBF10	10_2_00007FFDFB4CBF10
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4BB700	10_2_00007FFDFB4BB700
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4C7DA0	10_2_00007FFDFB4C7DA0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4F1DD0	10_2_00007FFDFB4F1DD0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB5915B0	10_2_00007FFDFB5915B0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4DE590	10_2_00007FFDFB4DE590
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B4630	10_2_00007FFDFB4B4630
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB58CE40	10_2_00007FFDFB58CE40
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4BA620	10_2_00007FFDFB4BA620
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB58FE20	10_2_00007FFDFB58FE20
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4D2650	10_2_00007FFDFB4D2650
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B4640	10_2_00007FFDFB4B4640
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4BE4B0	10_2_00007FFDFB4BE4B0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB54CCB0	10_2_00007FFDFB54CCB0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4BC4C0	10_2_00007FFDFB4BC4C0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4B9CC0	10_2_00007FFDFB4B9CC0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4C84F0	10_2_00007FFDFB4C84F0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB592510	10_2_00007FFDFB592510
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4EDCE0	10_2_00007FFDFB4EDCE0
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4BDD10	10_2_00007FFDFB4BDD10
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB4C0510	10_2_00007FFDFB4C0510
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB504510	10_2_00007FFDFB504510

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5572 -s 328

Source: libmmd.dll.dll

Static PE information: invalid certificate

Source: libmmd.dll.dll

Binary or memory string: OriginalFilenamelibmmd.dll` vs libmmd.dll.dll

Source: classification engine

Classification label: mal48.winDLL@126/17@0/0

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7360
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7212
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5572
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5180
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6372:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\08768608-d9f7-4341-905f-872fba1a7398

Jump to behavior

Source: libmmd.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,_LIB_VERSIONIMF

Source: libmmd.dll.dll	Virustotal: Detection: 59%
Source: libmmd.dll.dll	ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\libmmd.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,_LIB_VERSIONIMF
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5572 -s 328
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5180 -s 328
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,__acosdq
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7212 -s 328
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,__acoshq
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7360 -s 320
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",_LIB_VERSIONIMF
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",__acosdq
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",__acoshq
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynl
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynf16
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynf
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",yn
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1l
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1f16
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1f
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0l
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0f16
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0f
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncl
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncf16
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncf
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",trunc
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammal
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammaf16
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammaf
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgamma
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,_LIB_VERSIONIMF	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,__acosdq	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,__acoshq	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",_LIB_VERSIONIMF	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",__acosdq	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",__acoshq	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynl	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynf16	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynf	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",yn	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1l	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1f16	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1f	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0l	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0f16	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0f	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncl	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncf16	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncf	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",trunc	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammal	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammaf16	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammaf	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgamma	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5180 -s 328	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7212 -s 328	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Section loaded: apphelp.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: libmmd.dll.dll

Static PE information: More than 1031 > 100 exports found

Source: libmmd.dll.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: libmmd.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: libmmd.dll.dll

Static file information: File size 4148864 > 1048576

Source: libmmd.dll.dll	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x186200
Source: libmmd.dll.dll	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1d4e00

Source: libmmd.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: libmmd.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: libmmd.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: libmmd.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: libmmd.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: libmmd.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: libmmd.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: libmmd.dll.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: libmmd.dll.dll

Static PE information: real checksum: 0x40421d should be: 0x40244a

Source: libmmd.dll.dll	Static PE information: section name: .trace
Source: libmmd.dll.dll	Static PE information: section name: _RDATA

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\loaddll64.exe	API coverage: 8.1 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 2.7 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 3.7 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\rundll32.exe

Code function: 10_2_00007FFDFB62BDAC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_00007FFDFB62BDAC

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB4B8420 CreateFileW,GetProcessHeap,HeapAlloc,

0_2_00007FFDFB4B8420

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB624CCC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FFDFB624CCC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB624CCC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FFDFB624CCC
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB62BDAC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FFDFB62BDAC
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_00007FFDFB624CCC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FFDFB624CCC

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB624670 cpuid

0_2_00007FFDFB624670

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB624F68 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FFDFB624F68

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Rundll32	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
libmmd.dll.dll	60%	Virustotal		Browse
libmmd.dll.dll	55%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	URL Reputation	safe
http://ocsp.sectigo.com0.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	libmmd.dll.dll	false	URL Reputation: safe URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	libmmd.dll.dll	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0.	libmmd.dll.dll	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	libmmd.dll.dll	false	URL Reputation: safe URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	libmmd.dll.dll	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	libmmd.dll.dll	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	libmmd.dll.dll	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	libmmd.dll.dll	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	libmmd.dll.dll	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483413
Start date and time:	2024-07-27 11:33:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	libmmd.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	libmmd.dll.exe
Detection:	MAL
Classification:	mal48.winDLL@126/17@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
05:34:16	API Interceptor	4x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_lib_7fb52cffe21ecd6abfc1c32e247ab46588f99498_0fd03ba9_5097cc39-576f-429e-8e24-a95d50f63d86\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7669326472533803
Encrypted:	false
SSDEEP:	96:LwFdguKOifm+yKy5sj54RvC5CQ16tQXIDcQ0c6vrcEecw3LXaXz+HbHgSQgJj+hu:UHgYi/y5Zy0KjrUXjGuzuiFIZ24lO8W
MD5:	06CB823C6AAF49D3691379BE8C759521
SHA1:	F74DB9E91569656F60B68C9EB05A7BF6EFD703AC
SHA-256:	5421791F16B799EF78C571EB3689BB092EB9CC6EA53F4DAC134AD1D7E4A93C4F
SHA-512:	CC8CCE9C15384251AE8BD54DEBA763B3A9E3A7D649BBBBAA658345BB4A7EDD75AC7E405706709FD7E402BC1E482561578517FEBFEB1995253EC6EEE2A51C1325
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.4.6.4.3.6.5.4.2.4.7.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.4.6.4.3.6.9.1.7.4.6.9.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.0.9.7.c.c.3.9.-.5.7.6.f.-.4.2.9.e.-.8.e.2.4.-.a.9.5.d.5.0.f.6.3.d.8.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.c.8.0.1.3.4.6.-.8.b.7.8.-.4.6.4.0.-.a.a.f.d.-.a.f.7.2.6.c.f.0.5.f.2.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.l.i.b.m.m.d...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.3.c.-.0.0.0.1.-.0.0.1.4.-.a.f.8.d.-.0.3.1.a.0.8.e.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_lib_7fb52cffe21ecd6abfc1c32e247ab46588f99498_0fd03ba9_7f5ebac1-d6d5-4cf2-8be5-db53b231b40a\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7671107094939073
Encrypted:	false
SSDEEP:	192:wuxDuiiyeZy0KjrUXjGuzuiFjZ24lO8W:71ui/eZ5KjrUXjvzuiFjY4lO8W
MD5:	B480B5CACFCF585AB5EA5EA130BCDAA5
SHA1:	2F1448DA088E643A169F0A0935F82D1E11A2C29A
SHA-256:	1E051BA2FF4A9507B0F37142A78A7A6B31A4AC575B611FFB3E9182400F815997
SHA-512:	2BFE43DED3E6BCAAE85E8DEE88D7380DB8D3014C60E3A1BEF6BC2B72FC63D4D134340A6A0AFA0FE7F03299CB6257C23399790D26C9C2148FE17145C5B9F2BD2F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.4.6.4.3.6.5.0.7.3.6.2.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.4.6.4.3.7.0.2.2.9.8.6.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.f.5.e.b.a.c.1.-.d.6.d.5.-.4.c.f.2.-.8.b.e.5.-.d.b.5.3.b.2.3.1.b.4.0.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.d.2.9.7.d.9.9.-.d.9.a.f.-.4.8.2.9.-.a.5.e.2.-.9.a.2.7.3.9.6.2.e.5.9.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.l.i.b.m.m.d...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.c.4.-.0.0.0.1.-.0.0.1.4.-.b.f.b.d.-.0.1.1.a.0.8.e.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_lib_9afd1e816e2885921660f65cfabdd427ac9437d_0fd03ba9_2091bba8-a1b3-45bc-be49-99cc77a1e4cd\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7574663437595754
Encrypted:	false
SSDEEP:	96:RgFmOikyKyUsj54RvC5CYfHQXIDcQpc6xcELcw3XXaXz+HbHgSQgJj+h88WpOy4S:S9ikyUZf0X1xTjGuzuiFjZ24lO8p
MD5:	41353C8C65499F12DA24F3BD318D939C
SHA1:	ECF28F9C1A0A0C80DAE3B6BBF7741E2A52443B6C
SHA-256:	243766DCC6B558AC9EE88DD959B77938F7B018F153918A5347A199F1D512CC98
SHA-512:	F38C047920E1220316F6F13AF713CB7B36D3E906A722EF189C173BA02BAA74A30CC93A047C674E3CD19B148F90A5B96E7EB78EF9E858687D99CF1611B5AE4A49
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.4.6.4.4.2.7.3.9.5.4.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.4.6.4.4.2.9.4.2.6.5.7.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.0.9.1.b.b.a.8.-.a.1.b.3.-.4.5.b.c.-.b.e.4.9.-.9.9.c.c.7.7.a.1.e.4.c.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.d.8.c.f.8.a.a.-.d.2.9.7.-.4.d.9.4.-.b.8.c.d.-.d.f.7.b.c.7.9.3.f.3.f.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.l.i.b.m.m.d...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.c.0.-.0.0.0.1.-.0.0.1.4.-.d.8.e.8.-.9.b.1.d.0.8.e.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_lib_a3b6957ca019c315fa2e856f651d7b4deeb1dc56_0fd03ba9_e9428bdd-c82c-4b88-bda4-2e7421f6b2a7\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7576932825992645
Encrypted:	false
SSDEEP:	96:itvF+b7OidyKyZsj54RvC5CYfBPQXIDcQpc6xcEBcw3xSXaXz+HbHgSQgJj+h881:WtidyZZx0X17lojGuzuiFIZ24lO8p7
MD5:	A1D0E5A45B76945DB1AF0F1710E6B9BB
SHA1:	6E4D6853FEA74030FAC10C8CA83D56F2EF619D66
SHA-256:	C5A2157CE07326BB65E5C797B334BB522A89B4D44894D43BB80880E9AFB7DE00
SHA-512:	DF52F84D34A2AB317AE84466C88066FAE3F66195E603F188D696B9D125E078A0EE08B90B891159B287D4373ACAE089BA2EE287DB26114E2DD5AFF2133E1DCF5A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.4.6.4.3.9.3.3.6.7.6.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.4.6.4.3.9.5.3.9.8.8.9.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.9.4.2.8.b.d.d.-.c.8.2.c.-.4.b.8.8.-.b.d.a.4.-.2.e.7.4.2.1.f.6.b.2.a.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.f.4.3.d.c.9.a.-.5.d.2.5.-.4.a.8.b.-.9.3.9.7.-.b.1.1.c.c.8.9.5.b.8.b.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.l.i.b.m.m.d...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.2.c.-.0.0.0.1.-.0.0.1.4.-.e.e.9.8.-.c.e.1.b.0.8.e.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B3E.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 09:33:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56140
Entropy (8bit):	1.6140646344768088
Encrypted:	false
SSDEEP:	192:dxrOM4dLEo/L9kwNCGwFnnAHne2omtrdLqYfd8xn:iJdYerCVnnAHnw0Lf+
MD5:	08C2201282B71F80E063823B6C8239E6
SHA1:	8146DDD7ACB56AC6AE1D6EBD2CE523AD41D7FEC3
SHA-256:	C522BDC4F6DF58F3C2E86B719C09A7BB8327D8573510D728945A92D97167C541
SHA-512:	BFD2A7D068C7F712A9CFE105132D7A138689C32C2E1389C902668980C677C1D52FB03D60CE6AC8077466E7AF24A629159FBB0E9D49DFFF31E6488C24D823E631
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................(..........T.......8...........T...............D...........\|...........h...............................................................................eJ..............Lw......................T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B4E.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 09:33:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56760
Entropy (8bit):	1.6142378922164773
Encrypted:	false
SSDEEP:	192:dwl6OMCjqeseEkiWwnhbwn2ePy60Rd+MlG2jY:G3bj2eik2eqdlG2
MD5:	E3AFD370A37FC1B11A22D13D73DB69EF
SHA1:	629B61B8C7EDEA0A4C7510248775640B515269DD
SHA-256:	51DBBD52B1A201A1A1A6C9DEF4FBF2C8187879D81FAC50694E441043A5F69C92
SHA-512:	F7F2F1B72D91D11CEBE89EE247D69A03257D09230430414710FEAB438E202E6B9E2A59831CE67D9BFC6BD4C74679E15C4B3E6A1CF13DCC1CADC6BC9A888A688A
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................(..........T.......8...........T...........X...`...........\|...........h...............................................................................eJ..............Lw......................T.......<......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2BCC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8856
Entropy (8bit):	3.6931325357464084
Encrypted:	false
SSDEEP:	192:R6l7wVeJp5RtWy6Y8868fgmf2tQlprH89bmQCfOg+im:R6lXJ3LWy6YXhgmf2tQQm1fDy
MD5:	D8C372F3091C478126F981E154B101CC
SHA1:	B1AC5415685B9E5ADC040B1711E902AF8E5F582C
SHA-256:	2ABF0915F22A2AB0C9FCB682A62546D2F3F61070EEA70DCE918E4AB5400880AF
SHA-512:	46B5CAC454325B5D0F1FB42AF635831D51206DC1F34FB016AB76D4970D5C5F01BF1E4A50F970AEB00B5105C740C8C9B95A6EAD585F6973AC49F4468FCB46EE89
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.1.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2BFC.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4875
Entropy (8bit):	4.45720116797675
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGWJg771I9cfWpW8VYWYm8M4JCsCK+FPayq8vhKYptSTSWd:uIjfzI7rO7VeJeaW3poOWd
MD5:	DF8BD80C765536D4AB18F327EA55DC61
SHA1:	09D41F1BD69B2DEE08359DED49F6A615B53B80D9
SHA-256:	E77166DB883F324D0F52022368F49105E0F1B786DD2C22B3E56DA38CBB3E03D2
SHA-512:	0F52F74EAE6A1F72E5EEC962CD93E4CE9023596E4EFF34A23B7A7CB722D3CEFC6A88DC5516F1845E4584411A6CC7F163BA76CA400384B8BD3DD090E453C64A6A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429156" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C4A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8850
Entropy (8bit):	3.6924868726070645
Encrypted:	false
SSDEEP:	192:R6l7wVeJA5RhVWg6YC5T1agmf2tQlprM89bmmCfqim:R6lXJOFWg6YC91agmf2tQRmDfG
MD5:	BA581430DD26C92965CC032B1C3F9205
SHA1:	6AF8D2782FA4688C29B4D38C6A1C9420974A7436
SHA-256:	90BFB3CFEBB0E8FCCEF8AC1A91DCB4D633D36A944B5F851A3E777A8B1C0D7D9A
SHA-512:	3B95137746AB50C938CFA104C4F2B6730A88F8806123A3C52A7E2028ADFEFAEC795A79F4F88663AE2BEE8DF5BD2AE741BFE1DE4E1015D1C3C64AFC4372E73FB4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C99.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4875
Entropy (8bit):	4.457811469384468
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGWJg771I9cfWpW8VYj5Ym8M4JCsCK+FCyq8vhKTptSTSRd:uIjfzI7rO7VBJJWcpoORd
MD5:	6890CA58B1E25967EA96E25F50DBAEEB
SHA1:	432A364D2A47CB400D129CD6DA13E7667E8CD110
SHA-256:	076BF0D2AF9C334ABCBEBD2B1185BEEEF98161C27B9D1A3762AEB9AF5D1FF240
SHA-512:	FCABAC455034591B397DD7A83D7D732FF6B8627119B87CB6BF3691A920046D4E0B6444D03E52DE8F258F2585C5DF192D10513C04AB8D3500009008ECE5E6EBD4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429156" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER363B.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 09:33:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57804
Entropy (8bit):	1.638825119526229
Encrypted:	false
SSDEEP:	192:mj/gaquOMWpolrQFFwZf/NvFCQzIAquRSdN:K6TClr5f/NvJb3SP
MD5:	359520E3D229E61D86837441A250657F
SHA1:	03394A91900133F5A22EA80A9E507807541F29C0
SHA-256:	49EBE5C38E0B34C89D8767F758CD41A0CF52CB329CED24F312C55F2B7F8070F7
SHA-512:	532677F445A0E2CF8643802481CED812EEA3AF521121747F5842EE54F581004A75EB37BB12F6A2D4FB109D4FB8814D297A0E2563EC6DEAC30C08040551874CCD
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................(..........T.......8...........T...........................\|...........h...............................................................................eJ..............Lw......................T.......,......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER366A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8514
Entropy (8bit):	3.6952574645849445
Encrypted:	false
SSDEEP:	192:R6l7wVeJL3RcWn6YC5Q1agmfHluWprRC89bR91fdbm:R6lXJr6Wn6YCu1agmfHluw7Rff8
MD5:	8A905C0232D8FB85E5506985A630C389
SHA1:	CD06A9EE71C1E45FEFA4D69F9FA8D6B1D38DB30E
SHA-256:	8B62B47D6CF0C2CE87CD359EE10A48E5BF742C069480FB8C1D8FC2F2734E2218
SHA-512:	9A1D16CCAA1AE460823B7EEF24BBCE238395DA297D62AA314878A887812226A01A22085C771413A170137B32633CF12D604A976C6BE55DF29CDD365E940983BF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER369A.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4755
Entropy (8bit):	4.465955049281228
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGWJg771I9cfWpW8VYRYm8M4JCsCKlFaYfyq85mbkUqptSTS6d:uIjfzI7rO7VNJiSW/poO6d
MD5:	0D69C2FCC08DACD7528A7F106E2DD904
SHA1:	7836CA289E037D5A8A493E2B3191361296E3CE22
SHA-256:	12C96A7BF55A2652613C8EE6A874692CE730BDD4D11021579034965CCE1E66BC
SHA-512:	3AA509F1933D7C5105ADC913AA9E618937F4718C803108E70A7C949F80FBED9FC9501BFE222DB99B9861C1B74FAFB52D65E0F873FC4B17EF245ABC3C53893923
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429156" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4389.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 09:34:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56980
Entropy (8bit):	1.6773302953800004
Encrypted:	false
SSDEEP:	192:rVEOMH7j8qamKtHAgqG+KAYi17lQV0UltmhS:tm7jRavtH65VPg0Zh
MD5:	72EFF898A48FD77752BD1B5E6FA14A97
SHA1:	677C7DFF3503B83D19E7F1B35204CE8331543EEE
SHA-256:	3E0B650BBCE73D93DA27A0C113C6A90A89BEE3FC4832A97C46CA20D595C1DAF9
SHA-512:	7F1AAF7C944E53CB35FA925951A6860BAC87D27AFE09A6E8AB7C70034EB493CED271F7E45480119FAA6F97E078F97CE37829931F43D89E8D6075B9C417599C28
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................(..........T.......8...........T...........................\|...........h...............................................................................eJ..............Lw......................T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER43C8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8518
Entropy (8bit):	3.694592615805223
Encrypted:	false
SSDEEP:	192:R6l7wVeJXWRbWf6YC5H1agmfHL2prQ89bg81f9Am:R6lXJG9Wf6YCp1agmfHLOgmfP
MD5:	A3A9C39C0D03AF0AAB8C13B579DACA94
SHA1:	3735A883AFF1CC594D94E4B6530D4325353A6F13
SHA-256:	C95D01DF218DA22B385BDE5502F4E7708BFFBC3274BB6E4734BAE1AF649E8BDC
SHA-512:	AF44E5F7786B62E81D0FED2FB0482BC70CDDDAA45C8341D30DC4F8E259F05BC630AE1C40223786D7FDC52427CB006C5DACB874A310F44F6827EF5504EAE573F3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER43E9.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4755
Entropy (8bit):	4.465351271341541
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGWJg771I9cfWpW8VYQWYm8M4JCsCKBFDHpyq85mbZptSTShhd:uIjfzI7rO7VZJvJjpoOhhd
MD5:	2EAD52F5DA7C917A9B27642DD73D0EC1
SHA1:	3E22BBFBC92A614265EDF998E748A3ED5EE38FEF
SHA-256:	B4D473ACA65757AD3B1D32AC4FF00D1CFC878E52A1339DE7D7CEBB246A916C87
SHA-512:	BBA8BE5869D59F86A593F43AC47750AEF73C2DF21068D11299CDE1B3EF472182F818DDED1F5A4E4B726FFA68AAB8023A3AA1A34789EF8DDB8BB95803741F4B7F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429156" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466379627626385
Encrypted:	false
SSDEEP:	6144:DIXfpi67eLPU9skLmb0b4zWSPKaJG8nAgejZMMhA2gX4WABl0uNcdwBCswSb9:UXD94zWlLZMM6YFHa+9
MD5:	C2F4B8D41A806887AACFA1423E7E23F2
SHA1:	C6696B4F7397DBA923A16D19E615527782264E56
SHA-256:	04C35A909E0D81141C484A974D634D4F60BE624D6CD512E2BAF738D6B6C96C93
SHA-512:	1C99BA019448DCC4D96FE081D7393E74E3EA8E14A557491342CB58F9D48413CDEF0E2A6F250662E96FD03692C8C89021E835A51576F7E9B97D4ED8971D4A336A
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmB./...................................................................................................................................................................................................................................................................................................................................................9.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.899491835786787
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	libmmd.dll.dll
File size:	4'148'864 bytes
MD5:	19c31c58313c58fc88cf27e77befb0c3
SHA1:	b0711e10ef98b86e76ad28665285598d8809ae36
SHA256:	c2684b143c3417c588a3c0ae0a9c4329e71a04fc304aa3a69eae61ede1d0b290
SHA512:	97c954d009d10aed8fdbe02efe3b8d74840c2dce03da8fe5a5001d390afb4598a5bb3d74dacb740dec10e86aadc54b792bcc3c6815b2dfff036f14dace31ac86
SSDEEP:	98304:0JLi7X0J2iGkPyxtZPk8joEGIbQOpv3VzGIsJQQJ:OyqCtZM8UEtb5yIs24
TLSH:	B716AE82F56395D4E868607028777E83DB3ABC86023815B31BE39D6D2EB77900DFB255
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j..............fy......fy..5...fy......fy...............~.......~.......~..............}~......}~$.....}~......Rich...........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180174c8c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x657971E2 [Wed Dec 13 08:57:06 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	9c43e43594e158938562d221466190bd

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	02/05/2023 01:00:00 02/05/2024 00:59:59
Subject Chain	CN=Intel Corporation, O=Intel Corporation, S=California, C=US, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US, SERIALNUMBER=2189074
Version:	3
Thumbprint MD5:	50A9AD93AF17D0A88D58FA79C00EB26A
Thumbprint SHA-1:	26F9D3F3DBF410A180F808B6928766175502BCBF
Thumbprint SHA-256:	7A128EAB12AEA9A3C0E89F233FD68B48F9482CF6FC0EC5BAE76CD4A615378A1C
Serial:	00CB6EEC20A5EBAEA975BC3B77D18FD5B8

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FCDB4B09C37h
call 00007FCDB4B09EF0h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FCDB4B09AC4h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001336Bh]
dec eax
mov ecx, ebx
call dword ptr [0001335Ah]
call dword ptr [00013364h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00013358h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [0001334Ch]
test eax, eax
je 00007FCDB4B09C39h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [0022C4AAh]
call 00007FCDB4B09DFEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [0022C591h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [0022C521h], eax
dec eax
mov eax, dword ptr [0022C57Ah]
dec eax
mov dword ptr [0022C3EBh], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3575b0	0x4f4c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x35c4fc	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3f4000	0x3c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3a3000	0x5550	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3f2600	0x2880
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3f5000	0x403e
IMAGE_DIRECTORY_ENTRY_DEBUG	0x353d20	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x353d80	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x188000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x186200	0x186200	818051dd5f4bc454c83059f32aed6dab	False	0.4215276804309516	data	6.534520269339557	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x188000	0x1d4d52	0x1d4e00	818123b268797eaff011629897851ac0	False	0.5836506098373767	data	6.875090602182947	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35d000	0x452d0	0x43a00	2d1c930230c79323dc90691a5ccd0ef5	False	0.22908964879852126	data	5.449861496582813	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3a3000	0x5550	0x5600	fd3bc5cd535f124b2aa488a72349a36d	False	0.5022256540697675	data	5.801047136232488	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.trace	0x3a9000	0x49805	0x49a00	64b584dc2eef8bb04f5d567c279870b3	False	0.3832402642190153	data	5.919557084086885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x3f3000	0xfc	0x200	6c59634414675e6616fa85c4c4005be9	False	0.32421875	data	2.475378694262942	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3f4000	0x3c8	0x400	2b3b6b6b524fc7e5897894a62a8ba3de	False	0.4140625	data	3.097877128088893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3f5000	0x4038	0x4200	978c22d1c97831bacdef87f98bf611de	False	0.4952059659090909	data	6.006733143474568	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3f4060	0x364	data	English	United States	0.44815668202764974

Imports

DLL

Import

KERNEL32.dll

GetModuleHandleA, GetProcAddress, GetThreadLocale, LoadLibraryA, FormatMessageA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, WriteConsoleW, RtlUnwindEx, InterlockedFlushSList, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, EncodePointer, RaiseException, RtlPcToFileHeader, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, HeapFree, HeapAlloc, GetStdHandle, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetProcessHeap, SetFilePointerEx, GetStringTypeW, SetStdHandle, HeapSize, HeapReAlloc, FlushFileBuffers, WriteFile, GetConsoleOutputCP, GetConsoleMode, CloseHandle, CreateFileW

Exports

Name	Ordinal	Address
_LIB_VERSIONIMF	1	0x18035ff20
__acosdq	2	0x180001090
__acoshq	3	0x180001170
__acosq	4	0x180001250
__annuityq	5	0x180001350
__asindq	6	0x180001440
__asinhq	7	0x180001520
__asinq	8	0x180001600
__atan2dq	9	0x180001700
__atan2q	10	0x180001810
__atand2q	11	0x180001920
__atandq	12	0x180001a10
__atanhq	13	0x180001af0
__atanq	14	0x180001bd0
__bwr_acos	15	0x180020eb0
__bwr_acosd	16	0x180008bc0
__bwr_acosdf	17	0x180003500
__bwr_acosf	18	0x180008f30
__bwr_acosh	19	0x180009240
__bwr_acoshf	20	0x1800096a0
__bwr_acospi	21	0x1800cb240
__bwr_acospif	22	0x1800cb690
__bwr_annuity	23	0x1800037a0
__bwr_annuityf	24	0x1800037b0
__bwr_asin	25	0x180020ec0
__bwr_asind	26	0x1800098f0
__bwr_asindf	27	0x1800038a0
__bwr_asinf	28	0x180009cc0
__bwr_asinh	29	0x18000a000
__bwr_asinhf	30	0x18000a3f0
__bwr_asinpi	31	0x1800cb880
__bwr_asinpif	32	0x1800c87a0
__bwr_atan	33	0x18000b210
__bwr_atan2	34	0x18000a620
__bwr_atan2d	35	0x180003c30
__bwr_atan2df	36	0x180003c40
__bwr_atan2f	37	0x18000acd0
__bwr_atan2pi	38	0x1800c0cc0
__bwr_atan2pif	39	0x1800c22d0
__bwr_atand	40	0x180003e50
__bwr_atand2	41	0x180003e60
__bwr_atand2f	42	0x180003e70
__bwr_atandf	43	0x180003ec0
__bwr_atanf	44	0x18000b460
__bwr_atanh	45	0x18000b700
__bwr_atanhf	46	0x18000bae0
__bwr_atanpi	47	0x1800c7270
__bwr_atanpif	48	0x1800c9880
__bwr_cbrt	49	0x18000bd90
__bwr_cbrtf	50	0x18000c030
__bwr_cdfnorminv	51	0x180004630
__bwr_cdfnorminvf	52	0x180004640
__bwr_ceil	53	0x18000c2e0
__bwr_ceilf	54	0x18000c3b0
__bwr_compound	55	0x180004ac0
__bwr_compoundf	56	0x180004ad0
__bwr_copysign	57	0x18000c460
__bwr_copysignf	58	0x18000c490
__bwr_cos	59	0x18000c4c0
__bwr_cosd	60	0x18000cb40
__bwr_cosdf	61	0x18000d020
__bwr_cosf	62	0x18000d2e0
__bwr_cosh	63	0x18000d570
__bwr_coshf	64	0x18000d9e0
__bwr_cospi	65	0x1800cc890
__bwr_cospif	66	0x1800ccb00
__bwr_cot	67	0x180004ff0
__bwr_cotd	68	0x18000dd10
__bwr_cotdf	69	0x18000e4b0
__bwr_cotf	70	0x1800050e0
__bwr_erf	71	0x1800c4f60
__bwr_erfc	72	0x1800c55b0
__bwr_erfcf	73	0x1800c6490
__bwr_erfcx	74	0x1800052e0
__bwr_erfcxf	75	0x1800052f0
__bwr_erff	76	0x1800c5400
__bwr_erfinv	77	0x180005300
__bwr_erfinvf	78	0x180005310
__bwr_exp	79	0x18000f520
__bwr_exp10	80	0x18000e810
__bwr_exp10f	81	0x18000eb60
__bwr_exp2	82	0x18000ecf0
__bwr_exp2f	83	0x18000f210
__bwr_expf	84	0x18000f840
__bwr_expm1	85	0x18000fa80
__bwr_expm1f	86	0x18000fe30
__bwr_fabs	87	0x180005730
__bwr_fabsf	88	0x180005740
__bwr_fdim	89	0x180010150
__bwr_fdimf	90	0x180010290
__bwr_floor	91	0x1800103a0
__bwr_floorf	92	0x180010470
__bwr_fma	93	0x180010510
__bwr_fmaf	94	0x180010f60
__bwr_fmax	95	0x1800114d0
__bwr_fmaxf	96	0x180011530
__bwr_fmin	97	0x180011580
__bwr_fminf	98	0x1800115e0
__bwr_fmod	99	0x180011630
__bwr_fmodf	100	0x1800117f0
__bwr_frexp	101	0x180011810
__bwr_frexpf	102	0x180005e80
__bwr_gamma	103	0x180011da0
__bwr_gamma_r	104	0x180013170
__bwr_gammaf	105	0x180013660
__bwr_gammaf_r	106	0x180014470
__bwr_hypot	107	0x1800118b0
__bwr_hypotf	108	0x1800119e0
__bwr_ilogb	109	0x180011b00
__bwr_ilogbf	110	0x180006070
__bwr_invsqrt	111	0x180006080
__bwr_invsqrtf	112	0x180006090
__bwr_j0	113	0x1800060d0
__bwr_j0f	114	0x1800060e0
__bwr_j1	115	0x1800060f0
__bwr_j1f	116	0x180006100
__bwr_jn	117	0x180006110
__bwr_jnf	118	0x180006120
__bwr_ldexp	119	0x180011be0
__bwr_ldexpf	120	0x1800061b0
__bwr_lgamma	121	0x180011da0
__bwr_lgamma_r	122	0x180013170
__bwr_lgammaf	123	0x180013660
__bwr_lgammaf_r	124	0x180014470
__bwr_llrint	125	0x180014770
__bwr_llrintf	126	0x180014820
__bwr_llround	127	0x1800148c0
__bwr_llroundf	128	0x1800149c0
__bwr_log	129	0x180015be0
__bwr_log10	130	0x180014ab0
__bwr_log10f	131	0x180014d30
__bwr_log1p	132	0x180014f80
__bwr_log1pf	133	0x180015540
__bwr_log2	134	0x180015650
__bwr_log2f	135	0x1800158c0
__bwr_logb	136	0x180015af0
__bwr_logbf	137	0x180006730
__bwr_logf	138	0x180015e70
__bwr_lrint	139	0x180016080
__bwr_lrintf	140	0x180016120
__bwr_lround	141	0x1800161c0
__bwr_lroundf	142	0x180016300
__bwr_modf	143	0x1800163f0
__bwr_modff	144	0x180006c30
__bwr_nearbyint	145	0x1800164e0
__bwr_nearbyintf	146	0x180016860
__bwr_nextafter	147	0x180016a80
__bwr_nextafterf	148	0x180016c20
__bwr_nexttoward	149	0x180016db0
__bwr_nexttowardf	150	0x180016fb0
__bwr_pow	151	0x1800171b0
__bwr_pow2o3	152	0x1800bff20
__bwr_pow2o3f	153	0x1800c0280
__bwr_pow3o2	154	0x1800c0520
__bwr_pow3o2f	155	0x1800c0960
__bwr_powf	156	0x180017da0
__bwr_powr	157	0x1800c3440
__bwr_powrf	158	0x1800c4300
__bwr_remainder	159	0x1800184f0
__bwr_remainderf	160	0x180018960
__bwr_remquo	161	0x180007470
__bwr_remquof	162	0x180007480
__bwr_rint	163	0x180018980
__bwr_rintf	164	0x1800189b0
__bwr_round	165	0x1800189e0
__bwr_roundf	166	0x180018b00
__bwr_scalb	167	0x180018bd0
__bwr_scalbf	168	0x1800076d0
__bwr_scalbln	169	0x180018eb0
__bwr_scalblnf	170	0x180007760
__bwr_scalbn	171	0x180019070
__bwr_scalbnf	172	0x1800077f0
__bwr_significand	173	0x180019230
__bwr_significandf	174	0x1800192b0
__bwr_sin	175	0x180019300
__bwr_sincos	176	0x180019990
__bwr_sincosd	177	0x180019e70
__bwr_sincosdf	178	0x180019eb0
__bwr_sincosf	179	0x18001a200
__bwr_sincospi	180	0x1800cbd40
__bwr_sincospif	181	0x1800cc1b0
__bwr_sind	182	0x18001a450
__bwr_sindf	183	0x18001aa80
__bwr_sinf	184	0x18001ad60
__bwr_sinh	185	0x18001afe0
__bwr_sinhcosh	186	0x18001b500
__bwr_sinhcoshf	187	0x18001baa0
__bwr_sinhf	188	0x18001bf10
__bwr_sinpi	189	0x1800cc400
__bwr_sinpif	190	0x1800cc6e0
__bwr_sqrt	191	0x180008b50
__bwr_sqrtf	192	0x18001c2b0
__bwr_tan	193	0x18001c330
__bwr_tand	194	0x18001cb50
__bwr_tandf	195	0x18001d310
__bwr_tanf	196	0x18001d680
__bwr_tanh	197	0x18001d940
__bwr_tanhf	198	0x18001de10
__bwr_tanpi	199	0x1800bf720
__bwr_tanpif	200	0x1800bfb10
__bwr_tgamma	201	0x1800085e0
__bwr_tgammaf	202	0x1800085f0
__bwr_trunc	203	0x18001e110
__bwr_truncf	204	0x180008670
__bwr_y0	205	0x18001ed60
__bwr_y0f	206	0x180008690
__bwr_y1	207	0x18001f690
__bwr_y1f	208	0x1800086b0
__bwr_yn	209	0x18001f7e0
__bwr_ynf	210	0x180020210
__cabsq	211	0x180166d00
__cacoshq	212	0x180166d60
__cacosq	213	0x180167b30
__cargq	214	0x180167bd0
__casinhq	215	0x180167c30
__casinq	216	0x1801689b0
__catanhq	217	0x180168a40
__catanq	218	0x180169770
__cbrtq	219	0x180001cb0
__ccoshq	220	0x180169800
__ccosq	221	0x1801699c0
__ceilq	222	0x180154b30
__cexp10q	223	0x180169db0
__cexp2q	224	0x180169eb0
__cexpm1q	225	0x180169fb0
__cexpq	226	0x18016a430
__cimagq	227	0x18016a9e0
__cisdq	228	0x18016a9f0
__cisq	229	0x18016aa40
__clog10q	230	0x18016aa90
__clog1pq	231	0x18016ac00
__clog2q	232	0x18016ad50
__clog_f90	233	0x1800d7130
__clogf_f90	234	0x1800d71b0
__clogq	235	0x18016aec0
__clogq_f90	236	0x1800d71f0
__compoundq	237	0x180001db0
__conjq	238	0x18016af70
__copysignq	239	0x180154d20
__cosdq	240	0x180001ea0
__coshq	241	0x180001f80
__cosq	242	0x180002060
__cotdq	243	0x180002140
__cotq	244	0x180002220
__cpowq	245	0x18016afa0
__cprojq	246	0x18016b130
__crealq	247	0x18016b1f0
__csinhq	248	0x18016b200
__csinq	249	0x18016b3f0
__csqrt_f90	250	0x1800d7280
__csqrtf_f90	251	0x1800d7300
__csqrtq	252	0x18016b810
__csqrtq_f90	253	0x1800d7340
__ctanhq	254	0x18016c660
__ctanq	255	0x18016cc00
__dremq	256	0x1800dfad0
__erfcq	257	0x1800ddc30
__erfcxq	258	0x1800ddc90
__erfq	259	0x1800dd8d0
__exp10q	260	0x180002300
__exp2q	261	0x1800023e0
__expm1q	262	0x1800024c0
__expq	263	0x1800025a0
__fabsq	264	0x180154d50
__fdimq	265	0x180154e20
__finite	266	0x1800a1490
__finited	267	0x1800a1490
__finitef	268	0x1800ae000
__finitel	269	0x1800ae020
__floorq	270	0x180155b40
__fmaq	271	0x180155d20
__fmaxq	272	0x180157360
__fminq	273	0x180157550
__fmodq	274	0x1800df400
__fpclassify	275	0x1800adeb0
__fpclassifyd	276	0x1800adeb0
__fpclassifyf	277	0x1800adf10
__fpclassifyl	278	0x1800adf50
__fpclassifyq	279	0x180166bb0
__frexpq	280	0x180157740
__gammaq	281	0x1800ded70
__gammaq_r	282	0x1801579a0
__hypotq	283	0x1800026a0
__ilogbq	284	0x1801579f0
__invsqrtq	285	0x180002790
__isfinite	286	0x1800a1490
__isfinited	287	0x1800a1490
__isfinitef	288	0x1800ae000
__isfinitel	289	0x1800ae020
__isfiniteq	290	0x180166c20
__isgreater	291	0x1800ae0b0
__isgreaterequal	292	0x1800ae1e0
__isgreaterequalf	293	0x1800ae1a0
__isgreaterequall	294	0x1800ae230
__isgreaterequalq	295	0x1801668c0
__isgreaterf	296	0x1800ae070
__isgreaterl	297	0x1800ae100
__isgreaterq	298	0x180166810
__isinf	299	0x1800ae2d0
__isinfd	300	0x1800ae2d0
__isinff	301	0x1800ae310
__isinfl	302	0x1800ae340
__isinfq	303	0x180166c40
__isless	304	0x1800ae3f0
__islessequal	305	0x1800ae520
__islessequalf	306	0x1800ae4e0
__islessequall	307	0x1800ae570
__islessequalq	308	0x180166a20
__islessf	309	0x1800ae3b0
__islessgreater	310	0x1800ae650
__islessgreaterf	311	0x1800ae610
__islessgreaterl	312	0x1800ae6a0
__islessgreaterq	313	0x180166ad0
__islessl	314	0x1800ae440
__islessq	315	0x180166970
__isnan	316	0x1800ae740
__isnand	317	0x1800ae740
__isnanf	318	0x1800ae770
__isnanl	319	0x1800ae790
__isnanq	320	0x180166c80
__isnormal	321	0x1800ae7f0
__isnormald	322	0x1800ae7f0
__isnormalf	323	0x1800ae820
__isnormall	324	0x1800ae840
__isnormalq	325	0x180166cc0
__isunordered	326	0x1800ae8b0
__isunorderedf	327	0x1800ae8f0
__isunorderedl	328	0x1800ae920
__isunorderedq	329	0x180166b60
__j0q	330	0x1800dc990
__j1q	331	0x1800dcb90
__jnq	332	0x1800dcc10
__ldexpq	333	0x180157bc0
__lgammaq	334	0x1800ded70
__lgammaq_r	335	0x1801579a0
__libm128_nexttoward128	336	0x1801642b0
__libm128_nexttoward128f	337	0x180164060
__libm128_nexttoward128l	338	0x180164500
__libm_f_pow2i	339	0x1800d9cc0
__libm_f_powc16i8	340	0x1800d9ce0
__libm_f_powc32i8	341	0x1800dbb90
__libm_f_powc8i8	342	0x1800d9ee0
__libm_f_powcc	343	0x1800da0c0
__libm_f_powci	344	0x1800da120
__libm_f_powdd	345	0x1800da140
__libm_f_powdi	346	0x1800da150
__libm_f_powi8i4	347	0x1800da1e0
__libm_f_powi8i8	348	0x1800da270
__libm_f_powii	349	0x1800da300
__libm_f_powji	350	0x1800da370
__libm_f_powr16i8	351	0x1800dc110
__libm_f_powr4i8	352	0x1800da400
__libm_f_powr8i8	353	0x1800da5c0
__libm_f_powri	354	0x1800da7a0
__libm_f_powrr	355	0x1800da8f0
__libm_f_powzi	356	0x1800da900
__libm_f_powzz	357	0x1800da950
__libm_flt_rounds	358	0x1800ad120
__libm_logl	359	0x1800067b0
__libm_nexttoward64	360	0x18007c830
__libm_nexttoward64f	361	0x18007c9d0
__libm_nexttoward64l	362	0x18007cba0
__libm_pow_bb	363	0x1800da9b0
__libm_pow_cc_val	364	0x1800da9c0
__libm_pow_ci	365	0x1800daa70
__libm_pow_ci_val	366	0x1800daa80
__libm_pow_cr_val	367	0x1800dab10
__libm_pow_dd	368	0x1800daba0
__libm_pow_di_val	369	0x1800da150
__libm_pow_dz_val	370	0x1800dabc0
__libm_pow_hh	371	0x1800daca0
__libm_pow_ii_val	372	0x1800dacb0
__libm_pow_rc_val	373	0x1800dad20
__libm_pow_ri_val	374	0x1800dadb0
__libm_pow_zd_val	375	0x1800dadd0
__libm_pow_zi_val	376	0x1800dae70
__libm_pow_zz_val	377	0x1800db0a0
__libm_setusermatherr	378	0x1800aed80
__libm_setusermatherrf	379	0x1800aed60
__libm_setusermatherrl	380	0x1800aeda0
__libm_sse2_sincos	381	0x180073b70
__libm_sse2_sincosf	382	0x180073f20
__llrintq	383	0x180161e80
__llroundq	384	0x180162570
__log10q	385	0x180002870
__log1pq	386	0x180002950
__log2q	387	0x180002a30
__logbq	388	0x180162850
__logq	389	0x180002b10
__lrintq	390	0x180162b70
__lroundq	391	0x180163090
__modfq	392	0x180163310
__nanq	393	0x1801635f0
__nearbyintq	394	0x180163620
__nextafterq	395	0x1801639c0
__nexttowardq	396	0x180163ce0
__nintq	397	0x1800e06f0
__pow_eq	398	0x1800de690
__powc16i4	399	0x1800d73d0
__powc16i8	400	0x1800d7670
__powc32i4	401	0x1800d7920
__powc32i8	402	0x1800d8270
__powc8i4	403	0x1800d8bc0
__powc8i8	404	0x1800d8e50
__powi4i4	405	0x1800d90f0
__powi8i8	406	0x1800d9170
__powi_eq	407	0x1800dfdb0
__powiq	408	0x1800dfbc0
__powq	409	0x180002c10
__powr10i4	410	0x1800d91f0
__powr10i8	411	0x1800d92c0
__powr16i4	412	0x1800d9390
__powr16i8	413	0x1800d9670
__powr4i4	414	0x1800d9970
__powr4i8	415	0x1800d9a20
__powr8i4	416	0x1800d9ad0
__powr8i8	417	0x1800d9bc0
__remainderq	418	0x1800dfad0
__remquoq	419	0x1800dfb40
__rintq	420	0x180164820
__roundq	421	0x180164c20
__rsqrtq	422	0x1800e02a0
__scalblnq	423	0x180164e10
__scalbnq	424	0x180165460
__scalbq	425	0x180165ab0
__signbit	426	0x1800ae9b0
__signbitd	427	0x1800ae9b0
__signbitf	428	0x1800ae9c0
__signbitl	429	0x1800ae9d0
__signbitq	430	0x180166cf0
__signgamq	431	0x1803a0a44
__significandq	432	0x180166380
__sincosdq	433	0x180002d00
__sincosq	434	0x180002dd0
__sindq	435	0x180002ea0
__sinhcoshq	436	0x180002f80
__sinhq	437	0x180003050
__sinq	438	0x180003130
__sqrtq	439	0x1800e01e0
__tandq	440	0x180003210
__tanhq	441	0x1800032f0
__tanq	442	0x1800033d0
__tgammaq	443	0x1801665a0
__truncq	444	0x1801666b0
__y0q	445	0x1800dcc80
__y1q	446	0x1800dcd40
__ynq	447	0x1800dcdc0
acos	448	0x180003480
acosd	449	0x1800034f0
acosdf	450	0x180003500
acosdf16	451	0x1800d6a00
acosdl	452	0x180021fe0
acosf	453	0x180003570
acosf16	454	0x1800d66f0
acosh	455	0x1800035e0
acoshf	456	0x180003650
acoshf16	457	0x1800d6120
acoshl	458	0x180003660
acosl	459	0x180003690
acospi	460	0x180003720
acospif	461	0x180003790
acospif16	462	0x1800d6b70
annuity	463	0x1800037a0
annuityf	464	0x1800037b0
annuityf16	465	0x1800d6d00
annuityl	466	0x180025fe0
asin	467	0x180003820
asind	468	0x180003890
asindf	469	0x1800038a0
asindf16	470	0x1800d6a20
asindl	471	0x1800298b0
asinf	472	0x180003910
asinf16	473	0x1800d6710
asinh	474	0x180003980
asinhf	475	0x1800039f0
asinhf16	476	0x1800d6140
asinhl	477	0x180003a00
asinl	478	0x180003a30
asinpi	479	0x180003ac0
asinpif	480	0x180003b30
asinpif16	481	0x1800d6b90
atan	482	0x180003ba0
atan2	483	0x180003c20
atan2d	484	0x180003c30
atan2df	485	0x180003c40
atan2df16	486	0x1800d6a60
atan2dl	487	0x180003c50
atan2f	488	0x180003d00
atan2f16	489	0x1800d67b0
atan2l	490	0x180003d10
atan2pi	491	0x180003dc0
atan2pif	492	0x180003e40
atan2pif16	493	0x1800d6f80
atand	494	0x180003e50
atand2	495	0x180003e60
atand2f	496	0x180003e70
atand2l	497	0x180003e80
atandf	498	0x180003ec0
atandf16	499	0x1800d6a40
atandl	500	0x1800300d0
atanf	501	0x180003f30
atanf16	502	0x1800d6730
atanh	503	0x180003fa0
atanhf	504	0x180004010
atanhf16	505	0x1800d6750
atanhl	506	0x180004020
atanl	507	0x180004050
atanpi	508	0x1800040e0
atanpif	509	0x180004150
atanpif16	510	0x1800d6fb0
cabs	511	0x18009a910
cabsf	512	0x18009a930
cabsl	513	0x1800a43a0
cacos	514	0x180004160
cacosf	515	0x18009b070
cacosh	516	0x1800041b0
cacoshf	517	0x18009b870
cacoshl	518	0x1800a43e0
cacosl	519	0x180004200
carg	520	0x18009b920
cargf	521	0x18009b940
cargl	522	0x180004260
casin	523	0x18009b970
casinf	524	0x18009ba30
casinh	525	0x1800042c0
casinhf	526	0x180004310
casinhl	527	0x180004320
casinl	528	0x1800a5290
catan	529	0x18009c260
catanf	530	0x18009c320
catanh	531	0x180004380
catanhf	532	0x1800043d0
catanhl	533	0x1800043e0
catanl	534	0x1800a7af0
cbrt	535	0x1800044a0
cbrtf	536	0x180004510
cbrtf16	537	0x1800d68a0
cbrtl	538	0x180004520
ccos	539	0x18009cbe0
ccosf	540	0x18009cc70
ccosh	541	0x180004550
ccoshf	542	0x1800045a0
ccoshl	543	0x1800045b0
ccosl	544	0x1800a8360
cdfnorm	545	0x180004610
cdfnormf	546	0x180004620
cdfnorminv	547	0x180004630
cdfnorminvf	548	0x180004640
cdfnorminvf16	549	0x1800d6d50
ceil	550	0x1800046b0
ceilf	551	0x180004720
ceilf16	552	0x1800d63c0
ceill	553	0x18003adb0
cexp	554	0x1800047c0
cexp10	555	0x180004890
cexp10f	556	0x180004880
cexp10l	557	0x1800048e0
cexp2	558	0x180004950
cexp2f	559	0x180004940
cexp2l	560	0x1800049a0
cexpf	561	0x18009e590
cexpl	562	0x180004820
cimag	563	0x18009ed50
cimagf	564	0x18009ed60
cimagl	565	0x1800a9890
cis	566	0x18009ed70
cisd	567	0x18009edc0
cisdf	568	0x18009ee10
cisdl	569	0x1800a98a0
cisf	570	0x18009ee60
cisl	571	0x1800a9900
clog	572	0x180004a00
clog10	573	0x18009eeb0
clog10f	574	0x18009f6e0
clog10l	575	0x1800a9960
clog2	576	0x18009f760
clog2f	577	0x18009ff80
clog2l	578	0x1800aa2d0
clogf	579	0x180004a50
clogl	580	0x180004a60
compound	581	0x180004ac0
compoundf	582	0x180004ad0
compoundf16	583	0x1800d6d70
compoundl	584	0x18003bc80
conj	585	0x1800a15e0
conjf	586	0x1800a1600
conjl	587	0x1800ab550
copysign	588	0x180004b50
copysignf	589	0x180004bd0
copysignf16	590	0x1800d64f0
copysignl	591	0x18003c890
cos	592	0x180004c40
cosd	593	0x180004cb0
cosdf	594	0x180004d20
cosdf16	595	0x1800d6ac0
cosdl	596	0x180004d30
cosf	597	0x180004dc0
cosf16	598	0x1800d6100
cosh	599	0x180004e30
coshf	600	0x180004ea0
coshf16	601	0x1800d6770
coshl	602	0x180004eb0
cosl	603	0x180004ee0
cospi	604	0x180004f70
cospif	605	0x180004fe0
cospif16	606	0x1800d6fd0
cot	607	0x180004ff0
cotd	608	0x180005060
cotdf	609	0x1800050d0
cotdf16	610	0x1800d6ae0
cotdl	611	0x180042500
cotf	612	0x1800050e0
cotf16	613	0x1800d6970
cotl	614	0x180043240
cpow	615	0x1800a1620
cpowf	616	0x1800a23f0
cpowl	617	0x1800ad070
cproj	618	0x1800a24a0
cprojf	619	0x1800a2500
cprojl	620	0x1800ab570
creal	621	0x1800a2560
crealf	622	0x1800a2570
creall	623	0x1800ab630
csin	624	0x1800a2580
csinf	625	0x1800a2640
csinh	626	0x1800050f0
csinhf	627	0x180005140
csinhl	628	0x180005150
csinl	629	0x1800abcd0
csqrt	630	0x1800051b0
csqrtf	631	0x180005200
csqrtl	632	0x1800abe20
ctan	633	0x1800a3a10
ctanf	634	0x1800a3ad0
ctanh	635	0x180005210
ctanhf	636	0x180005260
ctanhl	637	0x180005270
ctanl	638	0x1800acf20
erf	639	0x180008980
erfc	640	0x180008a60
erfcf	641	0x1800089f0
erfcf16	642	0x1800d6360
erfcinv	643	0x180044690
erfcinvf	644	0x1800052d0
erfcl	645	0x18004a5e0
erfcx	646	0x1800052e0
erfcxf	647	0x1800052f0
erff	648	0x180008910
erff16	649	0x1800d68f0
erfinv	650	0x180005300
erfinvf	651	0x180005310
erfinvf16	652	0x1800d6da0
erfinvl	653	0x18004d030
erfl	654	0x18004caf0
exp	655	0x180005380
exp10	656	0x1800053f0
exp10f	657	0x180005460
exp10f16	658	0x1800d6c20
exp10l	659	0x180005470
exp2	660	0x180005500
exp2f	661	0x180005570
exp2f16	662	0x1800d6800
exp2l	663	0x180005580
expf	664	0x180005610
expf16	665	0x1800d6180
expl	666	0x180005620
expm1	667	0x1800056b0
expm1f	668	0x180005720
expm1f16	669	0x1800d61a0
expm1l	670	0x180051ea0
f_pow2i	671	0x1800d9cc0
f_powc16i8	672	0x1800d9ce0
f_powc32i8	673	0x1800dbb90
f_powc8i8	674	0x1800d9ee0
f_powcc	675	0x1800da0c0
f_powci	676	0x1800da120
f_powdd	677	0x1800da140
f_powdi	678	0x1800da150
f_powi8i4	679	0x1800db1e0
f_powi8i8	680	0x1800db270
f_powii	681	0x1800db300
f_powji	682	0x1800db370
f_powr16i8	683	0x1800dc430
f_powr4i8	684	0x1800db400
f_powr8i8	685	0x1800db5c0
f_powri	686	0x1800db7a0
f_powrr	687	0x1800da8f0
f_powzi	688	0x1800da900
f_powzz	689	0x1800da950
fabs	690	0x180005730
fabsf	691	0x180005740
fabsf16	692	0x1800d62e0
fabsl	693	0x180005750
fdim	694	0x1800057f0
fdimf	695	0x180005870
fdimf16	696	0x1800d6590
fdiml	697	0x180052990
feclearexcept	698	0x1800ad170
fedisableexcept	699	0x1800ad200
feenableexcept	700	0x1800ad2e0
fegetenv	701	0x180005880
fegetexcept	702	0x1800ad5c0
fegetexceptflag	703	0x1800ad640
fegetround	704	0x180005890
feholdexcept	705	0x1800ad720
feraiseexcept	706	0x1800058a0
fesetenv	707	0x1800058b0
fesetexceptflag	708	0x1800adc10
fesetround	709	0x1800058c0
fetestexcept	710	0x1800058d0
feupdateenv	711	0x1800ade70
finite	712	0x1800a1490
finited	713	0x1800a1490
finitef	714	0x1800ae000
finitef16	715	0x1800d7030
finitel	716	0x1800ae020
floor	717	0x180005940
floorf	718	0x1800059b0
floorf16	719	0x1800d63e0
floorl	720	0x180052e30
fma	721	0x180005a50
fmaf	722	0x180005af0
fmaf16	723	0x1800d6600
fmal	724	0x180055000
fmax	725	0x180005b70
fmaxf	726	0x180005bf0
fmaxf16	727	0x1800d65c0
fmaxl	728	0x180055ea0
fmin	729	0x180005c70
fminf	730	0x180005cf0
fminf16	731	0x1800d65e0
fminl	732	0x180056070
fmod	733	0x180005d70
fmodf	734	0x180005df0
fmodf16	735	0x1800d6910
fmodl	736	0x180056b50
fpclassify	737	0x1800adeb0
fpclassifyd	738	0x1800adeb0
fpclassifyf	739	0x1800adf10
fpclassifyf16	740	0x1800d7050
fpclassifyl	741	0x1800adf50
frexp	742	0x180005e70
frexpf	743	0x180005e80
frexpf16	744	0x1800d61c0
frexpl	745	0x180005e90
gamma	746	0x18005c6e0
gamma_r	747	0x18005e800
gammaf	748	0x18005ecf0
gammaf16	749	0x1800d6380
gammaf16_r	750	0x1800d6de0
gammaf_r	751	0x18005fcd0
gammal	752	0x18005ffd0
gammal_r	753	0x1800619c0
hypot	754	0x180005f30
hypotf	755	0x180005fb0
hypotf16	756	0x1800d6300
hypotl	757	0x180005fc0
ilogb	758	0x180006060
ilogbf	759	0x180006070
ilogbf16	760	0x1800d61e0
ilogbl	761	0x1800580e0
invsqrt	762	0x180006080
invsqrtf	763	0x180006090
invsqrtf16	764	0x1800d6c70
invsqrtl	765	0x1800060a0
isfinite	766	0x1800a1490
isfinited	767	0x1800a1490
isfinitef	768	0x1800ae000
isfinitef16	769	0x1800d7030
isfinitel	770	0x1800ae020
isgreater	771	0x1800ae0b0
isgreaterequal	772	0x1800ae1e0
isgreaterequalf	773	0x1800ae1a0
isgreaterequalf16	774	0x1800d6650
isgreaterequall	775	0x1800ae230
isgreaterf	776	0x1800ae070
isgreaterf16	777	0x1800d6630
isgreaterl	778	0x1800ae100
isinf	779	0x1800ae2d0
isinfd	780	0x1800ae2d0
isinff	781	0x1800ae310
isinff16	782	0x1800d70b0
isinfl	783	0x1800ae340
isless	784	0x1800ae3f0
islessequal	785	0x1800ae520
islessequalf	786	0x1800ae4e0
islessequalf16	787	0x1800d6690
islessequall	788	0x1800ae570
islessf	789	0x1800ae3b0
islessf16	790	0x1800d6670
islessgreater	791	0x1800ae650
islessgreaterf	792	0x1800ae610
islessgreaterf16	793	0x1800d66b0
islessgreaterl	794	0x1800ae6a0
islessl	795	0x1800ae440
isnan	796	0x1800ae740
isnand	797	0x1800ae740
isnanf	798	0x1800ae770
isnanf16	799	0x1800d70e0
isnanl	800	0x1800ae790
isnormal	801	0x1800ae7f0
isnormald	802	0x1800ae7f0
isnormalf	803	0x1800ae820
isnormalf16	804	0x1800d7110
isnormall	805	0x1800ae840
isunordered	806	0x1800ae8b0
isunorderedf	807	0x1800ae8f0
isunorderedf16	808	0x1800d66d0
isunorderedl	809	0x1800ae920
j0	810	0x1800060d0
j0f	811	0x1800060e0
j0f16	812	0x1800d6e00
j0l	813	0x180059180
j1	814	0x1800060f0
j1f	815	0x180006100
j1f16	816	0x1800d6e20
j1l	817	0x180059f10
jn	818	0x180006110
jnf	819	0x180006120
jnf16	820	0x1800d6e40
jnl	821	0x18005bd60
ldexp	822	0x1800061a0
ldexpf	823	0x1800061b0
ldexpf16	824	0x1800d61f0
ldexpl	825	0x18005c310
lgamma	826	0x18005c6e0
lgamma_r	827	0x18005e800
lgammaf	828	0x18005ecf0
lgammaf16	829	0x1800d6380
lgammaf16_r	830	0x1800d6de0
lgammaf_r	831	0x18005fcd0
lgammal	832	0x18005ffd0
lgammal_r	833	0x1800619c0
llrint	834	0x180006220
llrintf	835	0x180006290
llrintf16	836	0x1800d6450
llrintl	837	0x1800753e0
llround	838	0x180006300
llroundf	839	0x180006370
llroundf16	840	0x1800d6490
llroundl	841	0x180075930
log	842	0x1800063e0
log10	843	0x180006450
log10f	844	0x1800064c0
log10f16	845	0x1800d6840
log10l	846	0x1800765b0
log1p	847	0x180006530
log1pf	848	0x1800065a0
log1pf16	849	0x1800d6860
log1pl	850	0x1800065b0
log2	851	0x180006640
log2f	852	0x1800066b0
log2f16	853	0x1800d6880
log2l	854	0x180078180
logb	855	0x180006720
logbf	856	0x180006730
logbf16	857	0x1800d6210
logbl	858	0x180078dd0
logf	859	0x1800067a0
logf16	860	0x1800d6820
logl	861	0x1800067b0
lrint	862	0x180006840
lrintf	863	0x1800068b0
lrintf16	864	0x1800d6440
lrintl	865	0x180079990
lround	866	0x180006920
lroundf	867	0x180006990
lroundf16	868	0x1800d6480
lroundl	869	0x180079e50
matherr	870	0x1800069a0
matherrf	871	0x1800069a0
matherrl	872	0x1800069a0
maxmag	873	0x180006a20
maxmagf	874	0x180006aa0
maxmagf16	875	0x1800d6ee0
minmag	876	0x180006b20
minmagf	877	0x180006ba0
minmagf16	878	0x1800d6f10
modf	879	0x180006c20
modff	880	0x180006c30
modff16	881	0x1800d6230
modfl	882	0x18007a2c0
nan	883	0x18007a4b0
nanf	884	0x18007a490
nanf16	885	0x1800d6510
nanl	886	0x18007a4f0
nearbyint	887	0x180006ca0
nearbyintf	888	0x180006d10
nearbyintf16	889	0x1800d6400
nearbyintl	890	0x180006d20
nextafter	891	0x180006dc0
nextafterf	892	0x180006e40
nextafterf16	893	0x1800d6530
nextafterl	894	0x18007bb50
nexttoward	895	0x180006ec0
nexttowardf	896	0x180006f50
nexttowardf16	897	0x1800d6560
nexttowardl	898	0x18007c500
pow	899	0x180006fe0
pow2o3	900	0x180007050
pow2o3f	901	0x1800070c0
pow2o3f16	902	0x1800d6c90
pow3o2	903	0x180007130
pow3o2f	904	0x1800071a0
pow3o2f16	905	0x1800d6cb0
pow_bb	906	0x1800da9b0
pow_cc_val	907	0x1800da9c0
pow_ci	908	0x1800daa70
pow_ci_val	909	0x1800daa80
pow_cr_val	910	0x1800dab10
pow_dd	911	0x1800daba0
pow_di_val	912	0x1800da150
pow_dz_val	913	0x1800dabc0
pow_hh	914	0x1800daca0
pow_ii_val	915	0x1800db8f0
pow_rc_val	916	0x1800dad20
pow_ri_val	917	0x1800dadb0
pow_zd_val	918	0x1800dadd0
pow_zi_val	919	0x1800db960
pow_zz_val	920	0x1800db0a0
powf	921	0x180007220
powf16	922	0x1800d68c0
powl	923	0x180007230
powr	924	0x1800072e0
powrf	925	0x180007360
powrf16	926	0x1800d6cd0
remainder	927	0x1800073e0
remainderf	928	0x180007460
remainderf16	929	0x1800d6940
remainderl	930	0x1800815d0
remquo	931	0x180007470
remquof	932	0x180007480
remquof16	933	0x1800d64c0
remquol	934	0x180081e90
rint	935	0x1800074f0
rintf	936	0x180007560
rintf16	937	0x1800d6420
rintl	938	0x180082950
round	939	0x1800075d0
roundf	940	0x180007640
roundf16	941	0x1800d6460
roundl	942	0x180082d10
scalb	943	0x1800076c0
scalbf	944	0x1800076d0
scalbf16	945	0x1800d6c40
scalbl	946	0x180083750
scalbln	947	0x180007750
scalblnf	948	0x180007760
scalblnf16	949	0x1800d62c0
scalblnl	950	0x1800841e0
scalbn	951	0x1800077e0
scalbnf	952	0x1800077f0
scalbnf16	953	0x1800d62a0
scalbnl	954	0x180084a60
signbit	955	0x1800ae9b0
signbitd	956	0x1800ae9b0
signbitf	957	0x1800ae9c0
signbitl	958	0x1800ae9d0
signgam	959	0x18035fe88
signgamq	960	0x1803a0a48
significand	961	0x180007860
significandf	962	0x1800078d0
significandf16	963	0x1800d6ec0
significandl	964	0x180084e70
sin	965	0x180007940
sincos	966	0x1800079c0
sincosd	967	0x180007a40
sincosdf	968	0x180007ac0
sincosdf16	969	0x1800d6b00
sincosdl	970	0x180007ad0
sincosf	971	0x180007b60
sincosf16	972	0x1800d6990
sincosl	973	0x180007b70
sincospi	974	0x180007c00
sincospif	975	0x180007c80
sind	976	0x180007cf0
sindf	977	0x180007d60
sindf16	978	0x1800d6f40
sindl	979	0x180007d70
sinf	980	0x180007e00
sinf16	981	0x1800d60e0
sinh	982	0x180007e70
sinhcosh	983	0x180007ef0
sinhcoshf	984	0x180007f70
sinhcoshf16	985	0x1800d6bb0
sinhcoshl	986	0x180007f80
sinhf	987	0x180008000
sinhf16	988	0x1800d6160
sinhl	989	0x180008010
sinl	990	0x180008040
sinpi	991	0x1800080d0
sinpif	992	0x180008140
sinpif16	993	0x1800d6ff0
sqrt	994	0x180008150
sqrtf	995	0x1800081c0
sqrtf16	996	0x1800d6330
sqrtl	997	0x1800081d0
tan	998	0x180008260
tand	999	0x1800082d0
tandf	1000	0x180008340
tandf16	1001	0x1800d6f60
tandl	1002	0x180091170
tanf	1003	0x1800083b0
tanf16	1004	0x1800d67e0
tanh	1005	0x180008420
tanhf	1006	0x180008490
tanhf16	1007	0x1800d6790
tanhl	1008	0x1800084a0
tanl	1009	0x1800084d0
tanpi	1010	0x180008560
tanpif	1011	0x1800085d0
tanpif16	1012	0x1800d7010
tgamma	1013	0x1800085e0
tgammaf	1014	0x1800085f0
tgammaf16	1015	0x1800d63a0
tgammal	1016	0x1800951c0
trunc	1017	0x180008660
truncf	1018	0x180008670
truncf16	1019	0x1800d64a0
truncl	1020	0x180096940
y0	1021	0x180008680
y0f	1022	0x180008690
y0f16	1023	0x1800d6e60
y0l	1024	0x180097ea0
y1	1025	0x1800086a0
y1f	1026	0x1800086b0
y1f16	1027	0x1800d6e80
y1l	1028	0x180099070
yn	1029	0x1800086c0
ynf	1030	0x1800086d0
ynf16	1031	0x1800d6ea0
ynl	1032	0x18009a700

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	05:33:56
Start date:	27/07/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\libmmd.dll.dll"
Imagebase:	0x7ff7807a0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	05:33:56
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:33:56
Start date:	27/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",#1
Imagebase:	0x7ff6a6950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:33:56
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,_LIB_VERSIONIMF
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:33:56
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",#1
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:33:56
Start date:	27/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5572 -s 328
Imagebase:	0x7ff6bbf10000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:33:56
Start date:	27/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5180 -s 328
Imagebase:	0x7ff6bbf10000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:33:59
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,__acosdq
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:33:59
Start date:	27/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7212 -s 328
Imagebase:	0x7ff6bbf10000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:34:02
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\libmmd.dll.dll,__acoshq
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:34:02
Start date:	27/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7360 -s 320
Imagebase:	0x7ff6bbf10000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",_LIB_VERSIONIMF
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",__acosdq
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",__acoshq
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynl
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynf16
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",ynf
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",yn
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1l
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1f16
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1f
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y1
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0l
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0f16
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0f
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",y0
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncl
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncf16
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",truncf
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",trunc
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:34:05
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammal
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:34:06
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammaf16
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	05:34:06
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgammaf
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:34:06
Start date:	27/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\libmmd.dll.dll",tgamma
Imagebase:	0x7ff633fb0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	50%
Total number of Nodes:	44
Total number of Limit Nodes:	2

Executed Functions

Function 00007FFDFB4B8420 Relevance: 4.7, APIs: 3, Instructions: 169
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FFDFB4B8439
GetProcessHeap.KERNEL32 ref: 00007FFDFB4B8472
HeapAlloc.KERNEL32 ref: 00007FFDFB4B8480

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID: Heap$AllocCreateFileProcess
String ID:
API String ID: 3203875786-0
Opcode ID: 2d9733e9c9f357357592a8d9fb725a563b86b74d139ad321112a9bbe39b3b16f
Instruction ID: 149af692fd1ab315c5f17e023e2b7c5f9bbc79d92c1502df8cc7a40b21c95c7f
Opcode Fuzzy Hash: 2d9733e9c9f357357592a8d9fb725a563b86b74d139ad321112a9bbe39b3b16f
Instruction Fuzzy Hash: 8971A332B1A78286EB10CF29A460AA9B765FFC5B84F449235DE5D077A9DF3CE041CB04

Function 00007FFDFB4B830E Relevance: 3.1, APIs: 2, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FFDFB4B8348
RtlAllocateHeap.NTDLL ref: 00007FFDFB4B8356

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: a862e8544bebae12cc5a9c17f0a728a48d4b76f78a33045e262ab66a77b43016
Instruction ID: dbee6fe987733851ef95727ff6429aec345b2463b084fc8d401bf6a73f4028ae
Opcode Fuzzy Hash: a862e8544bebae12cc5a9c17f0a728a48d4b76f78a33045e262ab66a77b43016
Instruction Fuzzy Hash: C331D126B0AA9286D7249F15D460ABD77A1FB88B44F049134CA5E573FCEF7E94418B00

Non-executed Functions

Function 00007FFDFB624670 Relevance: 5.1, Strings: 4, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Genu, xrefs: 00007FFDFB6246D2
, xrefs: 00007FFDFB624826
ntel, xrefs: 00007FFDFB6246F9
ineI, xrefs: 00007FFDFB6246E0

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID: $Genu$ineI$ntel
API String ID: 0-3800267741
Opcode ID: 99e989276af72c8e815189a1b2a21291dc0bc2fe3b05ec1a40957390aae53259
Instruction ID: d3890417255b1ff5cdc9024a1700d07e59eceaa120525a1d6ac0cbb96ceb12ea
Opcode Fuzzy Hash: 99e989276af72c8e815189a1b2a21291dc0bc2fe3b05ec1a40957390aae53259
Instruction Fuzzy Hash: DD5168B1B1D7428AFB648B19E060B26B6D1EBC5355F108139EE9D86BD8DB3DD8418F00

Function 00007FFDFB4B4630 Relevance: 4.0, Instructions: 3998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d763e1d6cc68028e6b2d2eea794fda0841ceffb1f6cd5f323a665f52420f494
Instruction ID: 7a9968d3bda245cafaaf3eee1a96e6da21ca1ef04d44c8e0c645af621bb75408
Opcode Fuzzy Hash: 1d763e1d6cc68028e6b2d2eea794fda0841ceffb1f6cd5f323a665f52420f494
Instruction Fuzzy Hash: F4B3B337928F8489C353CE34A45253BA779EFDB2E5F116306FA8B55D2ACF68D142DA00

Function 00007FFDFB4F4690 Relevance: 3.9, Instructions: 3854
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112e599dd39b663bb0fdac5e8b54a5a16eb251792ea24bf8d5de669bb097fe55
Instruction ID: 379f42c4726677559288a0091802e106c243e3abea47e4c46a04918614d6a05d
Opcode Fuzzy Hash: 112e599dd39b663bb0fdac5e8b54a5a16eb251792ea24bf8d5de669bb097fe55
Instruction Fuzzy Hash: 40A3B737968F8489D353CE34A45253BAB39EFDB2D5F116306FA8A55D2ACF28D043DA40

Function 00007FFDFB4D5FE0 Relevance: 2.2, Instructions: 2235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 748225a74ff30e70aa2d2e1619d8541cf7faeffc297aca5ffb1a756eb108b6fe
Instruction ID: 0e64807efa7ebdc928b9cf136ba89cb937998802d3966722f9b30a959f01a4bd
Opcode Fuzzy Hash: 748225a74ff30e70aa2d2e1619d8541cf7faeffc297aca5ffb1a756eb108b6fe
Instruction Fuzzy Hash: 2F235993F1D1D251E3732260E1753DEAF60E786B84F600A56D2D9A19EEF91FC9208EC4

Function 00007FFDFB4C7DA0 Relevance: 1.7, Strings: 1, Instructions: 413
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#, xrefs: 00007FFDFB4C827F

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 03e692accf221de9e8b636625370183c9590b304654c90d0b67131d2e5f4bfe1
Instruction ID: 5033ae7ddfab7105a7c15318a985f8ff0e9dc28dcd7320e43b12e914c55bad97
Opcode Fuzzy Hash: 03e692accf221de9e8b636625370183c9590b304654c90d0b67131d2e5f4bfe1
Instruction Fuzzy Hash: A5F11562E3AA4349E7738635C96473A63559FA6758F34C336F42A759FCEF2CE0824500

Function 00007FFDFB4D0EC0 Relevance: 1.6, Strings: 1, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=, xrefs: 00007FFDFB4D8A64

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 9ddc42a44bcf7dc5fdc33450e44dadd9ebcb590b44dbfef38383ecb755c2cc5f
Instruction ID: 08022701622d7efea6619003ce807402150b67c614f1b40e6f56fbc5184068c2
Opcode Fuzzy Hash: 9ddc42a44bcf7dc5fdc33450e44dadd9ebcb590b44dbfef38383ecb755c2cc5f
Instruction Fuzzy Hash: 75F18622E3AF424ED35387349461636B718AFA72C4F11D323F967B5EA9DB29E5434500

Function 00007FFDFB4DC250 Relevance: 1.6, Strings: 1, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 00007FFDFB4DC7BA

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: e879e8d9a7ca7b9909caaecc9338ec2390779ea5072203849cc28d77a3e5c8b1
Instruction ID: 204a0de7e95340599c4ccfaf6d31e8042ceaf0b9d29821c39acc41acd802223b
Opcode Fuzzy Hash: e879e8d9a7ca7b9909caaecc9338ec2390779ea5072203849cc28d77a3e5c8b1
Instruction Fuzzy Hash: E6D1A251E2EF4388E7638638887167652199F772D5E15D337E92B78DFAEF2CA1834200

Function 00007FFDFB4DE590 Relevance: 1.5, Strings: 1, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&, xrefs: 00007FFDFB4DEA91

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: e3384bcdf49d8c4ae8428da9b7b44a41eb43070f33d4b6f7af649716f65371c6
Instruction ID: 2df540534fd66682ca668f13568a5549511313acbf2f2d303b8e675efaf91f3b
Opcode Fuzzy Hash: e3384bcdf49d8c4ae8428da9b7b44a41eb43070f33d4b6f7af649716f65371c6
Instruction Fuzzy Hash: 57C1DA21E7AA0B89EB53823755617396252AFAE384F39C737F829395FDEB2C70C15500

Function 00007FFDFB4D0EB0 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:, xrefs: 00007FFDFB4D13A3

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 95378f8e9efeab19656c0c74fe394c3cdf134ef61569ba899f9c836e0b92d12d
Instruction ID: 3fe8fc126e7cb7b991d1893334cb7a936ebfe33c5561875ae132173013e94e68
Opcode Fuzzy Hash: 95378f8e9efeab19656c0c74fe394c3cdf134ef61569ba899f9c836e0b92d12d
Instruction Fuzzy Hash: D6C16F21E2AF434CE72386399871636A71C6FBB2D5E51D327FC2B74DB5EB19A1938100

Function 00007FFDFB4B6100 Relevance: 1.5, Strings: 1, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nA, xrefs: 00007FFDFB509C0C

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID: nA
API String ID: 0-1316725957
Opcode ID: 9acc2828e5ef9c8e9c0a36c9a83603fa8eae80337e3397a18f3421c7b2ae394e
Instruction ID: 02eedd61829d0dc982be5ffffa83a19c007952778531c5bb06ff678c1b3e5d06
Opcode Fuzzy Hash: 9acc2828e5ef9c8e9c0a36c9a83603fa8eae80337e3397a18f3421c7b2ae394e
Instruction Fuzzy Hash: A2D1D322E2AF5788E367873594B16356718AF662D4F46C333F86F35AB9DF1CA0938500

Function 00007FFDFB4B58B0 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

?, xrefs: 00007FFDFB55DB7D

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 743fb0690d21a2bfc34ec116a226c37de37c7f63cd3c71f2e1b9eb7cd6fc9382
Instruction ID: e709c79a99c56f0d76bd46a2c1ca860e5e51c813bcf866b84eb4809b4828c327
Opcode Fuzzy Hash: 743fb0690d21a2bfc34ec116a226c37de37c7f63cd3c71f2e1b9eb7cd6fc9382
Instruction Fuzzy Hash: AC319BB3F3D45243A33E4B19A810D256B90A7E9B95B456139EE0F0BBD6CD2CDB51CB80

Function 00007FFDFB4B6110 Relevance: 1.3, Instructions: 1330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a043db48796c865c5c97e7ae7ee9018aab35bded4def970419be971f03d26b4
Instruction ID: 29fe28a482c546313b2ba49ff47723182d88f33d4e6aaed3e8431de7c0b820b0
Opcode Fuzzy Hash: 2a043db48796c865c5c97e7ae7ee9018aab35bded4def970419be971f03d26b4
Instruction Fuzzy Hash: 5592BAA3F1F18275C36732A0D4616C96B60DB81ED0F302E5A85D6A15BFFD1B8E944EC8

Function 00007FFDFB4B37A0 Relevance: 1.3, Instructions: 1263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4beefde7efc2d7f3965ed56e14acd43a5fbfea44d7cd9701e681e08f5bb9f6d
Instruction ID: e6e78a0118664ade83a9aa7a2412210991aeefbebce51ccc16485401e896dfb0
Opcode Fuzzy Hash: e4beefde7efc2d7f3965ed56e14acd43a5fbfea44d7cd9701e681e08f5bb9f6d
Instruction Fuzzy Hash: D3B29E22F2AF4249EB6386359471A7663189FA63D4F11D333F96B75AF9DF1CA0834240

Function 00007FFDFB52F6B0 Relevance: 1.2, Instructions: 1159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eddbf0e1ebc1580ef838b8e4223f7cba4513b7c02958abe12947a35bb69c871
Instruction ID: 793cef4082eca6590e048c49e8dade1157d8c6d3c92c5bb2d4f904ea74548c66
Opcode Fuzzy Hash: 5eddbf0e1ebc1580ef838b8e4223f7cba4513b7c02958abe12947a35bb69c871
Instruction Fuzzy Hash: B8B2B1B3F0D28251E3776610E4217E97B60E745780F640925C9DAA2BFEFE2ED9548EC0

Function 00007FFDFB505000 Relevance: .8, Instructions: 850COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e03afbd49d72632794f0edc178e3f03295cf3ec5192f66c5ad4a46814b30f8
Instruction ID: 244d108211dd6abc21296f61675a9849c9f87d94268eea1d10863a9039696d9a
Opcode Fuzzy Hash: 34e03afbd49d72632794f0edc178e3f03295cf3ec5192f66c5ad4a46814b30f8
Instruction Fuzzy Hash: 1E623A23B1D29747F7764A25B0A0B7E7A91EB80784F185135DAEA42BEDDE3CD844CB40

Function 00007FFDFB4FD030 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0035069d5cdad763482af1719770d8d5a5f38f6f3d213e4864f05c2f09ba960
Instruction ID: 4f2c1ef3d937926b21fcc8b48d00f5fa54170c1a26727ef0d27e52ca960af25f
Opcode Fuzzy Hash: a0035069d5cdad763482af1719770d8d5a5f38f6f3d213e4864f05c2f09ba960
Instruction Fuzzy Hash: 1F727EA3F1D58122D3677660E1222D96FA0DB45FE0F310E2995DAF16BEFD1B99108EC0

Function 00007FFDFB4C0510 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf26b8575944bc68815bd5694531a0e5cedbb8e91ff889c0f4c43c88fb3258c
Instruction ID: 67248c79f061196bffb3e1dc3d6e08c1b4b0dc4636b1455b75029ab8cc368ddd
Opcode Fuzzy Hash: 7cf26b8575944bc68815bd5694531a0e5cedbb8e91ff889c0f4c43c88fb3258c
Instruction Fuzzy Hash: 34225AA2F2945703F7294D2A6A60F3945436BD4BE8F15A335ED3B67BE8CE389D409240

Function 00007FFDFB4D0210 Relevance: .7, Instructions: 672COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b545ce14306a7837f043426c29aa0961ab947da752e1f84d63174a7b6074801c
Instruction ID: 77be88aabead9556088d2e8bea9a77bb1b90165248d7b2c61ace5f0cc39a30bc
Opcode Fuzzy Hash: b545ce14306a7837f043426c29aa0961ab947da752e1f84d63174a7b6074801c
Instruction Fuzzy Hash: A052E822F29F864DE31387354472A75A25CAF7B2D8F119323F85BB5EB6DB2871938500

Function 00007FFDFB502FD0 Relevance: .7, Instructions: 672COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f434fc715291ac6ca2c1ab8d0cd603f5bcdd5efe22f77c8a5364d77da906c378
Instruction ID: 8bc50bb12f9c5267ba301798032c21585e6746e5650a86dc1af0052b40d97cb9
Opcode Fuzzy Hash: f434fc715291ac6ca2c1ab8d0cd603f5bcdd5efe22f77c8a5364d77da906c378
Instruction Fuzzy Hash: 86226862F2949703F73A092669A1F3909426BD87E4F19A334ED7B67BEDCD3C9D058240

Function 00007FFDFB4C71B0 Relevance: .7, Instructions: 661COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d109e12a5d331f059daeead56b3120fcb95c3d3d0e94ce7fb874789e8f84c0a9
Instruction ID: a5a1283799e2cd2c5c93c04f18436b5f9502a9a8075cee79f32c6e0733c39eeb
Opcode Fuzzy Hash: d109e12a5d331f059daeead56b3120fcb95c3d3d0e94ce7fb874789e8f84c0a9
Instruction Fuzzy Hash: 0B52D162E2EE434AE7634634D9317356258AFA27C8F10D333E93AB59FDDF2DA5824104

Function 00007FFDFB4B4A50 Relevance: .7, Instructions: 661COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57089aa6be1e030319cc4d0506c54f800e2e95f96a8b3cf7dad2ae92eb010878
Instruction ID: d92e8b69b1dcc0cc81fdc2cd1d25ea032835cee09bc959799991fc4e056c9cc7
Opcode Fuzzy Hash: 57089aa6be1e030319cc4d0506c54f800e2e95f96a8b3cf7dad2ae92eb010878
Instruction Fuzzy Hash: 83527B32E2BF414AC753D639946237A7319AFA73C5F25C323F92775E99DB28A0864201

Function 00007FFDFB503A10 Relevance: .6, Instructions: 634COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02227af2f0308b7971d1a023db06ddb54e8a66628a1bd1f7aa9cad1ee3ea5175
Instruction ID: feee88772bf2b1855e52d1b5470773e689a6a302b371742988c63ffd0f9e5341
Opcode Fuzzy Hash: 02227af2f0308b7971d1a023db06ddb54e8a66628a1bd1f7aa9cad1ee3ea5175
Instruction Fuzzy Hash: 9D12EE13F1AA4703EB158625A931BB55351AF957D4F086332EE7E27BEDEE3CA542C200

Function 00007FFDFB58CE40 Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531a386d7fd723af18119abf23d936c93c208b87aedd856c9f97d8368f96c472
Instruction ID: d2e1b1d8c5aa959d81257b527febb349dd585a1add0042e080b5132f5efb081e
Opcode Fuzzy Hash: 531a386d7fd723af18119abf23d936c93c208b87aedd856c9f97d8368f96c472
Instruction Fuzzy Hash: 4F422861B19B8741E7128B369421BBAA360AF85BC4F548336ED5D277FADF3CE1858700

Function 00007FFDFB512E70 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f136b34965850c78c2b95e23a32ca7de31aab7a1612d080d7828331d4c5667b
Instruction ID: d78caded44fe1ad763e74b3cc32cd3edc033c96233a43ec14f3e334de8a6004c
Opcode Fuzzy Hash: 4f136b34965850c78c2b95e23a32ca7de31aab7a1612d080d7828331d4c5667b
Instruction Fuzzy Hash: 4732E622F2AF824DD77356358832B75AA4C5F772D4E11E327FD2A74EB5DB29A1438200

Function 00007FFDFB4B4AC0 Relevance: .6, Instructions: 561COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9103adab70f63dfd990f547049117c0fde09d2e1da92cc759475ab9d9240b5b
Instruction ID: 07b20bd91bc67f840b8270db41cc23a8b051a558d54f89b236cbf7767c6d5d5a
Opcode Fuzzy Hash: d9103adab70f63dfd990f547049117c0fde09d2e1da92cc759475ab9d9240b5b
Instruction Fuzzy Hash: 45328D61F2AF9349E7638B359971B3553189F623D8F119332E92B75AF8DF1DA1838200

Function 00007FFDFB537B30 Relevance: .6, Instructions: 559COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568fb40d477010ecf80d15a36c37236d0d1c0e3022d4a567b73bfa1d17d924bf
Instruction ID: a39a93d255a6722ace43b35e1b50f2fc82962efef878a5aab16669050b026a4b
Opcode Fuzzy Hash: 568fb40d477010ecf80d15a36c37236d0d1c0e3022d4a567b73bfa1d17d924bf
Instruction Fuzzy Hash: D432D0A3F1918262D3673660E5326D82FA0D741BD0F351E25C5DAA1AFEFD1F99208EC0

Function 00007FFDFB4B6120 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2adcb422eb515f46c5c65a91c34b6b75fbd11b8ff7c49a16e0a76c941e45df7
Instruction ID: 36e9e83b22f6dd4e93ddd27aa33e9ef5f9b566f2621d41f5cb0ff3572cfbacbc
Opcode Fuzzy Hash: e2adcb422eb515f46c5c65a91c34b6b75fbd11b8ff7c49a16e0a76c941e45df7
Instruction Fuzzy Hash: D7322B22F29F874DD223963544B2A7AE358AF7B2C4F05D323F95B759BADF2861834500

Function 00007FFDFB4CF7E0 Relevance: .5, Instructions: 542COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc186652fcc5e2968f2f3d569a2d9b2078f7f6791e99010ebf7f781e971e3a3
Instruction ID: 1f56dbcd33735f067e491d15d7768e40534b9fdacda9ac0c60fb0abafaff8b22
Opcode Fuzzy Hash: 1dc186652fcc5e2968f2f3d569a2d9b2078f7f6791e99010ebf7f781e971e3a3
Instruction Fuzzy Hash: E822C2E3F1E18261D7673260D1212EE6F60DB42FD4F311A66D5DAA18FEF91B89244EC0

Function 00007FFDFB4B5300 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e2c164904810641a6217d8f01738aaedd99cf360816c393a14b5275449fe54
Instruction ID: d09b9c32d3bb6cdee09044b9cad0ca5d4df991b9dacb85992f2d2b796c0aa0cf
Opcode Fuzzy Hash: c5e2c164904810641a6217d8f01738aaedd99cf360816c393a14b5275449fe54
Instruction Fuzzy Hash: D732AF22F35F814CD26386399472636A65CAF7B3E9F12E317F85BB5E72DB2591438200

Function 00007FFDFB527080 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8feebcd0468933b4e735094c0ee9f3a7539eb6cb4bf6d58c7269196d0bc830
Instruction ID: c7abd6903a5f2643b58bfb42aa1240d3ef712bfc3672a00b0931a559ca6b3d20
Opcode Fuzzy Hash: bc8feebcd0468933b4e735094c0ee9f3a7539eb6cb4bf6d58c7269196d0bc830
Instruction Fuzzy Hash: DA22A4A3F1E14252E3576B10E0315AD6BB0EB81B90F240935E5DA956FEFD6EE9108FC0

Function 00007FFDFB4CC330 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6995a572ff6863a5858f7d2ac9b4dc2792e7b27e04898c0394a1d71f3a50bc67
Instruction ID: 21aa89b1d3cd3170aa1a1927576ffb5f25de935b97ae7cc042a199ba3fe09b61
Opcode Fuzzy Hash: 6995a572ff6863a5858f7d2ac9b4dc2792e7b27e04898c0394a1d71f3a50bc67
Instruction Fuzzy Hash: 32023A22F25F520EE667477998317747718AFB67D4F01D333ED1A36EA6EB18A5838200

Function 00007FFDFB4B3C30 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2577988af3a84551343cd549d5035ec4360bbbe02a22ad4b2c82684c9c97b776
Instruction ID: 0f624c94b22f1883bdbe8630af97391cfcbbb7657adfe35273ebd21e6e159b66
Opcode Fuzzy Hash: 2577988af3a84551343cd549d5035ec4360bbbe02a22ad4b2c82684c9c97b776
Instruction Fuzzy Hash: 14129322F39F824CE62386349872B756658AF7B3D4E02D337F92A75EF6DB18A1534500

Function 00007FFDFB53A120 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73f1a5723eba6ac0c21b7060a8898b0c5ea611e9fb68df99a34137de746baf4
Instruction ID: 418c3da7dbbdb5ef6c0f5b251cb58080441eebb8fcd509454523f215ace677ee
Opcode Fuzzy Hash: e73f1a5723eba6ac0c21b7060a8898b0c5ea611e9fb68df99a34137de746baf4
Instruction Fuzzy Hash: 3802B1E3F1914262D36B3660E5326982B60D751BE0F311E29D1DBA0AFEFD1B5E644EC0

Function 00007FFDFB4CCB50 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f95bb06ad17f6fbc9d6fb12189477d09ada8809d27d140a8cff21ab0359a99
Instruction ID: f942a2b796cd3230fc6f859b70d8b4c7ac1f3fb639090c7b5af01f13c52d49c8
Opcode Fuzzy Hash: f6f95bb06ad17f6fbc9d6fb12189477d09ada8809d27d140a8cff21ab0359a99
Instruction Fuzzy Hash: 43F1E362F2AF4249EA138A355831776A6585FA67E4F02D337FD2B39BF9DF18A0434100

Function 00007FFDFB4F0F10 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a5af94fba73b2c3da74daeec69d136b71ccb865ed0cf87a5ece6130064f339
Instruction ID: 6fbe8bf2cc3660d6629237516a5b5e2f12e2530354edef01c1e26195c07b66df
Opcode Fuzzy Hash: d7a5af94fba73b2c3da74daeec69d136b71ccb865ed0cf87a5ece6130064f339
Instruction Fuzzy Hash: E3F10251F2AF8249EA1386754831776A6485FA63E4F02D333FD3B3ABF9DB19A1434500

Function 00007FFDFB4BDD10 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1451519dd1cb4e8900d9d3fb617e2ca457fa69c8af9f5cb6f06dbd60fd13faf7
Instruction ID: 8dcd9404f1eb44d41138b6453cc92844c0344eaa7b9dce2fab7b11490c1c07e5
Opcode Fuzzy Hash: 1451519dd1cb4e8900d9d3fb617e2ca457fa69c8af9f5cb6f06dbd60fd13faf7
Instruction Fuzzy Hash: 3AF1F251F2AF8249DA2786354831776A6589FA63E4F02D733FE3B39BF9DB18A1434500

Function 00007FFDFB4D8E80 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e3ed8e573c22511840b7b4c24d09eaf59bbbf2eeca7b7a047e1bc95bdf5d18
Instruction ID: 3bc0e17eeff016c6106956b251f0674a6aa32467371afe4255eef64d591cc5c4
Opcode Fuzzy Hash: 38e3ed8e573c22511840b7b4c24d09eaf59bbbf2eeca7b7a047e1bc95bdf5d18
Instruction Fuzzy Hash: 4D12B632E3AF524ED7538738D462536B719AFA62C4F11D323F926F5EA9DB2CE4424500

Function 00007FFDFB54C390 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4be3cf216bbf5b2378732003119712f6435b93bcb3df6a96d0e34a0a639539
Instruction ID: 17269c004ba6b742286c843a1099623de890c28334c0278e1cd2c0ccbd6d9feb
Opcode Fuzzy Hash: 5b4be3cf216bbf5b2378732003119712f6435b93bcb3df6a96d0e34a0a639539
Instruction Fuzzy Hash: DB12C0A2B0D5C691E7335721E0747EEBF60EBC6740F104226D3E9519EEEA2ED561CB40

Function 00007FFDFB553B40 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 119ed3c22b8776ada4ceac7a7a68ecbd36920fb59c71c00117d07a5757708e07
Instruction ID: f52f798833d53110105dd155548e4be8f4252b327ceae74b58d23c842a628437
Opcode Fuzzy Hash: 119ed3c22b8776ada4ceac7a7a68ecbd36920fb59c71c00117d07a5757708e07
Instruction Fuzzy Hash: A702FC22E29F8649D3238931843177A9658AFA73D5F10D323FA6B35AB9DF2DE0934500

Function 00007FFDFB54B120 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef230f12ef51237a39ab5b70f93dd048508814634f467387aa8505feba75214
Instruction ID: 80a0663ff3c8710782e3f1dc803dac62165f300b1fb4d8b378e5d3b25d6030dc
Opcode Fuzzy Hash: fef230f12ef51237a39ab5b70f93dd048508814634f467387aa8505feba75214
Instruction Fuzzy Hash: 0B12B172F0D5C791E7375620D1707AEBB60EB86780F204632D2EA51AFEFE2DD5618A40

Function 00007FFDFB54A960 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3505da8eafc6020f2da5b32b8363c48397a0ef74a506660be05b09585ddeb045
Instruction ID: fe0977256cfb0b619c502941a8f5f680c356b89e2357e7c82433012fe5d86a60
Opcode Fuzzy Hash: 3505da8eafc6020f2da5b32b8363c48397a0ef74a506660be05b09585ddeb045
Instruction Fuzzy Hash: AF12B262F0D5C794E7735620D1707EE6B60EB82784F204622D2EA51AFEFE2DD5618F80

Function 00007FFDFB4EC930 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016004c5287d06109edddff589a8d18ee8bc4b7b6ee8c74416aba534709c3a2d
Instruction ID: 7b352a0ac1b6bee5001d4acf852b03d5723c1b26941cfdb4dee39185a944f8ce
Opcode Fuzzy Hash: 016004c5287d06109edddff589a8d18ee8bc4b7b6ee8c74416aba534709c3a2d
Instruction Fuzzy Hash: DBE12A22F25F560EE3278B795861B7156099FB77D0F11D333EC1A7AEA5EF1895438100

Function 00007FFDFB4ECFD0 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc15b28ec454bb62a3b466608b824145a15bd3e696c7c4da085c39179dac877a
Instruction ID: 85e426c3422ee365e4a2286ba2d29fab31ccc95756fd01083bf5a3656fe6954b
Opcode Fuzzy Hash: dc15b28ec454bb62a3b466608b824145a15bd3e696c7c4da085c39179dac877a
Instruction Fuzzy Hash: DEE14922F25F560AE72747795831B7097189FAA7D4F12D333ED1A37BA5EF28A5438200

Function 00007FFDFB4C9300 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8319b5f39006afc96b84a25af54b9b438759a3ab066925ab3a5de209946ee1
Instruction ID: 1ede35ae2d79179774ecb09b96b3515191de8a89186a84274eeaec6276ee422d
Opcode Fuzzy Hash: 2b8319b5f39006afc96b84a25af54b9b438759a3ab066925ab3a5de209946ee1
Instruction Fuzzy Hash: 67E18C22F25F560AE72746799C31B7057185FB67C4E42D333ED1A76FA5EB2CA5838100

Function 00007FFDFB54BAA0 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a168931a7aad363172cd2c46a20c4e0c42c11e0cb211525911ee86a20a6ee5dc
Instruction ID: 8a61ee5d994faf06128860fd59d32fc84f432829b3fedae39d41c66e8e278e64
Opcode Fuzzy Hash: a168931a7aad363172cd2c46a20c4e0c42c11e0cb211525911ee86a20a6ee5dc
Instruction Fuzzy Hash: 3802B262F0D5C384E7335634D1707BEAB60EB92784F204732D6EA51AFEEE2DD5618A40

Function 00007FFDFB4BC4C0 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04da69dae6d7f630540a50a2f9a63f1955bf6143a1993f515167344a61911ee0
Instruction ID: 1ad6bcfd38371b4112abde8873438c075149fd350c3289e3e6f9475c07f3dd50
Opcode Fuzzy Hash: 04da69dae6d7f630540a50a2f9a63f1955bf6143a1993f515167344a61911ee0
Instruction Fuzzy Hash: E5E14A22F25F564EE2278A799871B7196189FB67D0F02D333FD1E36EA9DF1895838100

Function 00007FFDFB4ED670 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2076748fbdee3fc284958df1566b974dc2e57fe5e3e7f0d49fd8c6dcbca135e4
Instruction ID: 7d43c6f6bf0ec3bdcf0b5e8c81ec80e6b839d88a3ce36ffd6064a251cf7bb987
Opcode Fuzzy Hash: 2076748fbdee3fc284958df1566b974dc2e57fe5e3e7f0d49fd8c6dcbca135e4
Instruction Fuzzy Hash: BCE12A22F25F560AE7274B759831B7057189FBA3D0F12D333ED1A37BA9EB18A5838140

Function 00007FFDFB4F16B0 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f22af1649f37f95e399366aaaa56e389e619e8db4ba4bef596225a4e077836e
Instruction ID: 1d1530c11f8be5ce74943e97d96f572924317d7e4a8589209aef778004722917
Opcode Fuzzy Hash: 7f22af1649f37f95e399366aaaa56e389e619e8db4ba4bef596225a4e077836e
Instruction Fuzzy Hash: 2E02A932E3AF9249D76347359471A35B768AF913D4F11E322F96A759F8EB2CE0434A00

Function 00007FFDFB4EEC00 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c28c778f20b16573a6effc39255455dfce495ccef60adc517b533b75d05e3ffc
Instruction ID: 220149552b6569bec5e749fd92365069a2f95104fda81aff69a9fbe751352c1c
Opcode Fuzzy Hash: c28c778f20b16573a6effc39255455dfce495ccef60adc517b533b75d05e3ffc
Instruction Fuzzy Hash: D8E1A3A3F1914262D3673760E532A986F60D751BD0F311E29D1DAA0AFEFD1B5E248EC0

Function 00007FFDFB531890 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e3302047f4cb07a1d6341551cbdd1f793d9469e338f746e2e117340ec56923
Instruction ID: c08538f835a034a72f8d5ddb028c5a44170a5e34bf70591184d9c03efc5f807b
Opcode Fuzzy Hash: 46e3302047f4cb07a1d6341551cbdd1f793d9469e338f746e2e117340ec56923
Instruction Fuzzy Hash: E0D11922F1E99741EF234A359420B769692AF567D0F189B31EE6D13BEDDF3CD4828600

Function 00007FFDFB4BA620 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9cb1ea5cd67f6e2cf96ee1403afd4eb7e9d41ae3d214b56c6e55219ad245be9
Instruction ID: 7319d059c71b41f35ca7638766f4f325ed62aeb84fe62ed7027b9bdfecf0b603
Opcode Fuzzy Hash: a9cb1ea5cd67f6e2cf96ee1403afd4eb7e9d41ae3d214b56c6e55219ad245be9
Instruction Fuzzy Hash: 39E1D012F2AF9249EA2386348931775665C6F6B3D8E01D323EE6E75EB5DF28A1434500

Function 00007FFDFB504510 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4c7f118c4af21d9100798fb35c87f7879fbe4955e37dcdf8b022f66d04bee3
Instruction ID: 28d0ded8ab9dc42beac3b56edde54d42b1851e5ffbf1dff519d7e4450d160750
Opcode Fuzzy Hash: 8a4c7f118c4af21d9100798fb35c87f7879fbe4955e37dcdf8b022f66d04bee3
Instruction Fuzzy Hash: 83C17822F2D44303F76B49284820A3821A26FD17E1F295334EDBB5B7EEDE3C9D459640

Function 00007FFDFB592510 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac7e9c1f6a01932d5966602faf0866dce1a467f159da0a7ae7a8c536feb3030
Instruction ID: 7493aa85509b1b72e6eb5eba48655c9cbb104b34b53db7ef13dab47e2f89dbc8
Opcode Fuzzy Hash: 8ac7e9c1f6a01932d5966602faf0866dce1a467f159da0a7ae7a8c536feb3030
Instruction Fuzzy Hash: 23C1AF62B4576547EB24CF11B851B99A765F78D7C8F08A035EE8D47BA9CE3CD841C700

Function 00007FFDFB4CA450 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26a855b300e4ad5e3c3472d79acb444b9a0f40ca346f8039a3b7e0abd541398
Instruction ID: ce0a6bc0d19f4df144ceeea4adb31886048ab52c978ed3b6cb9281eea210e1f7
Opcode Fuzzy Hash: c26a855b300e4ad5e3c3472d79acb444b9a0f40ca346f8039a3b7e0abd541398
Instruction Fuzzy Hash: E2D1F612F2AF8249EB17873459727766258AF663E4F02D332ED6B36AF9DF18A5434100

Function 00007FFDFB4C0F60 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c35888e2e6e3a0c99eb31175262ccb21e5c3019fd412ac34f66c63fc28f7f0
Instruction ID: fcd7b5bb3cf28d113c78d2cde2c712006b5dfba9fa06e4883b8e776a7c4be969
Opcode Fuzzy Hash: d5c35888e2e6e3a0c99eb31175262ccb21e5c3019fd412ac34f66c63fc28f7f0
Instruction Fuzzy Hash: 3EB1DCA3F2984343F76A09295920F3811825FD1BA9F656335ED3B97BF4CD3D9C059A40

Function 00007FFDFB4D1760 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4c2165f926c7f95825eb64fc32db0cc582075c1f2306dfc8bd96fc9e0b818d
Instruction ID: 78ae45e144743821e1e52216fd9a4464f426a1c9ce39e17837080b833bd60dae
Opcode Fuzzy Hash: 6c4c2165f926c7f95825eb64fc32db0cc582075c1f2306dfc8bd96fc9e0b818d
Instruction Fuzzy Hash: E5D1A221E3AF524CEB2396395871636B71C6FBB2D5E51C327FC2A34EA5DB5AA1834100

Function 00007FFDFB506360 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c721c534180ab0a027f40f5909b6b421fb10a9e493fbd9df6b9d091e9e86eb
Instruction ID: 0ee99f8caaabc468aad30538ed3b66b34a0a3ae0ed89ec8eb8f0079f7cb4303f
Opcode Fuzzy Hash: 07c721c534180ab0a027f40f5909b6b421fb10a9e493fbd9df6b9d091e9e86eb
Instruction Fuzzy Hash: 04D1D522E2EE4386EB5396349471736A7649F673C4F158333F96A35BEEDB1DA1824200

Function 00007FFDFB54CCB0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef14dd4d6d9ff842d9815e6f7aa3e3943646684d0ca02773cf9ff5dcbf94bd40
Instruction ID: 8d52b7da231fe97f9dff582ae6df61b5a7b94901a4158f514b9ac2556b12418c
Opcode Fuzzy Hash: ef14dd4d6d9ff842d9815e6f7aa3e3943646684d0ca02773cf9ff5dcbf94bd40
Instruction Fuzzy Hash: DFD1D032F19F8786E7278E35D530676A354EF96380F109333EA5915AF9DF2DD4928A00

Function 00007FFDFB51E980 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 551e96eaac94b4593811af65f1abae5d1cd731806e3a8cadf9ea6fde07c46e2f
Instruction ID: 23209bc1574b54df570d12138a19d66680ce905dcbb03288d73d0133f3e12f4b
Opcode Fuzzy Hash: 551e96eaac94b4593811af65f1abae5d1cd731806e3a8cadf9ea6fde07c46e2f
Instruction Fuzzy Hash: 63B1E421F7AF920DD67386769830675AA4C5FB73D5A02E717FD2A78DF0E70AA1834600

Function 00007FFDFB51F3D0 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4460ea51bc18654a188e415c05c3822887f64006a440744ad6666ae51ba699
Instruction ID: a6773aba4af09eb7ae252612f700c7b8e1bcfd805b6ca7ed6cdb36929d059221
Opcode Fuzzy Hash: 3b4460ea51bc18654a188e415c05c3822887f64006a440744ad6666ae51ba699
Instruction Fuzzy Hash: 79B10921F39F920DD67396769830674AA0C6FB73D5A02E317FC2A38DF1E70A90834600

Function 00007FFDFB51EEB0 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a84864bb31aa7b5e32277f2ef3c194d3bbf43db8e3c6bb0cfeda7af1dc96eaaf
Instruction ID: 877916f1a381cfc88d992e7e63d95435371307c6bf4a563963ff9250d43f949f
Opcode Fuzzy Hash: a84864bb31aa7b5e32277f2ef3c194d3bbf43db8e3c6bb0cfeda7af1dc96eaaf
Instruction Fuzzy Hash: 7BB1E721E79F920DD67386769831675AA4C5FB73D5A02E317FC2B78DF1EB0AA1834600

Function 00007FFDFB504AE0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ff74b7997be9a7a7cef4a9b9172511e6bdbe0c09c7c16122f689449d9c93f1
Instruction ID: 583f730f6a9c5f8bb9d5002748a90a6d38e1e5ae4f269d8ba6d299095e1b3220
Opcode Fuzzy Hash: 49ff74b7997be9a7a7cef4a9b9172511e6bdbe0c09c7c16122f689449d9c93f1
Instruction Fuzzy Hash: A6A18681F36AC702EB2643795831FB44561AF623F5E18D331EE7A7ABEDEB1C56819100

Function 00007FFDFB5526B0 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def1668d0114a901585b01d5db24e79118c5730304809109b504a4b2e9483552
Instruction ID: 840d927d2741a2a6442e1a0e12f39003427f53db0fecbc6988d9ca263d675eee
Opcode Fuzzy Hash: def1668d0114a901585b01d5db24e79118c5730304809109b504a4b2e9483552
Instruction Fuzzy Hash: 46C1ED32E19F8646D3179E35D42067AE364EF96384F10D332EB59256F9DF2DE4928B00

Function 00007FFDFB4EE1C0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 035933fdac6a1f909daa1c00fd50f81463c8af8a6fd834abc983d0cde452a79c
Instruction ID: 0dcfc941d84f4e94ebc131f1334680239a82e0aeb44ada48c182cf751690e89b
Opcode Fuzzy Hash: 035933fdac6a1f909daa1c00fd50f81463c8af8a6fd834abc983d0cde452a79c
Instruction Fuzzy Hash: CCC1D532E29F1249E3778B34A8616357754EF653D4F519333E92AB1DB8EF2DE1428600

Function 00007FFDFB4B4640 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1d0b3a6cb5cb37c007f34f7ce4f27706d180f4d8cf2a2e339f342492bf67e9
Instruction ID: 94692f011829f8eeced1845ab8339ba8ea62e94211daccf5d4a49af1d8b1e09b
Opcode Fuzzy Hash: ea1d0b3a6cb5cb37c007f34f7ce4f27706d180f4d8cf2a2e339f342492bf67e9
Instruction Fuzzy Hash: D5D1F832D2EF4389D7639B36A460A65A328EF563D4F11D322E92E365F4DF2DD0938600

Function 00007FFDFB4C84F0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c2f44912f5e09ebd99c88d57d39f464eaeee4cd27c2cecf72a42ba10740dcc
Instruction ID: 05d9bfeee5e583e1e9f7de015138ecbf43fbd52bfe5374fba0de0956316e6b0e
Opcode Fuzzy Hash: 30c2f44912f5e09ebd99c88d57d39f464eaeee4cd27c2cecf72a42ba10740dcc
Instruction Fuzzy Hash: D3A11852F2FD6341EB614A349620F759751AF91B98F269331DD6D23AECDF3CE8428204

Function 00007FFDFB4BCB40 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db3963ad50e004714a37869b501b581ddd5cc8b371eae06e2c9d2a34473a976
Instruction ID: 4138fea64a4584ae75090e411f460c3d3f57c9212d9ed21b5cdfa7e41ffeaea7
Opcode Fuzzy Hash: 4db3963ad50e004714a37869b501b581ddd5cc8b371eae06e2c9d2a34473a976
Instruction Fuzzy Hash: 27A11612F29F9245E72387345431BB563589F663F5F02D332EE6A76AE9DF2C92438500

Function 00007FFDFB4EDCE0 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d18fb902741463884a8091511c25784e1496c556b1443837f426afa14859011
Instruction ID: 8091aad8ce08bebb35f5306d2abb86196bc6dc037ed8df9d9175b95fb91b2ca3
Opcode Fuzzy Hash: 5d18fb902741463884a8091511c25784e1496c556b1443837f426afa14859011
Instruction Fuzzy Hash: A8A11512F29F9245E72387345431BB563589F663F9F029333ED6A76AE9DF2CA2038100

Function 00007FFDFB4B52D0 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ebf0d4392b518ed46df58e1a546be9c986e70c751878c7e1f96ccabe1ccea36
Instruction ID: 84ed000c7c20520d104c412493cd34e4e2ffc1db1037737df5696eeadc3b08e3
Opcode Fuzzy Hash: 2ebf0d4392b518ed46df58e1a546be9c986e70c751878c7e1f96ccabe1ccea36
Instruction Fuzzy Hash: 3FC1E932E3AF4389D7539B36A460A646328EF617D4F11D732E92B366F5DF2D90938600

Function 00007FFDFB592170 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf2624e55a330b87f8c0472f5d428c4070dec954c1d9240c8d87dcebd6b07f0
Instruction ID: 0a05dd26802650e5e42a7d4dd128644f97fc04ed1b272ff7a57330dc8f668bc4
Opcode Fuzzy Hash: 5cf2624e55a330b87f8c0472f5d428c4070dec954c1d9240c8d87dcebd6b07f0
Instruction Fuzzy Hash: BF81AEA2F11FA546DB06DF32A910F959219BB58BD4F05D332DE2D2BBE9DA3CC502C200

Function 00007FFDFB4B60E0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094128e65ce4ee1d3f125fa9b13db7303f6ab075c80fac6e8482d058264ed630
Instruction ID: e809546f692a1b1702d1e39d76deace86f3af38b19c5ca7d740d7d8c2a6297dd
Opcode Fuzzy Hash: 094128e65ce4ee1d3f125fa9b13db7303f6ab075c80fac6e8482d058264ed630
Instruction Fuzzy Hash: 33C1D622F29F8388D363873594716356718AF672D5B12D337E46F75ABADF1CA0938600

Function 00007FFDFB4B9240 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b0d08238f732f86c5fcd97342b466156b3b345439f645708aa888bc85a9206
Instruction ID: 35e8603f777f8d255c62400928ceca785992a3b797d38afe2996c74f89955fac
Opcode Fuzzy Hash: 01b0d08238f732f86c5fcd97342b466156b3b345439f645708aa888bc85a9206
Instruction Fuzzy Hash: 36A1B021E2AF4249D66386309471776B35CAFA73D4F11E323F96B74AF9DF18A0834900

Function 00007FFDFB5915B0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931d8c6ccc1ae5a39f24684deed67a703beb54abe1614145a1f90ddf6d62d1b5
Instruction ID: c9d8275461610dab98790afd028a6ee04811ca31ebc6baef5ff3e6bb70a378e7
Opcode Fuzzy Hash: 931d8c6ccc1ae5a39f24684deed67a703beb54abe1614145a1f90ddf6d62d1b5
Instruction Fuzzy Hash: 40811862B1AA9796EB22CB16A420B357760BB4478CF045335DE6D137E9DF3CE545CB00

Function 00007FFDFB58FE20 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62834c3136cc061e6afbbc8f43515c8ec4fa69d6ad4d8141bd8c20b10c354076
Instruction ID: 360332e5dd31bc9408e2a35227c5e7eae513abd999db40b758d078e74525d433
Opcode Fuzzy Hash: 62834c3136cc061e6afbbc8f43515c8ec4fa69d6ad4d8141bd8c20b10c354076
Instruction Fuzzy Hash: 73815E61B14F8246E7138B35A4617B6A365BF567D4F048322ED5A63BBADF3CE142C700

Function 00007FFDFB4F2130 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49638405a087308876907fb22c3f9984d5718240554481d42d0310f29fd439d8
Instruction ID: c218e5b938e6baaa923204e20d2605a0e5d4aff863255670e03c5dc1c490641b
Opcode Fuzzy Hash: 49638405a087308876907fb22c3f9984d5718240554481d42d0310f29fd439d8
Instruction Fuzzy Hash: 3F91C632E29E528AD372873599619297754FF99388F14C332F529A7DFDDF2CE1818A00

Function 00007FFDFB54D6B0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd0e0ea0d155c843edde5cb7a9320593a6a3265ee2024138aa6cd55d8a67bef7
Instruction ID: 20aa40e0eea64611847d12c9fd613b637430839b28143fa54902d579da6023d3
Opcode Fuzzy Hash: fd0e0ea0d155c843edde5cb7a9320593a6a3265ee2024138aa6cd55d8a67bef7
Instruction Fuzzy Hash: 4991A732B19A4786E7168E34D43077AA360FF85384F009236EB6E566EDDF7CE951CA00

Function 00007FFDFB4D8AB0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b94b6364d9f8ecc1e2973ad542fe804447542a1e2b8fea954b94bbafe4a884e
Instruction ID: ae274c11bc78c8c4360deb98821d41609b7587a88474a06b2743141b501349b7
Opcode Fuzzy Hash: 7b94b6364d9f8ecc1e2973ad542fe804447542a1e2b8fea954b94bbafe4a884e
Instruction Fuzzy Hash: CC819321F2AF4288EA53973594717766358AFAA7D4F12D323F81B36BF9DF18A0934100

Function 00007FFDFB4B98F0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9c3b041f443a02d4cfbb25eac4bd17b2791ecba92c8ad740aca22d120b887c
Instruction ID: 3ddd7b6dd2c969ce04ec21e2a51b8ecad4cbf4939dfd4e2620a16bbe9e08341a
Opcode Fuzzy Hash: 9c9c3b041f443a02d4cfbb25eac4bd17b2791ecba92c8ad740aca22d120b887c
Instruction Fuzzy Hash: 35819221F29F8288EA53873594617766358AFA63D4F12D323F91F76BF9DF18A0934500

Function 00007FFDFB4C9EB0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87bce2d7c5d8f37564b3338fd23e95d9f15756c4f0121a1a387407bd7a96ed2a
Instruction ID: 8121cd8e4c884ba09ceac10853ef585775bf5022aab218a6f4b5dd52f2e880c7
Opcode Fuzzy Hash: 87bce2d7c5d8f37564b3338fd23e95d9f15756c4f0121a1a387407bd7a96ed2a
Instruction Fuzzy Hash: 3D813D72E39F4789D35B8E36A572A346214AF637C5F11D333E92B319F9DF2865928200

Function 00007FFDFB4E0B10 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa29f32df1fefac24be1141ec8290592e149f214a7b5868cb4a0e3c47ea1f04
Instruction ID: 9034efb0a9417575e73ca6dc9b5d00ce08f6f66f00862f73cbb6aa71c2201e3f
Opcode Fuzzy Hash: 4fa29f32df1fefac24be1141ec8290592e149f214a7b5868cb4a0e3c47ea1f04
Instruction Fuzzy Hash: 0E91E521E39F8249D7638B3594716766358AFAA3D4F11A327F96B34EB8DF18A1834600

Function 00007FFDFB4BB700 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2903f9fd0b0a73cdea8a10db3e1eaacaa50b9f2f500f4407156dfb922e8102
Instruction ID: 52fe96964b0da58acf0ec972d0e21b31eb7627b64e85f6a6e15814f35647338f
Opcode Fuzzy Hash: 7b2903f9fd0b0a73cdea8a10db3e1eaacaa50b9f2f500f4407156dfb922e8102
Instruction Fuzzy Hash: 6C91D621E39F8249D6638B3594717766358AFAA3E4F11D327F96F34EB4DF18A1834600

Function 00007FFDFB4CD310 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b23a8ff871ce8d5293a7dde1ead125a7bb58777e880a9bfea69504b5390a75
Instruction ID: 68595911b499604175564ded9ce66456ab2092119fea98c0bde35ae0663f4da5
Opcode Fuzzy Hash: 53b23a8ff871ce8d5293a7dde1ead125a7bb58777e880a9bfea69504b5390a75
Instruction Fuzzy Hash: 28812672F2AF1788E3278B3599716356315AF57398F518332E52F7A9F8DF2CA1828500

Function 00007FFDFB591300 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2325d13bcea4abe68e1b842b6fd1c3733934982d334fc04fdf697fc7854dc178
Instruction ID: 46489723813eb712a1b857cc6bb9db1001202662c211e90969d077dfba86c050
Opcode Fuzzy Hash: 2325d13bcea4abe68e1b842b6fd1c3733934982d334fc04fdf697fc7854dc178
Instruction Fuzzy Hash: 14610A66B16BA657EF1A9F25952073936A0BB087D8F009638DE3F477E5DB3CE8418600

Function 00007FFDFB4CBF10 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfffbf3c97e4c293a94c6063d7cc05e155f98ccc300e52c3a4176bcc98c158a
Instruction ID: 947aa4336f38aec284357b09e90a4ee60f6ab9c1ddc6f2d2fd1192bdcb1f94a7
Opcode Fuzzy Hash: 5bfffbf3c97e4c293a94c6063d7cc05e155f98ccc300e52c3a4176bcc98c158a
Instruction Fuzzy Hash: 3391E732E2AF5789D3278B3658716356214AFA67C4F15D333E42F759F9DF2CA1828500

Function 00007FFDFB4F1DD0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8978cca177bba2a7f0ee3dd6e3b0016b93c9fe6141872dbef0b80195821fad
Instruction ID: aec5ba8f32f3c2dcc28b159f222e4e34d681a2c3242c14860a66a19fd498dbd2
Opcode Fuzzy Hash: 7c8978cca177bba2a7f0ee3dd6e3b0016b93c9fe6141872dbef0b80195821fad
Instruction Fuzzy Hash: 43811822E2AF4788E3238B3594716356715AF663D5F51C332E52F7A9F8DF2CE1828600

Function 00007FFDFB4BE4B0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e6c9d005b11431245f524f5aed0ba73343ebbf1519dec636c7560edcf032d0
Instruction ID: 49fd141f1310dd668d680b4fdfb159b3e9c714ed794d376689b223e3a53ac05e
Opcode Fuzzy Hash: 73e6c9d005b11431245f524f5aed0ba73343ebbf1519dec636c7560edcf032d0
Instruction Fuzzy Hash: 43814B22E29F0784E323873995716356315AF963C9F51C732E52F799F9EF2CE1824600

Function 00007FFDFB54D2A0 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41277bf010971ae7e4087a96f13162fe19b3524e711f5ce92598cffc7a24a00c
Instruction ID: 3dec3cdec7cc5f2936b11014d3a1943e05064153dd4c72a3fd14703007a826d5
Opcode Fuzzy Hash: 41277bf010971ae7e4087a96f13162fe19b3524e711f5ce92598cffc7a24a00c
Instruction Fuzzy Hash: 9981B932B19E47C5E7268A35D03077AA350FF96344F009336E76E666E9DF3CE5928A00

Function 00007FFDFB4B8BC0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67ec89f879223372e398217338fb620e29794df0c382a7868d4ceca52482606
Instruction ID: 5b57eb20e3539c47f070c348f1898f2b877554e3e77895e53dbd9319aa704f3d
Opcode Fuzzy Hash: a67ec89f879223372e398217338fb620e29794df0c382a7868d4ceca52482606
Instruction Fuzzy Hash: 0671AF21E2AF8249DA5397359471776A318AFA63D4F11D323F96F35BF8DF18A0934600

Function 00007FFDFB4D13F0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e64bf01820c876063b654664034f010fbadcb8e0dd08d4b7e7cc0a469e0812
Instruction ID: e50313dee6b93de8c7daf0aa921f838eb771dfe5602029debede2699ac854836
Opcode Fuzzy Hash: 64e64bf01820c876063b654664034f010fbadcb8e0dd08d4b7e7cc0a469e0812
Instruction Fuzzy Hash: 8271B121E2AF8249DB5397359471776A318AFAA3D4F11D323F96B35BF9DF18A0838500

Function 00007FFDFB4C8BD0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe90c0ef3c378eba2375e6ba37783d6d143187b7c9aed0e9ede92d85dcad7acb
Instruction ID: 0b79a398ed50e8ed1d4313fa9ecae723f307f7611519cd31cb036f787a165092
Opcode Fuzzy Hash: fe90c0ef3c378eba2375e6ba37783d6d143187b7c9aed0e9ede92d85dcad7acb
Instruction Fuzzy Hash: D56108A1F1F91755FB6A8A349A30E3413529F72BC8E109336D92F666FCEF2C65814210

Function 00007FFDFB4CAA80 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b3061c66c281f6c5a0ece4a3d787df2b41a8c81dde58f407fd36e817a43712
Instruction ID: 8116aa67c6d52b70da627cde0277db3fade512156f6dee1695543e1376f2e30b
Opcode Fuzzy Hash: a2b3061c66c281f6c5a0ece4a3d787df2b41a8c81dde58f407fd36e817a43712
Instruction Fuzzy Hash: 79613572F29F1789E36B86366572F361214AF62784F129336E12F21DFDDF1D61828200

Function 00007FFDFB4DA010 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b034d4ae0bef55d3e8bb3621fa9dd719b8c7a120a1e16a906c8c7b8114f773c
Instruction ID: d331b4c42049574015a6fe037d21206bcd93d129951fed3b3e0a5cbaa2c1507e
Opcode Fuzzy Hash: 7b034d4ae0bef55d3e8bb3621fa9dd719b8c7a120a1e16a906c8c7b8114f773c
Instruction Fuzzy Hash: DE810321E2EF4388E7238736A47163562196F6A3D8F02D333E92E759F9DF1DA1838504

Function 00007FFDFB4B9CC0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d32a59b8c30f1a246eb7320b6288177383b8731a1afc40a0d9aa95af8480761
Instruction ID: 24dddefcc6684f6ea2371ea37ba54c1bdd779c037d87c6fcef77c3b725fcd5b1
Opcode Fuzzy Hash: 5d32a59b8c30f1a246eb7320b6288177383b8731a1afc40a0d9aa95af8480761
Instruction Fuzzy Hash: F181F421E2EF5388E723873694716356218AF663D9F02D333E92E759F99F1DA1838904

Function 00007FFDFB591A10 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8d761121db8e9d51aaaaec2445dd3bd33d7b0b178a85ee4080ed671954576a
Instruction ID: c39342707e3cce49627de2287a0fbd29e8baef45c0606f4cfa4cc0871dd37460
Opcode Fuzzy Hash: fb8d761121db8e9d51aaaaec2445dd3bd33d7b0b178a85ee4080ed671954576a
Instruction Fuzzy Hash: 25513AA2B06B9356EB21CB26E410B7962A0EF547C8F118234DE6D47BF9DF3CE5818700

Function 00007FFDFB4BD020 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38173b49ad3a54d5b2293eb3c62621e4386f534d703035a610f9eabd62e6abf0
Instruction ID: 42700a630b0ce0be24595617f35c0bf97c1acdd5de6c4f9423a9ae93e7e23f82
Opcode Fuzzy Hash: 38173b49ad3a54d5b2293eb3c62621e4386f534d703035a610f9eabd62e6abf0
Instruction Fuzzy Hash: 86613831F29E1789E72B87359471B366219AF62385F12C336E62F35DE9DF1D61828A00

Function 00007FFDFB4EE6C0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e058288062cfc7a3274efe7028e4185b4dfbe26cc7034c14453b825a77cc1d
Instruction ID: ce272baa8896ee48eca388724ef799d3034dfffd91fdcc7532c74947891288d2
Opcode Fuzzy Hash: d9e058288062cfc7a3274efe7028e4185b4dfbe26cc7034c14453b825a77cc1d
Instruction Fuzzy Hash: 69613631F29E1789E76B87359471A366219AF623C5F52C336E52B359F9DF2C60838600

Function 00007FFDFB4B8F30 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d001685cde57dd69e6d5499c01484a1483b37e70a26819e70c39d258613f5dd
Instruction ID: f829d562a27e4203fa6895b266181b44d0fdc3721f9f44a6f684063243148cf1
Opcode Fuzzy Hash: 5d001685cde57dd69e6d5499c01484a1483b37e70a26819e70c39d258613f5dd
Instruction Fuzzy Hash: FA717E22E2AF4388E7674B3195615326318AF7A2E5F16D333E52FB5AB9DF1CA0D34100

Function 00007FFDFB4D2650 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e816c0f78ab03e732b50abe3fc9ebc9e2b2b0a385e43e19b038264679c99195
Instruction ID: 6ddfad0bfaa9474026ad358281de98050d9cdd766893e1d6ee98d4efbe869047
Opcode Fuzzy Hash: 6e816c0f78ab03e732b50abe3fc9ebc9e2b2b0a385e43e19b038264679c99195
Instruction Fuzzy Hash: 13715D22F2AF4388E7639B35956163663186F7A2E5F16D333E42E75AB9DF1CA0D34100

Function 00007FFDFB4BBAE0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860788318de192d3b4b3ddbb509c0cdd4444bb495f2c3d059925915e2b18e2ef
Instruction ID: 2a0433e12b71308eebc015a46c0b4c923a379a1d9d41cc16180968e67fc2ef3d
Opcode Fuzzy Hash: 860788318de192d3b4b3ddbb509c0cdd4444bb495f2c3d059925915e2b18e2ef
Instruction Fuzzy Hash: AA513631E2AF8389D763973654716355214BF6A3C8F61C333E92E349F9EF2DA1828500

Function 00007FFDFB4E1200 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b88380b083e2c5602851094573cb46c33a93952d88dcd8e14091659b941835
Instruction ID: 5607514a5b22d3b6ba678c085ec2f5c907970f566590defe6059c447b97497f2
Opcode Fuzzy Hash: 09b88380b083e2c5602851094573cb46c33a93952d88dcd8e14091659b941835
Instruction Fuzzy Hash: 1C512831E2AF8789D763973654715356314AF6A3C9F61C333E82E359F9EF2DA1828900

Function 00007FFDFB4B4AD0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf06f54103c5cc25296ef1b72b92cb1f4eb859a5c468d4e750c106aa546d2a04
Instruction ID: b8af4fbd85bda1c71bc003ac15687fa0d91b02068c9c32558c568e7e6c8901cf
Opcode Fuzzy Hash: cf06f54103c5cc25296ef1b72b92cb1f4eb859a5c468d4e750c106aa546d2a04
Instruction Fuzzy Hash: C551F425F2E54784EB71833196A0EBB62519F9434CF609336F53E56DECDE2CE1868B40

Function 00007FFDFB591FC0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d452344f4a644b9ec0b168545340ba19e39037bd80a5ac05049245aba1ec374e
Instruction ID: 4fabbf31c133d215ef692883bb51640dd7173e1dccde1bce6f650cfb8a224700
Opcode Fuzzy Hash: d452344f4a644b9ec0b168545340ba19e39037bd80a5ac05049245aba1ec374e
Instruction Fuzzy Hash: 3441FDB7F4127857D6088F55B9419C5FA59B398BC9F08E016DE5C57F64D638C983C240

Function 00007FFDFB591EA0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f33713845d21480dc85f324d9f26d82b484ae95ff2e2e6418c8e3df5e1ce514
Instruction ID: cd4f0e83ac75ba4870f1ac0cd373e875c4e1f16df20674e3292c0467a9d005e2
Opcode Fuzzy Hash: 1f33713845d21480dc85f324d9f26d82b484ae95ff2e2e6418c8e3df5e1ce514
Instruction Fuzzy Hash: BB215BA3F0152903EB1C8EB67953A84C55E6BE8FD5309F1239D4C77BA5E939C8838240

Function 00007FFDFB55EA20 Relevance: 38.6, APIs: 20, Strings: 2, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA48
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA65
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA82
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA9F
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EABC
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EAD9
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EAF6
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB13
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB30
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB4D
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB6A
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB87
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBA4
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBBD
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBD6
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBEF
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EC08
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EC21
GetProcAddress.KERNEL32 ref: 00007FFDFB55EC44
GetProcAddress.KERNEL32 ref: 00007FFDFB55EC5B

Strings

_errno, xrefs: 00007FFDFB55EC54
_write, xrefs: 00007FFDFB55EC33

Memory Dump Source

Source File: 00000000.00000002.2915035295.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000000.00000002.2915014796.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915237559.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915474698.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915527348.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2915557948.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb4b0000_loaddll64.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: _errno$_write
API String ID: 1883125708-629457799
Opcode ID: a7e45877e4498e92427e6c2f68ae8fdc50a8aa3ab37254dae28a79f26cfcfa8d
Instruction ID: dcdfa421a7974b0069e92ee6071cd1f393491f7abcb34fb76591985b338b78df
Opcode Fuzzy Hash: a7e45877e4498e92427e6c2f68ae8fdc50a8aa3ab37254dae28a79f26cfcfa8d
Instruction Fuzzy Hash: 20515660F1FF1780FB52CB19A970A7422A0BF98796F484435C87E067F9EFADA9458340

Analysis Process: rundll32.exePID: 5572, Parent PID: 6324COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	40
Total number of Limit Nodes:	2

Executed Functions

Function 00007FFDFB4B8420 Relevance: 4.7, APIs: 3, Instructions: 169
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FFDFB4B8439
GetProcessHeap.KERNEL32 ref: 00007FFDFB4B8472
HeapAlloc.KERNEL32 ref: 00007FFDFB4B8480

Memory Dump Source

Source File: 00000003.00000002.1847988962.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000003.00000002.1847959704.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1848304264.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1848569628.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1848642524.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1848683063.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: Heap$AllocCreateFileProcess
String ID:
API String ID: 3203875786-0
Opcode ID: 2d9733e9c9f357357592a8d9fb725a563b86b74d139ad321112a9bbe39b3b16f
Instruction ID: 149af692fd1ab315c5f17e023e2b7c5f9bbc79d92c1502df8cc7a40b21c95c7f
Opcode Fuzzy Hash: 2d9733e9c9f357357592a8d9fb725a563b86b74d139ad321112a9bbe39b3b16f
Instruction Fuzzy Hash: 8971A332B1A78286EB10CF29A460AA9B765FFC5B84F449235DE5D077A9DF3CE041CB04

Non-executed Functions

Function 00007FFDFB55EA20 Relevance: 38.6, APIs: 20, Strings: 2, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA48
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA65
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA82
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA9F
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EABC
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EAD9
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EAF6
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB13
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB30
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB4D
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB6A
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB87
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBA4
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBBD
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBD6
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBEF
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EC08
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EC21
GetProcAddress.KERNEL32 ref: 00007FFDFB55EC44
GetProcAddress.KERNEL32 ref: 00007FFDFB55EC5B

Strings

_write, xrefs: 00007FFDFB55EC33
_errno, xrefs: 00007FFDFB55EC54

Memory Dump Source

Source File: 00000003.00000002.1847988962.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 00000003.00000002.1847959704.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1848304264.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1848569628.00007FFDFB80D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1848642524.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1848683063.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: _errno$_write
API String ID: 1883125708-629457799
Opcode ID: a7e45877e4498e92427e6c2f68ae8fdc50a8aa3ab37254dae28a79f26cfcfa8d
Instruction ID: dcdfa421a7974b0069e92ee6071cd1f393491f7abcb34fb76591985b338b78df
Opcode Fuzzy Hash: a7e45877e4498e92427e6c2f68ae8fdc50a8aa3ab37254dae28a79f26cfcfa8d
Instruction Fuzzy Hash: 20515660F1FF1780FB52CB19A970A7422A0BF98796F484435C87E067F9EFADA9458340

Analysis Process: rundll32.exePID: 7212, Parent PID: 6324COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	183
Total number of Limit Nodes:	3

Executed Functions

Function 00007FFDFB4B8420 Relevance: 4.7, APIs: 3, Instructions: 169
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FFDFB4B8439
GetProcessHeap.KERNEL32 ref: 00007FFDFB4B8472
HeapAlloc.KERNEL32 ref: 00007FFDFB4B8480

Memory Dump Source

Source File: 0000000A.00000002.1885626446.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 0000000A.00000002.1885603915.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885773523.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885940259.00007FFDFB80D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885963770.00007FFDFB80E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886009205.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886039521.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: Heap$AllocCreateFileProcess
String ID:
API String ID: 3203875786-0
Opcode ID: 2d9733e9c9f357357592a8d9fb725a563b86b74d139ad321112a9bbe39b3b16f
Instruction ID: 149af692fd1ab315c5f17e023e2b7c5f9bbc79d92c1502df8cc7a40b21c95c7f
Opcode Fuzzy Hash: 2d9733e9c9f357357592a8d9fb725a563b86b74d139ad321112a9bbe39b3b16f
Instruction Fuzzy Hash: 8971A332B1A78286EB10CF29A460AA9B765FFC5B84F449235DE5D077A9DF3CE041CB04

Function 00007FFDFB62E344 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FFDFB62DBF6,?,?,?,00007FFDFB62C1C1,?,?,?,?,00007FFDFB62AAD7), ref: 00007FFDFB62E399

Memory Dump Source

Source File: 0000000A.00000002.1885626446.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 0000000A.00000002.1885603915.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885773523.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885940259.00007FFDFB80D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885963770.00007FFDFB80E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886009205.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886039521.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d1728647228f92dd1fcf1da762d887e051608acd538b4b990c3edadb53133b84
Instruction ID: bfb6e0a7fbe4e868fc4e1fe23f69784026eda016a28ac9d52be61e438cd72cb7
Opcode Fuzzy Hash: d1728647228f92dd1fcf1da762d887e051608acd538b4b990c3edadb53133b84
Instruction Fuzzy Hash: 2BF09004B1B20782FF6457619971FB922805F84B81F4C1438ED2E8E3F9EE2CE4C44211

Non-executed Functions

Function 00007FFDFB62BDAC Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFDFB62BE25
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFB62BE3D
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFB62BE78
IsDebuggerPresent.KERNEL32 ref: 00007FFDFB62BEB1
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB62BEBB
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB62BEC6

Memory Dump Source

Source File: 0000000A.00000002.1885626446.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 0000000A.00000002.1885603915.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885773523.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885940259.00007FFDFB80D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885963770.00007FFDFB80E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886009205.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886039521.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 750841f4963b94de0c0b3500b646837ed4ee6ddd7b476c2d72146abbaab38126
Instruction ID: 44ef6162e47891eca66e98bf91d56b28a79facd3ff269567af48681781f0702e
Opcode Fuzzy Hash: 750841f4963b94de0c0b3500b646837ed4ee6ddd7b476c2d72146abbaab38126
Instruction Fuzzy Hash: A7318136719B8286EB60CF25E8506AE73A0FB88794F540136EE9D47BA9DF3CC145CB00

Function 00007FFDFB55EA20 Relevance: 38.6, APIs: 20, Strings: 2, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA48
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA65
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA82
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EA9F
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EABC
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EAD9
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EAF6
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB13
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB30
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB4D
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB6A
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EB87
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBA4
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBBD
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBD6
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EBEF
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EC08
GetModuleHandleA.KERNEL32 ref: 00007FFDFB55EC21
GetProcAddress.KERNEL32 ref: 00007FFDFB55EC44
GetProcAddress.KERNEL32 ref: 00007FFDFB55EC5B

Strings

_write, xrefs: 00007FFDFB55EC33
_errno, xrefs: 00007FFDFB55EC54

Memory Dump Source

Source File: 0000000A.00000002.1885626446.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 0000000A.00000002.1885603915.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885773523.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885940259.00007FFDFB80D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885963770.00007FFDFB80E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886009205.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886039521.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: _errno$_write
API String ID: 1883125708-629457799
Opcode ID: a7e45877e4498e92427e6c2f68ae8fdc50a8aa3ab37254dae28a79f26cfcfa8d
Instruction ID: dcdfa421a7974b0069e92ee6071cd1f393491f7abcb34fb76591985b338b78df
Opcode Fuzzy Hash: a7e45877e4498e92427e6c2f68ae8fdc50a8aa3ab37254dae28a79f26cfcfa8d
Instruction Fuzzy Hash: 20515660F1FF1780FB52CB19A970A7422A0BF98796F484435C87E067F9EFADA9458340

Function 00007FFDFB63031C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00007FFDFB63049B
GetProcAddress.KERNEL32 ref: 00007FFDFB6304A7

Strings

ext-ms-, xrefs: 00007FFDFB6303F8
api-ms-, xrefs: 00007FFDFB6303E5

Memory Dump Source

Source File: 0000000A.00000002.1885626446.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 0000000A.00000002.1885603915.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885773523.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885940259.00007FFDFB80D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885963770.00007FFDFB80E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886009205.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886039521.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 8cddd77126df67d415fdc83bb25cec66b0080605921fc163ad3e30ebbab7ec17
Instruction ID: 155c738bf8c05e25f30f9c9854045675d0b16281b6b67d40f14ff29769e1783f
Opcode Fuzzy Hash: 8cddd77126df67d415fdc83bb25cec66b0080605921fc163ad3e30ebbab7ec17
Instruction Fuzzy Hash: ED41B462B1A64381FB51CB1AA834A762395AF45BE0F4C4135DD2D8B7EDEE3CE5898340

Function 00007FFDFB62DA1C Relevance: 10.6, APIs: 7, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FFDFB62DA2B
FlsGetValue.KERNEL32 ref: 00007FFDFB62DA40
FlsSetValue.KERNEL32 ref: 00007FFDFB62DA61
FlsSetValue.KERNEL32 ref: 00007FFDFB62DA8E
FlsSetValue.KERNEL32 ref: 00007FFDFB62DA9F
FlsSetValue.KERNEL32 ref: 00007FFDFB62DAB0
SetLastError.KERNEL32 ref: 00007FFDFB62DACB

Memory Dump Source

Source File: 0000000A.00000002.1885626446.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 0000000A.00000002.1885603915.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885773523.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885940259.00007FFDFB80D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885963770.00007FFDFB80E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886009205.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886039521.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 616a8a8d77a6b8d9e8b81ded9d66018e56d5c459af8475019f2794630c65dc87
Instruction ID: d12c15824a07816f810e93e818ef78fe64caaae69e51a921b94dbce52815a564
Opcode Fuzzy Hash: 616a8a8d77a6b8d9e8b81ded9d66018e56d5c459af8475019f2794630c65dc87
Instruction Fuzzy Hash: 9B213720B0E24342FF986761A575E7952525F88BB0F184634EC3E4EBFEDE2CA4858711

Function 00007FFDFB62DB94 Relevance: 9.1, APIs: 6, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00007FFDFB62C1C1,?,?,?,?,00007FFDFB62AAD7,?,?,?,00007FFDFB61E948), ref: 00007FFDFB62DBA3
FlsSetValue.KERNEL32(?,?,?,00007FFDFB62C1C1,?,?,?,?,00007FFDFB62AAD7,?,?,?,00007FFDFB61E948), ref: 00007FFDFB62DBD9
FlsSetValue.KERNEL32(?,?,?,00007FFDFB62C1C1,?,?,?,?,00007FFDFB62AAD7,?,?,?,00007FFDFB61E948), ref: 00007FFDFB62DC06
FlsSetValue.KERNEL32(?,?,?,00007FFDFB62C1C1,?,?,?,?,00007FFDFB62AAD7,?,?,?,00007FFDFB61E948), ref: 00007FFDFB62DC17
FlsSetValue.KERNEL32(?,?,?,00007FFDFB62C1C1,?,?,?,?,00007FFDFB62AAD7,?,?,?,00007FFDFB61E948), ref: 00007FFDFB62DC28
SetLastError.KERNEL32(?,?,?,00007FFDFB62C1C1,?,?,?,?,00007FFDFB62AAD7,?,?,?,00007FFDFB61E948), ref: 00007FFDFB62DC43

Memory Dump Source

Source File: 0000000A.00000002.1885626446.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 0000000A.00000002.1885603915.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885773523.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885940259.00007FFDFB80D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885963770.00007FFDFB80E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886009205.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886039521.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: afab31eddbab2fcb999a24c33dad6c6f2826fa1a7dac849d93b6fddb21923f0c
Instruction ID: 11e8021b21efdd188e604cade8568408fabb25520559c1e484bddf6efbf0bc35
Opcode Fuzzy Hash: afab31eddbab2fcb999a24c33dad6c6f2826fa1a7dac849d93b6fddb21923f0c
Instruction Fuzzy Hash: 1C116D60B0E24342FF9867215571A3911525F88BB0F040334DC3E4FBFEDE6CA4818B10

Function 00007FFDFB62DC5C Relevance: 7.6, APIs: 5, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFDFB62BD3B,?,?,00000000,00007FFDFB62BFD6,?,?,?,?,?,00007FFDFB62BF62), ref: 00007FFDFB62DC7B
FlsSetValue.KERNEL32(?,?,?,00007FFDFB62BD3B,?,?,00000000,00007FFDFB62BFD6,?,?,?,?,?,00007FFDFB62BF62), ref: 00007FFDFB62DC9A
FlsSetValue.KERNEL32(?,?,?,00007FFDFB62BD3B,?,?,00000000,00007FFDFB62BFD6,?,?,?,?,?,00007FFDFB62BF62), ref: 00007FFDFB62DCC2
FlsSetValue.KERNEL32(?,?,?,00007FFDFB62BD3B,?,?,00000000,00007FFDFB62BFD6,?,?,?,?,?,00007FFDFB62BF62), ref: 00007FFDFB62DCD3
FlsSetValue.KERNEL32(?,?,?,00007FFDFB62BD3B,?,?,00000000,00007FFDFB62BFD6,?,?,?,?,?,00007FFDFB62BF62), ref: 00007FFDFB62DCE4

Memory Dump Source

Source File: 0000000A.00000002.1885626446.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 0000000A.00000002.1885603915.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885773523.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885940259.00007FFDFB80D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885963770.00007FFDFB80E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886009205.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886039521.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 063ea84af38c3dee00ac2677882d953c5b7c9168a632be67b9157d65d40a8ad0
Instruction ID: c82972dd05fcb87d473df3c09c8161e039545c1f7cdc450bd18a61f90a444c72
Opcode Fuzzy Hash: 063ea84af38c3dee00ac2677882d953c5b7c9168a632be67b9157d65d40a8ad0
Instruction Fuzzy Hash: 6A113760B0B68342FF98A325A571A7922565F847F0F184739EC3D4EBFEDE6CA4818711

Function 00007FFDFB62DAF0 Relevance: 7.6, APIs: 5, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32 ref: 00007FFDFB62DB01
FlsSetValue.KERNEL32 ref: 00007FFDFB62DB20
FlsSetValue.KERNEL32 ref: 00007FFDFB62DB48
FlsSetValue.KERNEL32 ref: 00007FFDFB62DB59
FlsSetValue.KERNEL32 ref: 00007FFDFB62DB6A

Memory Dump Source

Source File: 0000000A.00000002.1885626446.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 0000000A.00000002.1885603915.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885773523.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885940259.00007FFDFB80D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885963770.00007FFDFB80E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886009205.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886039521.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 0e5752f7d8c9a4120b3f1562c0d343e5f65816b89d77409a09a23f1410ee526e
Instruction ID: 6dc5f4ef66043725b5d9c9c2dfc1cd0cbc824eddfacc47319f671124005d7b07
Opcode Fuzzy Hash: 0e5752f7d8c9a4120b3f1562c0d343e5f65816b89d77409a09a23f1410ee526e
Instruction Fuzzy Hash: 4C11E894F0B20302FF98A3255832A7911424F857B2F180738DD3D4E2FEDD2CB4859A61

Function 00007FFDFB62F8B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFDFB62F20C: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,00007FFDFB62F548), ref: 00007FFDFB62F236

IsValidCodePage.KERNEL32(?,?,?,00000001,?,00000000,INTEL_ISA_DISABLE,00007FFDFB62F679), ref: 00007FFDFB62F91D
GetCPInfo.KERNEL32(?,?,?,00000001,?,00000000,INTEL_ISA_DISABLE,00007FFDFB62F679), ref: 00007FFDFB62F969

Strings

INTEL_ISA_DISABLE, xrefs: 00007FFDFB62F8BA

Memory Dump Source

Source File: 0000000A.00000002.1885626446.00007FFDFB4B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB4B0000, based on PE: true

Associated: 0000000A.00000002.1885603915.00007FFDFB4B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885773523.00007FFDFB638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885940259.00007FFDFB80D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1885963770.00007FFDFB80E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886009205.00007FFDFB84F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000A.00000002.1886039521.00007FFDFB853000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffdfb4b0000_rundll32.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: INTEL_ISA_DISABLE
API String ID: 546120528-73491743
Opcode ID: 1cfd66923bfafb69a9f1693d224c02c4870d00efb05212d6f9914e271ce99b4e
Instruction ID: c6a253f2354e9641b3db355bc85cf4dcfe2cc87299581ea11ee6730483c559d0
Opcode Fuzzy Hash: 1cfd66923bfafb69a9f1693d224c02c4870d00efb05212d6f9914e271ce99b4e
Instruction Fuzzy Hash: BD81D162B0E28786FF648F25E07097977A1AB54B80F584036CAAE4B6F9DE3DE541C740

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report libmmd.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_lib_7fb52cffe21ecd6abfc1c32e247ab46588f99498_0fd03ba9_5097cc39-576f-429e-8e24-a95d50f63d86\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_lib_7fb52cffe21ecd6abfc1c32e247ab46588f99498_0fd03ba9_7f5ebac1-d6d5-4cf2-8be5-db53b231b40a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_lib_9afd1e816e2885921660f65cfabdd427ac9437d_0fd03ba9_2091bba8-a1b3-45bc-be49-99cc77a1e4cd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_lib_a3b6957ca019c315fa2e856f651d7b4deeb1dc56_0fd03ba9_e9428bdd-c82c-4b88-bda4-2e7421f6b2a7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B3E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B4E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2BCC.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2BFC.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C4A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C99.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER363B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER366A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER369A.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4389.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER43C8.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER43E9.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Windows Analysis Report
libmmd.dll.dll