Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll (renamed file extension from exe to dll)
Original sample name:	SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.exe
Analysis ID:	1542010
MD5:	76dae69bfde8cb40d0259f8b3736820c
SHA1:	a7f83b240002220cae161c351946c59e7db255c9
SHA256:	e8cd3d85840d7eedb28875ea60457f450d3b3c57f0834012f77a9a7fe713e6ad
Tags:	exe
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6372 cmdline: loaddll64.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 6588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5744 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 2084 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 5016 cmdline: C:\Windows\system32\WerFault.exe -u -p 2084 -s 344 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 3844 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutCallBehaviorMethod MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 1104 cmdline: C:\Windows\system32\WerFault.exe -u -p 3844 -s 288 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 5416 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutCreateElement MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 3400 cmdline: C:\Windows\system32\WerFault.exe -u -p 5416 -s 296 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7248 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutDataReady MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7292 cmdline: C:\Windows\system32\WerFault.exe -u -p 7248 -s 288 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7360 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutCallBehaviorMethod MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7372 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutCreateElement MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7380 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutDataReady MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7408 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_step MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7464 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_prepare_v2 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7476 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_open16 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7488 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_column_text MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7504 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_close MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7512 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayout_UseElement MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7524 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayout_UnuseElement MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7540 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutWindowDetachEventHandler MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7548 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutWindowAttachEventHandler MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7564 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutVisitElements MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7572 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateWindow MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7580 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateElementEx MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7588 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateElement MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7604 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetupDebugOutput MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7620 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetStyleAttribute MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7644 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetOption MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7656 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementState MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7780 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementInnerText16 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7792 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementHtml MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7804 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetCallback MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll

ReversingLabs: Detection: 13%

Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE1150C824 FindFirstFileExW,

0_2_00007FFE1150C824

Source: Amcache.hve.8.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE11502390	0_2_00007FFE11502390
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE11503010	0_2_00007FFE11503010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE11501C80	0_2_00007FFE11501C80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE1150C824	0_2_00007FFE1150C824
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE11503BD0	0_2_00007FFE11503BD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE115116B8	0_2_00007FFE115116B8

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2084 -s 344

Source: classification engine

Classification label: mal48.winDLL@83/17@0/0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6588:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2084
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3844
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7248
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5416

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\2e3fbea0-52ef-49a4-b49e-776d0f7f4fcf

Jump to behavior

Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutCallBehaviorMethod

Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutCallBehaviorMethod
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2084 -s 344
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3844 -s 288
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutCreateElement
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5416 -s 296
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutDataReady
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7248 -s 288
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutCallBehaviorMethod
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutCreateElement
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutDataReady
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_step
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_prepare_v2
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_open16
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_column_text
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_close
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayout_UseElement
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayout_UnuseElement
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutWindowDetachEventHandler
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutWindowAttachEventHandler
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutVisitElements
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateWindow
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateElementEx
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateElement
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetupDebugOutput
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetStyleAttribute
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetOption
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementState
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementInnerText16
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementHtml
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetCallback
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutCallBehaviorMethod	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutCreateElement	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutDataReady	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutCallBehaviorMethod	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutCreateElement	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutDataReady	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_step	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_prepare_v2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_open16	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_column_text	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_close	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayout_UseElement	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayout_UnuseElement	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutWindowDetachEventHandler	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutWindowAttachEventHandler	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutVisitElements	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateWindow	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateElementEx	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateElement	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetupDebugOutput	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetStyleAttribute	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetOption	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementState	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementInnerText16	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementHtml	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetCallback	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Section loaded: apphelp.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE11502230 LoadLibraryA,GetProcAddress,FreeLibrary,GetCurrentThread,CreateThread,CloseHandle,

0_2_00007FFE11502230

Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: section name: _RDATA
Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: section name: .detourc
Source: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	Static PE information: section name: .detourd

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\loaddll64.exe TID: 6616

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE1150C824 FindFirstFileExW,

0_2_00007FFE1150C824

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE11509DDC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FFE11509DDC

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE11502230 LoadLibraryA,GetProcAddress,FreeLibrary,GetCurrentThread,CreateThread,CloseHandle,

0_2_00007FFE11502230

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE1150E374 GetProcessHeap,

0_2_00007FFE1150E374

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE11509DDC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FFE11509DDC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE11511D20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FFE11511D20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE115054C4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FFE115054C4

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE11511500 cpuid

0_2_00007FFE11511500

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE11505094 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FFE11505094

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Rundll32	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll	13%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542010
Start date and time:	2024-10-25 12:45:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll (renamed file extension from exe to dll)
Original Sample Name:	SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.exe
Detection:	MAL
Classification:	mal48.winDLL@83/17@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 29

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll

Simulations

Behavior and APIs

Time	Type	Description
06:46:24	API Interceptor	4x Sleep call for process: WerFault.exe modified
06:48:07	API Interceptor	1x Sleep call for process: loaddll64.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Sec_847e5933c7b68f10fff588c9d4be4118d8c5e594_a132e67f_5dfd797d-ff43-4b78-8031-391bd555f2ca\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7693054116424295
Encrypted:	false
SSDEEP:	384:lVUGi0ndVUD9hufrjDzuiFNY4lO8bVU1:ljieo9hufrjDzuiFNY4lO8b
MD5:	140A9DB4E48E5BEEA518AA91C40C6656
SHA1:	D3D7CB15BCF1C567A8C7F46CC935C8D6A6A2E39C
SHA-256:	309C5E83199F007B21734A7B6ADB9E225DFFDA3E444780C4CCD256751C7AF2F1
SHA-512:	A4588068FB794E972981DD3278B7BA8EEB7722CAA98CD66474B1E57D9F31E661768BFE78BA4E3BBD63E7D226C3D2157134747EF38F775245DE802BE8CDD27E1E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.3.2.6.7.6.2.2.7.4.9.2.2.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.3.2.6.7.6.2.9.3.1.1.8.0.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.d.f.d.7.9.7.d.-.f.f.4.3.-.4.b.7.8.-.8.0.3.1.-.3.9.1.b.d.5.5.5.f.2.c.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.3.e.e.3.f.b.a.-.f.0.7.6.-.4.4.c.8.-.b.4.c.9.-.d.1.f.5.1.9.9.e.3.7.3.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...T.r.o.j.a.n...K.r.y.p.t.i.k...D.Q.O.J.J.U...3.2.4.8.7.......O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.8.2.4.-.0.0.0.1.-.0.0.1.4.-.c.e.a.e.-.8.8.1.5.c.b.2.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Sec_84dfe926c8a473f70df6ff9eee142b124f3fe79_a132e67f_0cdc4759-0de7-40f8-8c28-aa5cc0333853\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7735501770811893
Encrypted:	false
SSDEEP:	384:rPVUGiPYdVUnOf0ZjDzuiFNY4lO8bVU1:rPjiC0Of0ZjDzuiFNY4lO8b
MD5:	116804AD203A60395FEC8A4213FFDB4B
SHA1:	FDE392D634F661F40E0027673C37DF7B55EC2D58
SHA-256:	36DF32A421726D3FF34AF45A8B252EE88CE20E20424A89B7A66A9C170863D6E3
SHA-512:	9BA681E1CE453DF86E9E5A8BE4C7A1380BDE25CE847C73E29E0A9742A8A192AABAA5112A65727B457158C4D56B00FE0B13A6C5A82AC5811C809C81DC682C01FB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.3.2.6.7.6.8.1.2.0.8.2.0.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.3.2.6.7.6.8.7.4.5.8.0.4.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.d.c.4.7.5.9.-.0.d.e.7.-.4.0.f.8.-.8.c.2.8.-.a.a.5.c.c.0.3.3.3.8.5.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.3.d.0.b.d.7.6.-.3.9.9.6.-.4.1.3.d.-.9.7.f.9.-.b.1.8.f.8.5.7.6.4.3.6.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...T.r.o.j.a.n...K.r.y.p.t.i.k...D.Q.O.J.J.U...3.2.4.8.7.......O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.5.0.-.0.0.0.1.-.0.0.1.4.-.1.1.5.6.-.1.f.1.9.c.b.2.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Sec_84dfe926c8a473f70df6ff9eee142b124f3fe79_a132e67f_23825486-2bbf-45fb-9b0a-6d8c1a4fbf60\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7734265734766228
Encrypted:	false
SSDEEP:	192:MBVUGivy6ZdVUs0O3v0ZjHjzuiFNZ24lO8bVU1:IVUGiqcdVUnOf0ZjDzuiFNY4lO8bVU1
MD5:	3D9082C79A776338948FF79AC27FB359
SHA1:	3D0A1379193C52678EE252BECEFF9367BEFC36B0
SHA-256:	B4E6A7DECAB27FA791EC7C1614EE6ECB286A8BA61FD786F3933F2C823D614932
SHA-512:	0BDD2FA274C6B723FB66CC339E8FD51631AABE82E95B356AF35EBE713E719A5D912D02045DF1CB86C15AFBE945C4ED82E5C648CBDAAC4244D2554BC9AE0FD085
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.3.2.6.7.6.5.0.9.1.1.3.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.3.2.6.7.6.5.6.8.4.8.8.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.3.8.2.5.4.8.6.-.2.b.b.f.-.4.5.f.b.-.9.b.0.a.-.6.d.8.c.1.a.4.f.b.f.6.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.d.c.c.f.a.b.3.-.3.3.e.2.-.4.d.2.6.-.9.d.7.9.-.6.a.e.6.d.b.f.b.a.c.2.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...T.r.o.j.a.n...K.r.y.p.t.i.k...D.Q.O.J.J.U...3.2.4.8.7.......O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.2.8.-.0.0.0.1.-.0.0.1.4.-.f.d.5.7.-.5.3.1.7.c.b.2.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Sec_84dfe926c8a473f70df6ff9eee142b124f3fe79_a132e67f_dea66e8e-942f-4a31-bba4-c04961d93161\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7731186098153546
Encrypted:	false
SSDEEP:	384:lVUGiOU2dVUnOf0ZjDzuiFNY4lO8bVU1:ljio0Of0ZjDzuiFNY4lO8b
MD5:	AC5F448DFD250DBB4096B0EB3DB1D737
SHA1:	FD17B22C2BA4F03F918F62093033A75BDB5928FF
SHA-256:	0DBB692F508E35657F37D1554EB0485F526ED1294BA1A264FFEF4F1D4EF7F33F
SHA-512:	B59EDDE9AFAB42DAABD67E11074082E61F33D4055F3AF93535A2370583DB72BC4A91CE8F8021881369FC5B3F517D5FAC16520916C829171AB89C4D5FCD59FAC8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.3.2.6.7.6.2.2.8.1.6.8.6.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.3.2.6.7.6.3.4.2.2.3.1.8.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.e.a.6.6.e.8.e.-.9.4.2.f.-.4.a.3.1.-.b.b.a.4.-.c.0.4.9.6.1.d.9.3.1.6.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.7.7.0.0.0.7.f.-.d.a.4.a.-.4.9.b.d.-.b.9.4.f.-.0.1.7.d.2.9.a.e.c.6.0.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...T.r.o.j.a.n...K.r.y.p.t.i.k...D.Q.O.J.J.U...3.2.4.8.7.......O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.0.4.-.0.0.0.1.-.0.0.1.4.-.5.7.7.3.-.8.7.1.5.c.b.2.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1718.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Oct 25 10:46:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	64934
Entropy (8bit):	1.4372382259023015
Encrypted:	false
SSDEEP:	96:5I8tyKH4Qxe9UlLhA1hIg8PMV2qtbuIoi7MqejaXop+7YMzY6xsMAtleMimyQbQV:RwQxXlMV2oAOMQYo7YMzYm8leMvhlbS
MD5:	32DF03DCBC4917BAD7622D8A54CA7491
SHA1:	E20B5802A79D621D3E50F40A76CF519066F58F4B
SHA-256:	62C93CB9D940E5B70F23ADB71B8C7969C1B804BDE7F53CE62AF58AEF9CEAB0B6
SHA-512:	55BFC6B9E9AD2F0D824FD8AD00918E8B8633DA2DA5D9009CE0208FAE374BC7A60183ADD410B87C2DBF9C258D144B9E078B5C50EFD107C45797315CB5BFECAE75
Malicious:	false
Preview:	MDMP..a..... ........v.g........................t...........<...L.......$....-..........`.......8...........T.......................................t...............................................................................eJ..............Lw......................T.......$....v.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1787.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Oct 25 10:46:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	575338
Entropy (8bit):	0.8890901316040474
Encrypted:	false
SSDEEP:	384:XPhwuTGemTpu/EoWnu3+nW3gl+UXbiTCd+U/VpWFJcEFf:Xpwua/oWu3Yd+U9qcEF
MD5:	128A62AF8F3D75C39A4307486C0C163A
SHA1:	FD40F49618D8961882FF575129D1F67AFB75DABA
SHA-256:	860A974476596625E29F20A2B969171B29CEA409E8950027099A3EDF41208BC1
SHA-512:	16CAB336BBB1E8D3F76616121EF3C10CA8719F116DC31247BC66549DA00F5BE3B314B924D3A54AEFAA8F3206651EA3151B26E1A9B12EEB85AC27716FD679C97E
Malicious:	false
Preview:	MDMP..a..... ........v.g........................t...........<...L.......4....-..........`.......8...........T......................................t...............................................................................eJ..............Lw......................T............v.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER17A6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8678
Entropy (8bit):	3.696372154910322
Encrypted:	false
SSDEEP:	192:R6l7wVeJzA3k/6YBKHfgmf0VUEiNnbpDT89bxLWffbm:R6lXJU3s6Ys/gmf0VUEiNn6xKf6
MD5:	A902107E281A1AAB7DFCF60A10C88C52
SHA1:	EBA6A2E22CAAFF8CE12114644EA93FDE446229FF
SHA-256:	BB2ACFBEF32F1FA99AFB6AE74F75BC2152C7926F3CB4C10463CA3AF00B3E8815
SHA-512:	91DAB8C8A173BC2C9453D589F25B757CFEE54F47584A5445BD6E4ECDD0E852B91FF660E42A481CB66909A3598EFA8594BA3D626F6388E317702937A09561CD71
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.0.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1805.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4989
Entropy (8bit):	4.542755236870299
Encrypted:	false
SSDEEP:	48:cvIwWl8zsqJg771I9ylWpW8VYIDYm8M4JC34YgFVyq8vh4YIptSTSud:uIjf4I7JU7VEJtW8poOud
MD5:	A0D1603D5D30D4848FD21FDDDD02D655
SHA1:	49F5F6B40F07BCFAD630C78A7800DCEC81FA9269
SHA-256:	62077E9F8101F0C891A6F64C26AA5F9B7413F2B623FC7FC592498AF6A4FCAE14
SHA-512:	4A83A174449BBB1A24BD35E744082F78EC706B8FC9ED988FEC7F3EB727857A2FD7B5CC30F654DC2997C9A8A29F32E43CBE2C21368E78471985E0F2CD067F2B65
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="558828" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A28.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.6978323100448858
Encrypted:	false
SSDEEP:	192:R6l7wVeJW9qK+6YZxVgmf0VUEwijpD089boPWfZYm:R6lXJEqL6YvVgmf0VUEwyoufT
MD5:	513C41C02A425EDA896D1095744EA401
SHA1:	D746665AFB383B2E4FC248D1B50F3BAB2D874293
SHA-256:	2F04798F10D91EB3B4D6FF52BBF00277C18D7E3914C2FC4B1A9CA6EF2A56ABC9
SHA-512:	7AC7B27A48DE365362DE433F50E018BBAC782BF773FB6ACD2A6E67F2B37FEC13D866FC17651BEF84651606090E55525AAAD7848FA9FED9F60BCDB590B9DC884D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.8.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A67.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5035
Entropy (8bit):	4.567784838278926
Encrypted:	false
SSDEEP:	48:cvIwWl8zsqJg771I9ylWpW8VYIBoYm8M4JC34XFiyq8vh4qVptSTSxd:uIjf4I7JU7VHFJkWdpoOxd
MD5:	86DB52F9DD2567D2D4E44CB695FAAF0D
SHA1:	95DAECDAA38885E386CA4C62FFDFE3DBF93DC6CE
SHA-256:	C14A6E6B0AA3A204873D147AB7D0DC5DC45C47BBE2F48D2B2FA60FF03713A220
SHA-512:	1A28C64721BF360F143709B719A9D2E3C991A1E8E554CE71F74ECF6842D34FF387E185B205C4BBC5B08A854310A8C3F1B9F0D5F173B7B26FDE4CFDDE37AE41DA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="558828" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2215.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Oct 25 10:46:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	578202
Entropy (8bit):	0.8864098378237648
Encrypted:	false
SSDEEP:	768:VOUrjz7DLTbjrz7DLTbjrz7DLTbjrz7DLTbj1Syay621ZBve3JnkiktPHCEOffKU:ZSya2RqkiktPHkffK
MD5:	FD36EE5B7F3BCBD173136BE213B709C6
SHA1:	89D29A6F1D1AAE56692F98198B536D3DDD227604
SHA-256:	D53EC5EAD278D8148F7BCBEF63CCC192076181B3F59F2CBAD58F00084E80FA41
SHA-512:	BA7CA56DA96EFDC19907BF54AB1F9277273D9C39570B1CACCAEB6F7115924837BAC335F8F0C03B9A416D4094AEE83DE2F4074AE6F7873EE57C965B2678210B3E
Malicious:	false
Preview:	MDMP..a..... ........v.g........................t...........<...L.......4....-..........`.......8...........T.......................................t...............................................................................eJ..............Lw......................T.......(....v.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23AC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8718
Entropy (8bit):	3.7003772415028733
Encrypted:	false
SSDEEP:	192:R6l7wVeJ7l1IF6YZBVgmf0VUEwijpDRC89b+wWftKm:R6lXJJeF6YfVgmf0VUEwg7+ZfB
MD5:	AC20CF3B7366BBA0252F9F568FA93C9A
SHA1:	4E6D031B0E46D2FB8B9511F782B3B25259DE0162
SHA-256:	4176993E80EB8CFA52089172E997214843BD3B19390D1ABAC42921878CA3EC97
SHA-512:	4224E36F8B35FAFE284D1AFC9ED10BE485422C438E61D063851D0BDE0A0DE891C385CF380A062D03D92B71751BA73F888F05530EB3397906177314596681D659
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.4.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23DC.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5035
Entropy (8bit):	4.570322002370681
Encrypted:	false
SSDEEP:	48:cvIwWl8zsqJg771I9ylWpW8VYIvYm8M4JC34XFNyq8vh4h9ptSTSBd:uIjf4I7JU7V0JXWQpoOBd
MD5:	FAB923D0C1B8F07105843C148C53759F
SHA1:	039AA21C9551F084682ABF077345C827B7909917
SHA-256:	345DE4287E49B28A08F0E5DDBC7628F5205EDCCBFD8DDBFBE67EEF9784607C20
SHA-512:	AD5FEDA7BE9905489031919DC9F7844A74EDC479A8AA71E680B0100F0CF2A39BBEAD673FA25C2E01702CADF2B65C80375535422E3856866297EFE114F34623F9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="558828" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DFC.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Oct 25 10:46:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	577186
Entropy (8bit):	0.886308258120648
Encrypted:	false
SSDEEP:	384:B2BVtVu3apXh3B9V9s34v434vSZlZnQ0WC3ksGOUm0:kBN5hx9E34vSJnLk5
MD5:	FDF70F2BCC2C2A1FA7D678C199E13A47
SHA1:	BF3547CE59CC10164FF3886CCDF7D02F8D8E5B91
SHA-256:	E097BE4CC8D8120E93E8D5EB10F997736FCB97B2FD08E5574923FF83B4A2048E
SHA-512:	02CEC27DE638D5E5CC1FB8DAE2128439D53E2CC0D3AB1941A95D05AAF26AD94F08532000FCF1A706BBB14E53EF755AA782A074A206A4CCA2C682456D66F9821D
Malicious:	false
Preview:	MDMP..a..... ........v.g........................t...........<...L.......D....-..........`.......8...........T.......................................t...............................................................................eJ..............Lw......................T.......P....v.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F26.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8718
Entropy (8bit):	3.7001929730719922
Encrypted:	false
SSDEEP:	192:R6l7wVeJEAr16YZYVgmf0VUEwijpDa89brjofqGZm:R6lXJjr16Y2Vgmf0VUEwArMfqZ
MD5:	D8502FB67998E2EECB40B63E8CC95382
SHA1:	900E85DD3F1B31E244CA33D682200F06728B7117
SHA-256:	A4A5B144EFB0AE072B30181A4D1E63C615E9546A78C618941307A6B781149499
SHA-512:	59D33B813CF6D652B92DE385446F9D88D07678E4429CC7933C569A9BF48BD50A893A5E23FAD6122B32ECBDFA1E88E61F456857DCD137093498A08D03BE2D3789
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F55.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5035
Entropy (8bit):	4.572948853530648
Encrypted:	false
SSDEEP:	48:cvIwWl8zsqJg771I9ylWpW8VYICYm8M4JC34XFvjyq8vh4SptSTSFd:uIjf4I7JU7VFJ5jWFpoOFd
MD5:	083616840F482C8616ABD068BA3769EB
SHA1:	8763EB1DA4DDDCD09F4AC088B29F22040F60FB1A
SHA-256:	AE336A2BEFC1917903BE35CAAEDD16752E04DCF4A4797A1F53C994558C04BD15
SHA-512:	5D1A6FFF0CD650A3FEFDE0B383119B1D31A413E9CA0B9240B4FC14AF0DFAF20DD6B33512399213A6AA8C683712570E0FCBA1A0DE908C29EAD94C8C6F5E816D06
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="558828" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466372140248933
Encrypted:	false
SSDEEP:	6144:xIXfpi67eLPU9skLmb0b4zWSPKaJG8nAgejZMMhA2gX4WABl0uNcdwBCswSb9:SXD94zWlLZMM6YFHa+9
MD5:	F71281DAA0B521F07B805C120E9AFC17
SHA1:	21AE2D9465D6FB0182E1133B5E802C06F8774BCC
SHA-256:	3D8225BDCC17283679A535EE77D25E11A523915721BBBAC256920245A69FA686
SHA-512:	52B786E3536207CE31C59D889390DC6F38650E43ECD40097D24AC16E50C900FE38DD540751CA25859EE86CCF75EF14218918570E0791E30E492D49A6CCE133F9
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm~....&...............................................................................................................................................................................................................................................................................................................................................(.!........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	5.852515449410217
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll
File size:	139'776 bytes
MD5:	76dae69bfde8cb40d0259f8b3736820c
SHA1:	a7f83b240002220cae161c351946c59e7db255c9
SHA256:	e8cd3d85840d7eedb28875ea60457f450d3b3c57f0834012f77a9a7fe713e6ad
SHA512:	0a718b8295448a4b57e1e656c1446e8ffadd09ac07a7754cbe1ae42c225be1630d552b05b8887db74cedf4b7d49f58c778cbaadd02d85a782b8175fdd26cef92
SSDEEP:	3072:YPBL22Nu6dCcGmBG3AxkEaaW6QlJlMQ6+snerWM5WH:cgBuBG3ck48lJWerWMgH
TLSH:	92D3283FB2B542BBD426813984530F35A332F8950730DB9F0A954ABD1EB37D19D29B62
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .^Rdq0.dq0.dq0./.3.aq0./.5..q0./.4.nq0.6.5.Fq0.6.4.jq0.6.3.mq0./.1.cq0.dq1..q0...9.cq0...0.eq0.....eq0...2.eq0.Richdq0........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180005018
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6715F971 [Mon Oct 21 06:49:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	44cdc801a895c4cbaf14c1dd721f21ad

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F9954815817h
call 00007F9954815870h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F99548156A4h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
jmp 00007F9954815821h
dec eax
mov ecx, ebx
call 00007F995481943Ah
test eax, eax
je 00007F9954815825h
dec eax
mov ecx, ebx
call 00007F99548194A6h
dec eax
test eax, eax
je 00007F99548157F9h
dec eax
add esp, 20h
pop ebx
ret
dec eax
cmp ebx, FFFFFFFFh
je 00007F9954815818h
call 00007F9954815F54h
int3
call 00007F9954815F6Eh
int3
dec eax
mov dword ptr [esp+20h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00019F68h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007F9954815886h
dec eax
and dword ptr [ebp+18h], 00000000h
dec eax
lea ecx, dword ptr [ebp+18h]
call dword ptr [0000E01Ah]
dec eax
mov eax, dword ptr [ebp+18h]
dec eax
mov dword ptr [ebp+10h], eax
call dword ptr [0000E004h]
mov eax, eax
dec eax
xor dword ptr [ebp+10h], eax
call dword ptr [0000DFF0h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1d1e0	0x5ec	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d7cc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28000	0xf8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x21000	0x1254	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x29000	0xa94	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b720	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1b760	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x348	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x115a2	0x11600	5078fef54c7d2e2983707352221cdea1	False	0.590349595323741	zlib compressed data	6.4854667724654576	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0xb2ca	0xb400	ccca7978ba6b4b2f434c1c9408cd8026	False	0.4117838541666667	data	4.630939705872032	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1f000	0x1d98	0xc00	0aea13ff98a072bc3efa4a3addb4f808	False	0.1435546875	DOS executable (block device driver \322f\324\377\3772)	2.042643173523336	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x21000	0x1254	0x1400	33c17830c447237df1a4ba8f73ce1bba	False	0.442578125	data	4.646158518892248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x23000	0xfc	0x200	c1afef9f385ed834f9b1d5311af224c0	False	0.296875	data	1.9925111403557825	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.detourc	0x24000	0x21c0	0x2200	c5690763d958566407d69b1cc40d6e4b	False	0.14510569852941177	data	2.7185189157071132	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.detourd	0x27000	0x18	0x200	083338860205efcc4d20e102cfe79c12	False	0.037109375	Matlab v4 mat-file (little endian) \377\377\377\377, numeric, rows 0, columns 0	0.11611507530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x28000	0xf8	0x200	af9421cf07137b18ce8c7d80578e5fc4	False	0.3359375	data	2.5220112108280497	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x29000	0xa94	0xc00	59aa9a8f5d7e94e2dec9d29ba1a9251b	False	0.3570963541666667	data	5.180079286833233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x28060	0x91	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.8689655172413793

Imports

DLL	Import
KERNEL32.dll	LoadLibraryA, GetProcAddress, FreeLibrary, Sleep, GetCurrentThread, VirtualFree, SetEvent, WaitForSingleObject, ResetEvent, CreateThread, CloseHandle, CreateFileA, GetFileSize, ReadFile, GetLastError, CreateEventW, AddVectoredExceptionHandler, GetModuleFileNameA, GetModuleHandleW, WriteConsoleW, HeapReAlloc, HeapSize, GetStringTypeW, FlushFileBuffers, SetStdHandle, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, VirtualProtect, GetCurrentProcess, VirtualAlloc, SuspendThread, ResumeThread, VirtualProtectEx, GetThreadContext, FlushInstructionCache, SetThreadContext, VirtualQuery, VirtualQueryEx, SetLastError, LoadLibraryExA, LoadLibraryExW, RtlUnwindEx, InterlockedFlushSList, RtlPcToFileHeader, RaiseException, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, TerminateProcess, GetModuleHandleExW, GetModuleFileNameW, GetConsoleMode, WriteFile, GetConsoleOutputCP, SetFilePointerEx, HeapFree, GetStdHandle, GetFileType, HeapAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, LCMapStringW, GetProcessHeap, CreateFileW
USER32.dll	PeekMessageW, DispatchMessageW, TranslateMessage
SHLWAPI.dll	PathRemoveFileSpecA, PathAppendA

Exports

Name	Ordinal	Address
HTMLayoutCallBehaviorMethod	1	0x1800027c0
HTMLayoutCreateElement	2	0x1800027c0
HTMLayoutDataReady	3	0x1800027c0
HTMLayoutGetAttributeByName	4	0x1800027c0
HTMLayoutGetChildrenCount	5	0x1800027c0
HTMLayoutGetElementHwnd	6	0x1800027c0
HTMLayoutGetElementIndex	7	0x1800027c0
HTMLayoutGetElementInnerTextCB	8	0x1800027c0
HTMLayoutGetElementLocation	9	0x1800027c0
HTMLayoutGetElementState	10	0x1800027c0
HTMLayoutGetNthChild	11	0x1800027c0
HTMLayoutGetParentElement	12	0x1800027c0
HTMLayoutGetRootElement	13	0x1800027c0
HTMLayoutGetStyleAttribute	14	0x1800027c0
HTMLayoutInsertElement	15	0x1800027c0
HTMLayoutLoadFile	16	0x1800027c0
HTMLayoutLoadHtmlEx	17	0x1800027c0
HTMLayoutPostEvent	18	0x1800027c0
HTMLayoutProcND	19	0x1800027c0
HTMLayoutScrollToView	20	0x1800027c0
HTMLayoutSelectElements	21	0x1800027c0
HTMLayoutSelectElementsW	22	0x1800027c0
HTMLayoutSendEvent	23	0x1800027c0
HTMLayoutSetAttributeByName	24	0x1800027c0
HTMLayoutSetCallback	25	0x1800027c0
HTMLayoutSetElementHtml	26	0x1800027c0
HTMLayoutSetElementInnerText16	27	0x1800027c0
HTMLayoutSetElementState	28	0x1800027c0
HTMLayoutSetOption	29	0x1800027c0
HTMLayoutSetStyleAttribute	30	0x1800027c0
HTMLayoutSetupDebugOutput	31	0x1800027c0
HTMLayoutUpdateElement	32	0x1800027c0
HTMLayoutUpdateElementEx	33	0x1800027c0
HTMLayoutUpdateWindow	34	0x1800027c0
HTMLayoutVisitElements	35	0x1800027c0
HTMLayoutWindowAttachEventHandler	36	0x1800027c0
HTMLayoutWindowDetachEventHandler	37	0x1800027c0
HTMLayout_UnuseElement	38	0x1800027c0
HTMLayout_UseElement	39	0x1800027c0
sqlite3_close	40	0x1800027c0
sqlite3_column_text	41	0x1800027c0
sqlite3_open16	42	0x1800027c0
sqlite3_prepare_v2	43	0x1800027c0
sqlite3_step	44	0x1800027c0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	06:46:01
Start date:	25/10/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll"
Imagebase:	0x7ff74d940000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	06:46:01
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:46:01
Start date:	25/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",#1
Imagebase:	0x7ff66d510000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:46:01
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutCallBehaviorMethod
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:46:01
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",#1
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:46:02
Start date:	25/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2084 -s 344
Imagebase:	0x7ff7d6030000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:46:02
Start date:	25/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3844 -s 288
Imagebase:	0x7ff7d6030000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:46:04
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutCreateElement
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:46:05
Start date:	25/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5416 -s 296
Imagebase:	0x7ff7d6030000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:46:07
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll,HTMLayoutDataReady
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:46:08
Start date:	25/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7248 -s 288
Imagebase:	0x7ff7d6030000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:46:10
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutCallBehaviorMethod
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:46:10
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutCreateElement
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:46:10
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutDataReady
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_step
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_prepare_v2
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_open16
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_column_text
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",sqlite3_close
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayout_UseElement
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayout_UnuseElement
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutWindowDetachEventHandler
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutWindowAttachEventHandler
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutVisitElements
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateWindow
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateElementEx
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutUpdateElement
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetupDebugOutput
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetStyleAttribute
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetOption
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementState
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementInnerText16
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetElementHtml
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	06:46:11
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll",HTMLayoutSetCallback
Imagebase:	0x7ff7eb6f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.4%
Total number of Nodes:	1356
Total number of Limit Nodes:	16

Executed Functions

Function 00007FFE11502390 Relevance: 58.0, APIs: 17, Strings: 16, Instructions: 233
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32 ref: 00007FFE115023B6
AddVectoredExceptionHandler.KERNEL32 ref: 00007FFE115023CF
CreateThread.KERNELBASE ref: 00007FFE115023F0
CloseHandle.KERNELBASE ref: 00007FFE115023F9
GetModuleFileNameA.KERNEL32 ref: 00007FFE11502421
PathRemoveFileSpecA.KERNELBASE ref: 00007FFE1150242B
PathAppendA.SHLWAPI ref: 00007FFE1150243C
CreateFileA.KERNELBASE ref: 00007FFE11502463
CloseHandle.KERNEL32 ref: 00007FFE11502475
GetFileSize.KERNEL32 ref: 00007FFE11502491
ReadFile.KERNEL32 ref: 00007FFE115024C8
GetLastError.KERNEL32 ref: 00007FFE115024D2
CloseHandle.KERNEL32 ref: 00007FFE115024DB

Strings

Slee, xrefs: 00007FFE11502762
el32, xrefs: 00007FFE1150270A
kern, xrefs: 00007FFE11502705
Virt, xrefs: 00007FFE11502685
e, xrefs: 00007FFE1150263C
ualA, xrefs: 00007FFE11502667
lloc, xrefs: 00007FFE1150272F
lloc, xrefs: 00007FFE1150266F
3, xrefs: 00007FFE11502644
.dll, xrefs: 00007FFE11502712
Virt, xrefs: 00007FFE1150271F
bd.dat, xrefs: 00007FFE11502431
ualA, xrefs: 00007FFE11502727
AABBAABB, xrefs: 00007FFE1150250E
r, xrefs: 00007FFE11502634
k, xrefs: 00007FFE1150262C

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: File$CloseCreateHandle$Path$AppendErrorEventExceptionHandlerLastModuleNameReadRemoveSizeSpecThreadVectored
String ID: .dll$3$AABBAABB$Slee$Virt$Virt$bd.dat$e$el32$k$kern$lloc$lloc$r$ualA$ualA
API String ID: 2000086441-2148533931
Opcode ID: 748b09c8db22c9233cfb8b6db612900a15be1036188c19155c0c32e5012fe5a0
Instruction ID: 819e37513ceabfb2f73a7a99d73ad5911274fc15f5f01597c782c3dc46123dce
Opcode Fuzzy Hash: 748b09c8db22c9233cfb8b6db612900a15be1036188c19155c0c32e5012fe5a0
Instruction Fuzzy Hash: 7FB1B572A19F8285EB61DFA2E8502AE77A9FB447A4F400179DA4D07B79DF3CD148CB00

Function 00007FFE11503010 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 348
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFE11503029
GetCurrentThreadId.KERNEL32 ref: 00007FFE11503079
VirtualProtect.KERNEL32 ref: 00007FFE115030B5
GetCurrentProcess.KERNEL32 ref: 00007FFE11503122
VirtualProtect.KERNEL32 ref: 00007FFE11503153
FlushInstructionCache.KERNEL32 ref: 00007FFE11503165
ResumeThread.KERNEL32 ref: 00007FFE11503188

Strings

dtrR, xrefs: 00007FFE115034C4

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: CurrentThread$ProtectVirtual$CacheFlushInstructionProcessResume
String ID: dtrR
API String ID: 389031504-1586779240
Opcode ID: 4e1dd71c2b551d481fc923206b8a64093158a7e9e0a79a0bf46b119fb70263a9
Instruction ID: a3e735a9d1841975f1cf283d3672d62f4d4f00fc005ae33bf7c54901e219dd83
Opcode Fuzzy Hash: 4e1dd71c2b551d481fc923206b8a64093158a7e9e0a79a0bf46b119fb70263a9
Instruction Fuzzy Hash: 48F18E22A0EE8286EB918F53D4502BE77A9FB49BA4F084176DA4D07776DF3CE095C740

Function 00007FFE11502230 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 69
librarythreadloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE11502266
GetProcAddress.KERNEL32 ref: 00007FFE115022A2
FreeLibrary.KERNEL32 ref: 00007FFE115022BB
GetCurrentThread.KERNEL32 ref: 00007FFE115022DF
CreateThread.KERNELBASE ref: 00007FFE11502360
CloseHandle.KERNELBASE ref: 00007FFE11502370

Strings

ct, xrefs: 00007FFE11502298
.dll, xrefs: 00007FFE11502303
kern.dllVirtrote, xrefs: 00007FFE115022ED
kernrote, xrefs: 00007FFE115022F8

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: LibraryThread$AddressCloseCreateCurrentFreeHandleLoadProc
String ID: .dll$ct$kern.dllVirtrote$kernrote
API String ID: 1766266960-2031131594
Opcode ID: e7fd98acc4234be35493e34f86f575c47727de015c7b141c750db42f753a3734
Instruction ID: 6df7a93a1768fcde02d417f206e3414996de71ba947d0d845f416694f35dba94
Opcode Fuzzy Hash: e7fd98acc4234be35493e34f86f575c47727de015c7b141c750db42f753a3734
Instruction Fuzzy Hash: 14312A72E09F0289FB41DFE2E9512AC3AB9BB04764F5044B8C94C66B79EF3C92448B15

Function 00007FFE11504CF8 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE11504D20
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE11504D72
_RTC_Initialize.LIBCMT ref: 00007FFE11504DA0
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE11504DC6
__scrt_release_startup_lock.LIBCMT ref: 00007FFE11504DF1

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: dd18162d97b1a6b29cd3cf662115e7bc01adcf2463740e85e59020e4d9962bdd
Instruction ID: 45614df8714cab16cf0ba71a8c4235aec0c5fa1aca55e7b34609cf3968f6eeb0
Opcode Fuzzy Hash: dd18162d97b1a6b29cd3cf662115e7bc01adcf2463740e85e59020e4d9962bdd
Instruction Fuzzy Hash: 5581DF21E1CE4346FB61ABA794512BD6A9DAF857A4F4480BDEA0C473B3DF3CE8458701

Function 00007FFE115036A0 Relevance: 6.2, APIs: 4, Instructions: 248
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFE115036D3

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: c061db6a54b3aca9ccfc29b1edd971cf39f48d1cbc30c91d7a325912b1399ad0
Instruction ID: a349c0c2b6071d8afd738e0ba895724e65b45f67d81704430abcc6dbd06cad61
Opcode Fuzzy Hash: c061db6a54b3aca9ccfc29b1edd971cf39f48d1cbc30c91d7a325912b1399ad0
Instruction Fuzzy Hash: BFB1B562E0DF828AE7A08B92E44477E7799FB447A4F4445B9CA9D03BB2DF3CE5548700

Function 00007FFE1150BF4C Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FFE1150BFC5
GetFileType.KERNELBASE ref: 00007FFE1150BFDB

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: d4df30131ec42738e431e5d51b80152184bce404cb529a4fbe6d8a5f229f992f
Instruction ID: 98bad001804bf7f534f17a7b91d23184e424133c152b50a480828b3701bdd17f
Opcode Fuzzy Hash: d4df30131ec42738e431e5d51b80152184bce404cb529a4fbe6d8a5f229f992f
Instruction Fuzzy Hash: E3317E22A18F4681EB608F56959017D6A59FB46BB0F6813ADDB6E473F0CF3DE4A1D300

Function 00007FFE11502B40 Relevance: 3.1, APIs: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,-7FF80000,00007FFE11502DD9,?,?,00000000,00007FFE11503790), ref: 00007FFE11502BAB
VirtualAlloc.KERNELBASE ref: 00007FFE11502BDF

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: a1bf2276042524e804c363faaddb26e5b58e67ec955276ecdb07037aca792729
Instruction ID: ec03519e16a206e9732ce98c2e3b0de6ba29c7e06af27550aaa6b543e4c96676
Opcode Fuzzy Hash: a1bf2276042524e804c363faaddb26e5b58e67ec955276ecdb07037aca792729
Instruction Fuzzy Hash: AA11E421F1DE8642EF618B62E114379A251BB487F4F184339FA9C467F8EF2CD1C08600

Function 00007FFE115052F4 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE11505316

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach
String ID:
API String ID: 2860701742-0
Opcode ID: 3df07956f1b410fff491cdda7c16f79f6f5fab2606c02a4a58a2709734f37b96
Instruction ID: 27d32b1bb9fa057b426661570fc5250cdb2fa343d85dd24f2653148664cbe5b4
Opcode Fuzzy Hash: 3df07956f1b410fff491cdda7c16f79f6f5fab2606c02a4a58a2709734f37b96
Instruction Fuzzy Hash: 2EE01A50E2CA4285FF252AF720622FD17581F15378F4414FDDDAE421F38D4D69491565

Non-executed Functions

Function 00007FFE11503BD0 Relevance: 38.8, APIs: 13, Strings: 9, Instructions: 262
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExA.KERNEL32 ref: 00007FFE11503C02
GetProcAddress.KERNEL32 ref: 00007FFE11503C1A
GetCurrentProcess.KERNEL32 ref: 00007FFE11503C6D
LoadLibraryExW.KERNEL32 ref: 00007FFE11503C86
GetProcAddress.KERNEL32 ref: 00007FFE11503CA6
GetProcAddress.KERNEL32 ref: 00007FFE11503CC1
GetProcAddress.KERNEL32 ref: 00007FFE11503CDC
GetProcAddress.KERNEL32 ref: 00007FFE11503CF7
GetProcAddress.KERNEL32 ref: 00007FFE11503D12
GetProcAddress.KERNEL32 ref: 00007FFE11503D2D
GetProcAddress.KERNEL32 ref: 00007FFE11503D48
GetLastError.KERNEL32 ref: 00007FFE11503E22
FreeLibrary.KERNEL32 ref: 00007FFE1150402B

Strings

SymGetOptions, xrefs: 00007FFE11503CE9
X, xrefs: 00007FFE11503FE1
SymFromName, xrefs: 00007FFE11503D3A
SymInitialize, xrefs: 00007FFE11503CB3
ImagehlpApiVersionEx, xrefs: 00007FFE11503C9C
SymSetOptions, xrefs: 00007FFE11503CCE
SymGetModuleInfo64, xrefs: 00007FFE11503D1F
SymLoadModule64, xrefs: 00007FFE11503D04
dbghelp.dll, xrefs: 00007FFE11503C76

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: AddressProc$Library$Load$CurrentErrorFreeLastProcess
String ID: ImagehlpApiVersionEx$SymFromName$SymGetModuleInfo64$SymGetOptions$SymInitialize$SymLoadModule64$SymSetOptions$X$dbghelp.dll
API String ID: 1987430839-1769957640
Opcode ID: af72ff92c30fe70ee819a1b1fed1df289b22ebf1dfbfbe834bb4dfab729c1675
Instruction ID: 9daa7786b5514614e3b03a7542fc9493795da5707347bea1bb2fc8701791ddf0
Opcode Fuzzy Hash: af72ff92c30fe70ee819a1b1fed1df289b22ebf1dfbfbe834bb4dfab729c1675
Instruction Fuzzy Hash: 66C15E22A1EF82C5FB91CB92E8542792BAAFF847A0F4441B9CA4D467B1DF3CE544C701

Function 00007FFE115054C4 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE115054E0
RtlCaptureContext.KERNEL32 ref: 00007FFE1150550D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE11505527
RtlVirtualUnwind.KERNEL32 ref: 00007FFE11505568
IsDebuggerPresent.KERNEL32 ref: 00007FFE115055BC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE115055DD
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE115055E8

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ceae5bf99175bf329a882c9c01ada8f9b0552e284b09529520216b81c19f759a
Instruction ID: 1a4ab360bc0dd3a400d836f495a7a82fb916bc8d72a1298dfb8f7b480818a493
Opcode Fuzzy Hash: ceae5bf99175bf329a882c9c01ada8f9b0552e284b09529520216b81c19f759a
Instruction Fuzzy Hash: FF316D72619E818AEB608F61E8503ED7369FB84768F444079DA4D47BA5EF3CC648C700

Function 00007FFE11509DDC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFE11509E55
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE11509E6D
RtlVirtualUnwind.KERNEL32 ref: 00007FFE11509EA8
IsDebuggerPresent.KERNEL32 ref: 00007FFE11509EE1
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE11509EEB
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE11509EF6

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 653a7dd5f739a26b48d6358187edaa874bff51e666f89fa05cf4fd4263b2b541
Instruction ID: e7db64b742455ec7db7b9749fd96cf63fe2ffed7653599bfbc426820374bd450
Opcode Fuzzy Hash: 653a7dd5f739a26b48d6358187edaa874bff51e666f89fa05cf4fd4263b2b541
Instruction Fuzzy Hash: 17319432618F8186DB60CF66E8402AE73A9FB84764F540179EA9D43B79EF3CC545CB00

Function 00007FFE115116B8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FFE11511907
RaiseException.KERNEL32 ref: 00007FFE11511918

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: e31da4721cf26eebe3d2a8be9e2adc1308b472473acb19fe4f12416613483fde
Instruction ID: a44321d5cfbace76f069ccb37f25ea995261da507bf7a381398dbb7d597e25df
Opcode Fuzzy Hash: e31da4721cf26eebe3d2a8be9e2adc1308b472473acb19fe4f12416613483fde
Instruction Fuzzy Hash: 22B16C77A04B898AEB16CF3AC48636C7BA5F784B58F1489A1DA6D837B4CB3DD451C700

Function 00007FFE1150C824 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ac312f4b710438d319fbfa6c52b5c7fbaa3ff3507b47009a3330bb5223a6f1
Instruction ID: b052cbec6a4b0606a2264c3ebe84a535412ec4fbb833d74127f73a06cf79fa7f
Opcode Fuzzy Hash: 09ac312f4b710438d319fbfa6c52b5c7fbaa3ff3507b47009a3330bb5223a6f1
Instruction Fuzzy Hash: F351C422B08F9185FB10DBB6A8442AE7BA9FB417A4F1441B9EE5D27AB5CE3CD5418700

Function 00007FFE1150E374 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFE1150E378

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8bb68053ac3bf32336c7316952a68321939a125ed2afefbdb217c5687ebb920c
Instruction ID: 48b5c23912b94a786eaf2a9530bcec24c2be95a78e3e481da409455aa9f7c19e
Opcode Fuzzy Hash: 8bb68053ac3bf32336c7316952a68321939a125ed2afefbdb217c5687ebb920c
Instruction Fuzzy Hash: 78B09225E0BE02C6EB992B526C8621422AE7F88730FA900B8C01C41330DE2C20E59701

Function 00007FFE11501C80 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 534549ea163d61a7c457dc93563329af7cb01e3e0525a982fb1a593890e2156f
Instruction ID: 864e87dfcb997ebe7a5a5758810f89d134d6f88fe4b8f36745c5bd0f219891ab
Opcode Fuzzy Hash: 534549ea163d61a7c457dc93563329af7cb01e3e0525a982fb1a593890e2156f
Instruction Fuzzy Hash: B1C15A53A0D6D04DE7128FB980901FD3FB0DB2E71DB0A428AEFD86998BD618D394D725

Function 00007FFE11511500 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8a0e7fef8ddd7bc8ed9c8976c1d54b922fe6bdf0dc1b8b06ed46e333767b34
Instruction ID: 5c7d2a006b22a7764544c1197bf818745794a77c9b2e8ec47835c8f6418e25dc
Opcode Fuzzy Hash: ce8a0e7fef8ddd7bc8ed9c8976c1d54b922fe6bdf0dc1b8b06ed46e333767b34
Instruction Fuzzy Hash: 8BF0F672B19695CBDBA4CFAEA84262977D5F7083D0F848079D68D83B24C63C80618F04

Function 00007FFE11504370 Relevance: 19.7, APIs: 13, Instructions: 160
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFE115043E8
VirtualQueryEx.KERNEL32 ref: 00007FFE11504410
VirtualProtectEx.KERNEL32 ref: 00007FFE1150444F
GetCurrentProcess.KERNEL32 ref: 00007FFE11504465
VirtualQueryEx.KERNEL32 ref: 00007FFE1150448C
VirtualProtectEx.KERNEL32 ref: 00007FFE115044BD
GetCurrentProcess.KERNEL32 ref: 00007FFE11504506
VirtualQueryEx.KERNEL32 ref: 00007FFE1150452D
VirtualProtectEx.KERNEL32 ref: 00007FFE1150455A
VirtualProtect.KERNEL32 ref: 00007FFE11504587
VirtualProtect.KERNEL32 ref: 00007FFE115045A1
VirtualProtect.KERNEL32 ref: 00007FFE115045B6
SetLastError.KERNEL32 ref: 00007FFE115045F7

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: Virtual$Protect$CurrentProcessQuery$ErrorLast
String ID:
API String ID: 3405148435-0
Opcode ID: ff34727a7d015ad3aec6eb73e7a699898f2e6799fc8288cd341ea737d9ec148e
Instruction ID: e232dfeb5f73631625636f94d1a2493370b56ff983f339ee5aca855ad6685a87
Opcode Fuzzy Hash: ff34727a7d015ad3aec6eb73e7a699898f2e6799fc8288cd341ea737d9ec148e
Instruction Fuzzy Hash: A9717E32B09A818AD7208F36D4146AD37A5FB49BA8F048269DE4C17BB9DF3CD595C740

Function 00007FFE1150B710 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00007FFE1150F54B,?,?,?,00007FFE1150E850,?,?,00000001,00007FFE11509C1F), ref: 00007FFE1150B71F
FlsGetValue.KERNEL32(?,?,?,00007FFE1150F54B,?,?,?,00007FFE1150E850,?,?,00000001,00007FFE11509C1F), ref: 00007FFE1150B734
FlsSetValue.KERNEL32(?,?,?,00007FFE1150F54B,?,?,?,00007FFE1150E850,?,?,00000001,00007FFE11509C1F), ref: 00007FFE1150B755
FlsSetValue.KERNEL32(?,?,?,00007FFE1150F54B,?,?,?,00007FFE1150E850,?,?,00000001,00007FFE11509C1F), ref: 00007FFE1150B782
FlsSetValue.KERNEL32(?,?,?,00007FFE1150F54B,?,?,?,00007FFE1150E850,?,?,00000001,00007FFE11509C1F), ref: 00007FFE1150B793
FlsSetValue.KERNEL32(?,?,?,00007FFE1150F54B,?,?,?,00007FFE1150E850,?,?,00000001,00007FFE11509C1F), ref: 00007FFE1150B7A4
SetLastError.KERNEL32(?,?,?,00007FFE1150F54B,?,?,?,00007FFE1150E850,?,?,00000001,00007FFE11509C1F), ref: 00007FFE1150B7BF
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFE1150F54B,?,?,?,00007FFE1150E850,?,?,00000001,00007FFE11509C1F), ref: 00007FFE1150B7F5
FlsSetValue.KERNEL32(?,?,00000001,00007FFE1150D810,?,?,?,?,00007FFE115093D3,?,?,?,?,?,00007FFE115051E4), ref: 00007FFE1150B814

Part of subcall function 00007FFE1150C24C: HeapAlloc.KERNEL32(?,?,00000000,00007FFE1150B8EA,?,?,00000000,00007FFE1150A1ED,?,?,?,?,00007FFE1150BB50), ref: 00007FFE1150C2A1

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFE1150F54B,?,?,?,00007FFE1150E850,?,?,00000001,00007FFE11509C1F), ref: 00007FFE1150B83C

Part of subcall function 00007FFE1150BB1C: HeapFree.KERNEL32 ref: 00007FFE1150BB32
Part of subcall function 00007FFE1150BB1C: GetLastError.KERNEL32 ref: 00007FFE1150BB3C

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFE1150F54B,?,?,?,00007FFE1150E850,?,?,00000001,00007FFE11509C1F), ref: 00007FFE1150B84D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFE1150F54B,?,?,?,00007FFE1150E850,?,?,00000001,00007FFE11509C1F), ref: 00007FFE1150B85E

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 8f004e0fd8d534411d4f2fec35ca597af5750725386c7776f7d15f151d711827
Instruction ID: 893ae9b182d38560d56bca6a720ac1b25cf40b8c6e91eefff05e546997acd79f
Opcode Fuzzy Hash: 8f004e0fd8d534411d4f2fec35ca597af5750725386c7776f7d15f151d711827
Instruction Fuzzy Hash: 51414B28E0DE0342FB69ABB759911BD224A9F547B0F1807BDE93E0A7F6DE2CB5054201

Function 00007FFE115077E8 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 312
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFE11507844

Part of subcall function 00007FFE1150869C: _GetEstablisherFrame.LIBVCRUNTIME ref: 00007FFE115086D1
Part of subcall function 00007FFE1150869C: __GetUnwindTryBlock.LIBCMT ref: 00007FFE115086DF
Part of subcall function 00007FFE1150869C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFE11508704

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1150791C
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFE11507B62
_GetEstablisherFrame.LIBVCRUNTIME ref: 00007FFE11507BB4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE11507C6E

Strings

csm, xrefs: 00007FFE115078C5
csm, xrefs: 00007FFE1150785E
csm, xrefs: 00007FFE1150793F

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: Frame$BlockEstablisherHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3606184308-393685449
Opcode ID: 06d3728c1fe3869259745ac4c5e6a0cb00fc75d00ae8fc1fa34a4fbaf183a18e
Instruction ID: 878fadacb6b06967065a0d309b32ad23372f440b7a46511cf66162bd4f59a878
Opcode Fuzzy Hash: 06d3728c1fe3869259745ac4c5e6a0cb00fc75d00ae8fc1fa34a4fbaf183a18e
Instruction Fuzzy Hash: BED17172A08F428AEB209FA6D4412AD77A8FB457A8F100179EE8D57B75DF3CE591C700

Function 00007FFE11504140 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,00000000,00007FFE1150427E,?,?,?,00007FFE1150463D,?,?,?,00007FFE1150215C), ref: 00007FFE1150414E
SetLastError.KERNEL32(?,?,?,?,00000000,00007FFE1150427E,?,?,?,00007FFE1150463D,?,?,?,00007FFE1150215C), ref: 00007FFE11504167
SetLastError.KERNEL32(?,?,?,?,00000000,00007FFE1150427E,?,?,?,00007FFE1150463D,?,?,?,00007FFE1150215C), ref: 00007FFE11504189
SetLastError.KERNEL32(?,?,?,?,00000000,00007FFE1150427E,?,?,?,00007FFE1150463D,?,?,?,00007FFE1150215C), ref: 00007FFE115041A5

Strings

.detour, xrefs: 00007FFE115041BC
Dtr, xrefs: 00007FFE1150420B

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: ErrorLast$HandleModule
String ID: .detour$Dtr
API String ID: 1090667551-1360480496
Opcode ID: 525fe6b1b2cddfa9d0ddd716b500ea8b7d1fd6ff01d5c97a3c603da605cd3077
Instruction ID: 97fd649a14323a6959dcec3d7ec54ece4c3ecc635c852ae75c9a293606e7046a
Opcode Fuzzy Hash: 525fe6b1b2cddfa9d0ddd716b500ea8b7d1fd6ff01d5c97a3c603da605cd3077
Instruction Fuzzy Hash: 5E31A031F0CD47D7EBA48BA2D41463C2AA9EB55B65F4541B9CA0A422F1EE3CE584C711

Function 00007FFE1150DED8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FFE1150E054
GetProcAddress.KERNEL32 ref: 00007FFE1150E060

Strings

ext-ms-, xrefs: 00007FFE1150DFB1
api-ms-, xrefs: 00007FFE1150DF9E

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 021fd238debe797a42248dafad0f7b6325df0aa8ae931348c9bf8a3dd3b1b969
Instruction ID: 94537b8ba02dfcb2ae3a80832e211805586d7186624fd33489e1fd535814e198
Opcode Fuzzy Hash: 021fd238debe797a42248dafad0f7b6325df0aa8ae931348c9bf8a3dd3b1b969
Instruction Fuzzy Hash: 5F41F221B19E1281EB16CB57A8206BE239ABF08BB0F18817DDD1D877B5EE3CE4059300

Function 00007FFE11507068 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFE11507227,?,?,?,00007FFE11506384,?,?,?,?,00007FFE11505CD9), ref: 00007FFE115070ED
GetLastError.KERNEL32(?,?,?,00007FFE11507227,?,?,?,00007FFE11506384,?,?,?,?,00007FFE11505CD9), ref: 00007FFE115070FB
LoadLibraryExW.KERNEL32(?,?,?,00007FFE11507227,?,?,?,00007FFE11506384,?,?,?,?,00007FFE11505CD9), ref: 00007FFE11507125
FreeLibrary.KERNEL32(?,?,?,00007FFE11507227,?,?,?,00007FFE11506384,?,?,?,?,00007FFE11505CD9), ref: 00007FFE1150716B
GetProcAddress.KERNEL32(?,?,?,00007FFE11507227,?,?,?,00007FFE11506384,?,?,?,?,00007FFE11505CD9), ref: 00007FFE11507177

Strings

api-ms-, xrefs: 00007FFE1150710D

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 9595c688d46539b0029f737ea7c98cea7b792a27edac32f2a73856f0b901c317
Instruction ID: bb75320945d752128a1fb0e3473ddc8641c5be3125894cdd8e1d3ad9dcff3578
Opcode Fuzzy Hash: 9595c688d46539b0029f737ea7c98cea7b792a27edac32f2a73856f0b901c317
Instruction Fuzzy Hash: 3931AD21B1AE4291EF56DB43A8106B922AEBF48BB0F590578DD5D0A3B0EF3CE4418340

Function 00007FFE11510BF8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFE11510C29
GetLastError.KERNEL32 ref: 00007FFE11510C35
CloseHandle.KERNEL32 ref: 00007FFE11510C4D
CreateFileW.KERNEL32 ref: 00007FFE11510C78
WriteConsoleW.KERNEL32 ref: 00007FFE11510C97

Strings

CONOUT$, xrefs: 00007FFE11510C59

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 9f93710af558f09a9892279fedac6daf20a1c9877a31ad6e89a14bce2994dbd4
Instruction ID: 6d59bbfd7c270342b0018c57ffc918a8b8a259dd501ac92d71b43781b4821048
Opcode Fuzzy Hash: 9f93710af558f09a9892279fedac6daf20a1c9877a31ad6e89a14bce2994dbd4
Instruction Fuzzy Hash: A411BB21B18F4286E7919B13E854329A7AAFB88BF4F104275EA1D877B5DF3CD8488700

Function 00007FFE1150B888 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,00007FFE1150A1ED,?,?,?,?,00007FFE1150BB50), ref: 00007FFE1150B897
FlsSetValue.KERNEL32(?,?,00000000,00007FFE1150A1ED,?,?,?,?,00007FFE1150BB50), ref: 00007FFE1150B8CD
FlsSetValue.KERNEL32(?,?,00000000,00007FFE1150A1ED,?,?,?,?,00007FFE1150BB50), ref: 00007FFE1150B8FA
FlsSetValue.KERNEL32(?,?,00000000,00007FFE1150A1ED,?,?,?,?,00007FFE1150BB50), ref: 00007FFE1150B90B
FlsSetValue.KERNEL32(?,?,00000000,00007FFE1150A1ED,?,?,?,?,00007FFE1150BB50), ref: 00007FFE1150B91C
SetLastError.KERNEL32(?,?,00000000,00007FFE1150A1ED,?,?,?,?,00007FFE1150BB50), ref: 00007FFE1150B937

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5712d5309adc982fc957e4a5394a015e28f1bd12a4f0ec68597790818cc231c7
Instruction ID: cbde8beb07c34fe180839e30c61944a884ddb3ed00175cf004be822bb87750f4
Opcode Fuzzy Hash: 5712d5309adc982fc957e4a5394a015e28f1bd12a4f0ec68597790818cc231c7
Instruction Fuzzy Hash: C8116028F0CE5242FB69ABB359D507D225A9F587B0F5847BDEC7E067F6DE2CA4024200

Function 00007FFE11508008 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFE11508030
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFE11508118
__std_exception_copy.LIBVCRUNTIME ref: 00007FFE11508264

Strings

csm, xrefs: 00007FFE11508052
csm, xrefs: 00007FFE1150816A

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
String ID: csm$csm
API String ID: 851805269-3733052814
Opcode ID: 9241c421326e447cd47d6f729757179164197b510e3a13c0456f9585d2c8a81a
Instruction ID: ba24e864396484f8c80207d86e97e1358759abb9f863e30e65eb2315be0d35d8
Opcode Fuzzy Hash: 9241c421326e447cd47d6f729757179164197b510e3a13c0456f9585d2c8a81a
Instruction Fuzzy Hash: 98618F32D08F4286EB248F92D45466C77A8FB55BA4F58417ADA8C47BB5CF3CE491C701

Function 00007FFE115090CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFE115090F1
GetProcAddress.KERNEL32 ref: 00007FFE11509107
FreeLibrary.KERNEL32 ref: 00007FFE1150912E

Strings

CorExitProcess, xrefs: 00007FFE11509100
mscoree.dll, xrefs: 00007FFE115090E8

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b02347b63891b87bf246745171a9137b88de9c8fc1f42791f7e12703f88cb520
Instruction ID: ac902bbd9c630a3a2bc4ea9ae0b969462be9ef13002ee2927d414ec16609c36e
Opcode Fuzzy Hash: b02347b63891b87bf246745171a9137b88de9c8fc1f42791f7e12703f88cb520
Instruction Fuzzy Hash: 5DF0CD61B1CE0281EB218B26E8583396779BF89BB0F5402BDCA6E452F4DF2CD048C300

Function 00007FFE1151131C Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFE11511344
_set_statfp.LIBCMT ref: 00007FFE1151135F
_set_statfp.LIBCMT ref: 00007FFE1151137B
_set_statfp.LIBCMT ref: 00007FFE115113B7

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 42c32d3acaf94be8bf6c9fa5576b7a947ae4a2e90c63d94789f449aabdcb8345
Instruction ID: e24a18dcf7bb0b87731bf7f14b5fc4c13789c0024c31d88f123bf021bd492ef2
Opcode Fuzzy Hash: 42c32d3acaf94be8bf6c9fa5576b7a947ae4a2e90c63d94789f449aabdcb8345
Instruction Fuzzy Hash: 77115E26E1CE0301F76A113AE5D63B9358B6F58370E0806F4E96E46AFEDE6CA8408644

Function 00007FFE1150B950 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFE11508A16,?,?,?,00007FFE11509BF7), ref: 00007FFE1150B96F
FlsSetValue.KERNEL32(?,?,?,00007FFE11508A16,?,?,?,00007FFE11509BF7), ref: 00007FFE1150B98E
FlsSetValue.KERNEL32(?,?,?,00007FFE11508A16,?,?,?,00007FFE11509BF7), ref: 00007FFE1150B9B6
FlsSetValue.KERNEL32(?,?,?,00007FFE11508A16,?,?,?,00007FFE11509BF7), ref: 00007FFE1150B9C7
FlsSetValue.KERNEL32(?,?,?,00007FFE11508A16,?,?,?,00007FFE11509BF7), ref: 00007FFE1150B9D8

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 66810da383b16041ac4f90909df8ff7a9f87a16cd65f4df93bff3abf34f73556
Instruction ID: 0dc75cae5c7e20d049ee5153a342a87b3b9ccf383b8d68ad50cfcd7e5b9726c5
Opcode Fuzzy Hash: 66810da383b16041ac4f90909df8ff7a9f87a16cd65f4df93bff3abf34f73556
Instruction Fuzzy Hash: F2114F28F08E4342FB59ABA799911BD614A9F543B0F184BBDE87D067F6DF2CA4414201

Function 00007FFE11507CB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFE11507CFC
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE11507D4B

Strings

MOC, xrefs: 00007FFE11507D10
RCC, xrefs: 00007FFE11507D19

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 898245a4e9ac5fcb2a92b3faea40d05d33a71a1af291c163c3876f26104ed544
Instruction ID: dc1e848c8cbb988f0b45989a7ffbb7d81f960d1fdc6678e5f6bad239eb55cf92
Opcode Fuzzy Hash: 898245a4e9ac5fcb2a92b3faea40d05d33a71a1af291c163c3876f26104ed544
Instruction Fuzzy Hash: 76512773A09E858AEB208FA6D4802AD77A4FB44B98F144169EE8D17B78DF3CE555C700

Function 00007FFE1150A3DC Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFE1150A45B
WriteFile.KERNEL32 ref: 00007FFE1150A723
WriteFile.KERNEL32 ref: 00007FFE1150A769
GetLastError.KERNEL32 ref: 00007FFE1150A81F

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ea2f9132f6d48a695c55c4ae9686dcec7304a04df8a6dc56de6e911d6adc0be8
Instruction ID: ac0e338566d76d1227bcfc029017f0ccc2df860a7dddb37e984ec6720ac15749
Opcode Fuzzy Hash: ea2f9132f6d48a695c55c4ae9686dcec7304a04df8a6dc56de6e911d6adc0be8
Instruction Fuzzy Hash: DED19032B18A8189E711CFA6D4402AC37B9FB547E8B144279CE5E97BB9DE3CD516C340

Function 00007FFE1150AD04 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?,00007FFE1150ACEF), ref: 00007FFE1150AE20
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?,00007FFE1150ACEF), ref: 00007FFE1150AEAB

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 70b4f0dda715ac8b7c46d9c9adf802532413323acc67bfa74d9044eab8bb075d
Instruction ID: 379e95d64ceb3cbb4f8afd0d97863d89f2b648a9920f4571e588957309ecb593
Opcode Fuzzy Hash: 70b4f0dda715ac8b7c46d9c9adf802532413323acc67bfa74d9044eab8bb075d
Instruction Fuzzy Hash: F791D672E18E5189F751DFA694402BD3BA9AB44BA8F14427DDE0E576B5DF3CD881C300

Function 00007FFE11504260 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?,?,?,00007FFE1150463D,?,?,?,00007FFE1150215C), ref: 00007FFE11504319
SetLastError.KERNEL32(?,?,?,00007FFE1150463D,?,?,?,00007FFE1150215C), ref: 00007FFE11504331
SetLastError.KERNEL32(?,?,?,00007FFE1150463D,?,?,?,00007FFE1150215C), ref: 00007FFE11504340

Strings

Dtr, xrefs: 00007FFE11504297

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: ErrorLast
String ID: Dtr
API String ID: 1452528299-2106216684
Opcode ID: f0267f2bb7e7edf3d30ea7b100ec0b05282f545f04cca291f4c47bc44467c1a4
Instruction ID: 772fb60c23e7c43445da44d1e771736c26c3a00ca79ae18e58d81fc4b1e63b07
Opcode Fuzzy Hash: f0267f2bb7e7edf3d30ea7b100ec0b05282f545f04cca291f4c47bc44467c1a4
Instruction Fuzzy Hash: 45319431E0CA82D6FB644BBA950427C7FE89B18775F4451BCC629061F5CE2CD9D08701

Function 00007FFE115020F0 Relevance: 6.0, APIs: 4, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE11502F50: GetCurrentThreadId.KERNEL32 ref: 00007FFE11502F61
Part of subcall function 00007FFE11502F50: VirtualProtect.KERNEL32(?,?,?,?,00007FFE11502095), ref: 00007FFE11502FC3

GetCurrentThread.KERNEL32 ref: 00007FFE115020FD

Part of subcall function 00007FFE11503600: GetCurrentThread.KERNEL32 ref: 00007FFE11503617

Part of subcall function 00007FFE11503A70: GetCurrentThreadId.KERNEL32 ref: 00007FFE11503A80

Part of subcall function 00007FFE11503010: GetCurrentThreadId.KERNEL32 ref: 00007FFE11503029

VirtualFree.KERNEL32 ref: 00007FFE1150213C
SetEvent.KERNEL32 ref: 00007FFE11502149
GetCurrentThread.KERNEL32 ref: 00007FFE11502161

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: CurrentThread$Virtual$EventFreeProtect
String ID:
API String ID: 3114980141-0
Opcode ID: a6d37546754540cac960b494684c5983a0f486765d434498aaeec168e2e9e9de
Instruction ID: b8ab59939490ac1801b485d7541b1c053d5edfae50c847a33dac63e9c8d2c763
Opcode Fuzzy Hash: a6d37546754540cac960b494684c5983a0f486765d434498aaeec168e2e9e9de
Instruction Fuzzy Hash: B901C855E1EE0385FB80EBE3E86627D526A6F487B0F4004B8D84E032B39E2CA1498741

Function 00007FFE11502010 Relevance: 6.0, APIs: 4, Instructions: 23windowsleepCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FFE11502035
TranslateMessage.USER32 ref: 00007FFE1150204B
DispatchMessageW.USER32 ref: 00007FFE11502056
Sleep.KERNEL32 ref: 00007FFE11502063

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslate
String ID:
API String ID: 3768732053-0
Opcode ID: 0395413088325337527c4fea6a51752cfaa5cbb19b32a1d120b66f6e5a3b3644
Instruction ID: 273faf2b1fa7fd3222a0b1923eaea8f88f4817a08cd1072ffb3f1c517264516e
Opcode Fuzzy Hash: 0395413088325337527c4fea6a51752cfaa5cbb19b32a1d120b66f6e5a3b3644
Instruction Fuzzy Hash: 46F0302292CA82D3E7A19B12E464A7E6A66FF94B64FC050B5E14F415B0CF3CD508DB00

Function 00007FFE11511FBC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__C_specific_handler.LIBVCRUNTIME ref: 00007FFE11511FCC

Part of subcall function 00007FFE11505A1C: __except_validate_context_record.LIBVCRUNTIME ref: 00007FFE11505A47
Part of subcall function 00007FFE11505A1C: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE11505ADC
Part of subcall function 00007FFE11505A1C: RtlUnwindEx.KERNEL32 ref: 00007FFE11505B2B

Strings

f, xrefs: 00007FFE11511FD1
csm, xrefs: 00007FFE11511FD7

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: C_specific_handlerCurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 3112662972-629598281
Opcode ID: e8dcb5c5d9ad2d1514f77f46448aa769a091e05a482fbfc692ed975bcc890757
Instruction ID: 59823c9e0b229ba99b5bdd9eaf13e824ff066d10238d5931af8e1b9bb9d3d59f
Opcode Fuzzy Hash: e8dcb5c5d9ad2d1514f77f46448aa769a091e05a482fbfc692ed975bcc890757
Instruction Fuzzy Hash: B231C6E2E18E8645EF624B6AD0806786397EF61BB4F7457B0CA5D072F1DF1DD882C200

Function 00007FFE1150AA74 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFE1150AB8B
GetLastError.KERNEL32 ref: 00007FFE1150ABAD

Strings

U, xrefs: 00007FFE1150AB37

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: c31127e09c37f873c947b8b3ca032fd4a57633eb6955ada51fddec5702fe77de
Instruction ID: a2a68443feab787fd26e1fd282d02b1c3a03f4b62ed4294744b4dc2521d25eea
Opcode Fuzzy Hash: c31127e09c37f873c947b8b3ca032fd4a57633eb6955ada51fddec5702fe77de
Instruction Fuzzy Hash: 8641AE22B18E8181EB609F66E4443AA77A5FB987A4F404275EE4E877A8DF7CD441C740

Function 00007FFE115060B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFE1150580B), ref: 00007FFE115060FC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFE1150580B), ref: 00007FFE11506142

Strings

csm, xrefs: 00007FFE1150612F

Memory Dump Source

Source File: 00000000.00000002.2933789667.00007FFE11501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000000.00000002.2933764440.00007FFE11500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933820544.00007FFE11513000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933848852.00007FFE1151F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933864769.00007FFE11521000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933889338.00007FFE11528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe11500000_loaddll64.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4985d7d09a7abd305dfa4f2fce599ff24cb257baee9f465fb6d6953927abce41
Instruction ID: d645b2bebf74d5017a0ec99276f89be5a0a593269229353a8d4650d70a598cf0
Opcode Fuzzy Hash: 4985d7d09a7abd305dfa4f2fce599ff24cb257baee9f465fb6d6953927abce41
Instruction Fuzzy Hash: 8E113A32608F8182EB618B16E44026977A9FB88BA4F284274DF8D07B79DF3CD551CB00

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Sec_847e5933c7b68f10fff588c9d4be4118d8c5e594_a132e67f_5dfd797d-ff43-4b78-8031-391bd555f2ca\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Sec_84dfe926c8a473f70df6ff9eee142b124f3fe79_a132e67f_0cdc4759-0de7-40f8-8c28-aa5cc0333853\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Sec_84dfe926c8a473f70df6ff9eee142b124f3fe79_a132e67f_23825486-2bbf-45fb-9b0a-6d8c1a4fbf60\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Sec_84dfe926c8a473f70df6ff9eee142b124f3fe79_a132e67f_dea66e8e-942f-4a31-bba4-c04961d93161\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1718.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1787.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER17A6.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1805.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A28.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A67.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2215.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23AC.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23DC.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DFC.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F26.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F55.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
SecuriteInfo.com.Win32.Trojan.Kryptik.DQOJJU.32487.4625.dll