Edit tour

Windows Analysis Report
gpufault.dll.dll

Overview

General Information

Sample name:	gpufault.dll.dll (renamed file extension from exe to dll)
Original sample name:	gpufault.dll.exe
Analysis ID:	1578369
MD5:	72462ae450bb675eae4ec1ba6bcb8305
SHA1:	c14355446cdc6786e9ef69180fc699d8cc17aecd
SHA256:	1bcf12604f49243fbb260f7e52b485fef7e215c5462e63ba2106bcbb7f68e3fa
Tags:	exeuser-pr0xylife
Infos:

Detection

BruteRatel

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected BruteRatel

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Modifies the context of a thread in another process (thread injection)

Sets debug register (to hijack the execution of another thread)

Sigma detected: RunDLL32 Spawning Explorer

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7312 cmdline: loaddll64.exe "C:\Users\user\Desktop\gpufault.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7400 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7424 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7568 cmdline: C:\Windows\system32\WerFault.exe -u -p 7424 -s 496 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7408 cmdline: rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,DllMain MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7576 cmdline: C:\Windows\system32\WerFault.exe -u -p 7408 -s 488 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7632 cmdline: rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,GfeXcodeFunc MD5: EF3179D498793BF4234F708D3BE28633)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

rundll32.exe (PID: 7700 cmdline: rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,GfeXcodeFuncEx MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7764 cmdline: C:\Windows\system32\WerFault.exe -u -p 7700 -s 492 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7932 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",DllMain MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7940 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeFunc MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7952 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeFuncEx MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7968 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NvOptimusEnablementCuda MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 6784 cmdline: C:\Windows\system32\WerFault.exe -u -p 7968 -s 496 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7980 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_Shutdown MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7988 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_ReleaseFeature MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7996 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_Init MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8012 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_GetScratchBufferSize MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8052 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_GetParameters MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8060 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_EvaluateFeature MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8068 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_CreateFeature MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8076 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeMontage MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8096 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeImageEx MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8104 cmdline: rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeImage MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Brute Ratel C4, BruteRatel	Brute Ratel C4 (BRC4) is a commercial framework for red-teaming and adversarial attack simulation, which made its first appearance in December 2020. It was specifically designed to evade detection by endpoint detection and response (EDR) and antivirus (AV) capabilities. BRC4 allows operators to deploy a backdoor agent known as Badger (aka BOLDBADGER) within a target environment.This agent enables arbitrary command execution, facilitating lateral movement, privilege escalation, and the establishment of additional persistence avenues. The Badger backdoor agent can communicate with a remote server via DNS over HTTPS, HTTP, HTTPS, SMB, and TCP, using custom encrypted channels. It supports a variety of backdoor commands including shell command execution, file transfers, file execution, and credential harvesting. Additionally, the Badger agent can perform tasks such as port scanning, screenshot capturing, and keystroke logging. Notably, in September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.	No Attribution	https://0xdarkvortex.dev/hiding-in-plainsight/ https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/ https://andreafortuna.org/2023/02/23/how-to-detect-brute-ratel-activities https://blog.krakz.fr/articles/latrodectus/ https://blog.reveng.ai/latrodectus-distribution-via-brc4/	https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000010.00000002.3479968792.00000260C38BC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
0000000B.00000002.3478193493.00000207037A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
0000000B.00000002.3477789509.000002070365C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000010.00000002.3479968792.00000260C392C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000010.00000003.3412211804.00000260C37DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
0000000B.00000002.3477789509.0000020703704000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000010.00000002.3479757956.00000260C37AC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 7632	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 7940	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: RunDLL32 Spawning Explorer

Source: Process started

Author: elhoim, CD_ROM_: Data: Command: C:\Windows\Explorer.EXE, CommandLine: C:\Windows\Explorer.EXE, CommandLine|base64offset|contains: , Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,GfeXcodeFunc, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7632, ParentProcessName: rundll32.exe, ProcessCommandLine: C:\Windows\Explorer.EXE, ProcessId: 1028, ProcessName: explorer.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: gpufault.dll.dll

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Source: gpufault.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source:	Binary string: C:\dvs\p4\build\sw\rel\gfclient\rel_03&3!ZxZQ9rbTQA!n8N>7T3de\GfeXCode\win7_amd64_release\GfeXCode64.pdb source: rundll32.exe, 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2383872587.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3480190804.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2383576702.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2381287077.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.3480884922.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2374550913.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2433732268.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2377836699.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2375651734.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2378915632.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2367865472.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, gpufault.dll.dll
Source:	Binary string: de\GfeXCode\win7_amd64_release\GfeXCode64.pdb source: rundll32.exe, 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2383872587.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3480190804.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2383576702.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2381287077.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.3480884922.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2374550913.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2433732268.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2377836699.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2375651734.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2378915632.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2367865472.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, gpufault.dll.dll

Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86856A0 FindFirstFileExW,		4_2_00007FF8A86856A0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF12BB0 FindFirstFileW,CreateFileW,SystemTimeToTzSpecificLocalTime,CreateFileW,SystemTimeToTzSpecificLocalTime,FindNextFileW,		11_2_000002077FF12BB0

Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_gpu_2cb5eecfada0578fd925b8fb75f122dc2c902f5e_790b1338_4a6e8b3f-d00d-4ffe-b52c-7069997444b1\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_59ea469c9cde70e5cc5fc8dc983f2f16bebbf3_85207d7d_99f64cc5-220c-40a6-a443-ae1f0170b272\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.46.11 8817			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.40.41 8817			Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.5:49756 -> 94.232.40.41:8817
Source: global traffic	TCP traffic: 192.168.2.5:49904 -> 94.232.46.11:8817

Source: Joe Sandbox View	IP Address: 94.232.46.11 94.232.46.11
Source: Joe Sandbox View	IP Address: 94.232.40.41 94.232.40.41

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: muuxxu.com
Source: global traffic	DNS traffic detected: DNS query: cronoze.com

Source: explorer.exe, 00000027.00000002.3483451712.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000027.00000000.3142664172.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3475320833.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: explorer.exe, 00000027.00000002.3483451712.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000027.00000002.3483451712.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000027.00000002.3483451712.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000027.00000002.3483451712.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: rundll32.exe, 0000000B.00000003.3137981944.000002077FB30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138142453.000002077FB32000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3479115762.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3172595213.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFBA5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411892440.00000260BFBA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.2
Source: rundll32.exe, 0000000B.00000003.3137981944.000002077FB30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138142453.000002077FB32000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3479115762.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3172595213.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFBA5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411892440.00000260BFBA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: explorer.exe, 00000027.00000002.3482760380.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000027.00000002.3482706289.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000027.00000002.3481832203.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: Amcache.hve.10.dr	String found in binary or memory: http://upx.sf.net
Source: rundll32.exe, 00000010.00000002.3477075468.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.le
Source: rundll32.exe, 0000000B.00000003.3137981944.000002077FB30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138142453.000002077FB32000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3479115762.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3172595213.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFBA5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411892440.00000260BFBA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: rundll32.exe, 0000000B.00000003.3137981944.000002077FB30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138142453.000002077FB32000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3479115762.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3172595213.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFBA5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411892440.00000260BFBA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: explorer.exe, 00000027.00000002.3491179741.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3162188864.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000027.00000000.3156801722.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3480242871.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000027.00000000.3159058846.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000027.00000002.3480242871.0000000007637000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3156801722.0000000007637000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000027.00000000.3153606270.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3478004014.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: rundll32.exe, 00000010.00000003.2712641891.00000260BFB3A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com/
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com/%
Source: rundll32.exe, 00000010.00000003.2712641891.00000260BFB3A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com/e
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com/y
Source: rundll32.exe, 0000000B.00000002.3478798849.000002077FA6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com:8817/
Source: rundll32.exe, 00000010.00000003.2712641891.00000260BFB3A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2712641891.00000260BFB1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com:8817/intel.php
Source: rundll32.exe, 00000010.00000003.2712641891.00000260BFB3A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com:8817/intel.phpn
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB57000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com:8817/pentium.php
Source: rundll32.exe, 00000010.00000003.3411915498.00000260BFB56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com:8817/pentium.php.
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com:8817/pentium.phpB
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com:8817/pentium.phpu
Source: rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com:8817/pentium.phpz
Source: explorer.exe, 00000027.00000002.3487535607.000000000AF1D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/test/
Source: explorer.exe, 00000027.00000002.3487535607.000000000AF1D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/test/t/
Source: explorer.exe, 00000027.00000000.3159058846.0000000009B95000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009B95000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com/
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com/1
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com/n
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com:8817/intel.phpP
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com:8817/intel.phpm
Source: rundll32.exe, 0000000B.00000002.3478798849.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com:8817/pentium.php
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com:8817/pentium.php;
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com:8817/pentium.phpu
Source: explorer.exe, 00000027.00000000.3159058846.0000000009B95000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009D42000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000027.00000002.3491179741.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000027.00000002.3483451712.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 00000027.00000002.3483451712.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon

Source: C:\Windows\System32\rundll32.exe	Code function: 11_3_000002070328D2E0 NtProtectVirtualMemory,	11_3_000002070328D2E0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_3_000002070328D270 NtAllocateVirtualMemory,	11_3_000002070328D270
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF24FF0 NtQueueApcThread,	11_2_000002077FF24FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF24BE0 NtProtectVirtualMemory,	11_2_000002077FF24BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FEF17B0 NtClose,	11_2_000002077FEF17B0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF0F3A0 CreateToolhelp32Snapshot,Thread32First,NtSuspendThread,NtResumeThread,Thread32Next,NtClose,	11_2_000002077FF0F3A0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF24360 NtCreateThreadEx,	11_2_000002077FF24360
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF24740 NtFreeVirtualMemory,	11_2_000002077FF24740
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF23F40 NtAllocateVirtualMemory,	11_2_000002077FF23F40
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF17AE0 CreateToolhelp32Snapshot,Process32FirstW,GetTokenInformation,GetTokenInformation,LookupAccountSidW,K32GetProcessImageFileNameW,NtClose,NtClose,Process32NextW,	11_2_000002077FF17AE0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF07A50 NtSetContextThread,	11_2_000002077FF07A50
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF245F0 NtDuplicateObject,	11_2_000002077FF245F0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FEF71B0 NtClose,	11_2_000002077FEF71B0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF055C0 NtClose,NtTerminateThread,	11_2_000002077FF055C0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF251C0 NtReadVirtualMemory,	11_2_000002077FF251C0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF08149 NtSetContextThread,	11_2_000002077FF08149

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004437C	0_2_000000018004437C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180037788	0_2_0000000180037788
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800147EC	0_2_00000001800147EC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002600C	0_2_000000018002600C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002A01C	0_2_000000018002A01C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019020	0_2_0000000180019020
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180047834	0_2_0000000180047834
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180013078	0_2_0000000180013078
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003D08C	0_2_000000018003D08C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180026890	0_2_0000000180026890
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800158A0	0_2_00000001800158A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800330A8	0_2_00000001800330A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003A904	0_2_000000018003A904
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003D91C	0_2_000000018003D91C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B924	0_2_000000018001B924
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B138	0_2_000000018001B138
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003713C	0_2_000000018003713C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800329B4	0_2_00000001800329B4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800279B8	0_2_00000001800279B8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180042A10	0_2_0000000180042A10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180045A60	0_2_0000000180045A60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180033278	0_2_0000000180033278
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F28C	0_2_000000018001F28C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003B294	0_2_000000018003B294
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001FA9C	0_2_000000018001FA9C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800462C4	0_2_00000001800462C4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000A314	0_2_000000018000A314
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180013BA0	0_2_0000000180013BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800193F0	0_2_00000001800193F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800423EC	0_2_00000001800423EC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001A47C	0_2_000000018001A47C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003B508	0_2_000000018003B508
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180012550	0_2_0000000180012550
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003A554	0_2_000000018003A554
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180008D6C	0_2_0000000180008D6C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180029D90	0_2_0000000180029D90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180032E14	0_2_0000000180032E14
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004363C	0_2_000000018004363C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180048E5A	0_2_0000000180048E5A
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180036E70	0_2_0000000180036E70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180015EA0	0_2_0000000180015EA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800176E4	0_2_00000001800176E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003E704	0_2_000000018003E704
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016744	0_2_0000000180016744
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002FF50	0_2_000000018002FF50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180024F60	0_2_0000000180024F60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000AF74	0_2_000000018000AF74
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800097A8	0_2_00000001800097A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800197C0	0_2_00000001800197C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D71C4DC	0_2_0000014F6D71C4DC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D70AD64	0_2_0000014F6D70AD64
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6E9D40	0_2_0000014F6D6E9D40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6F3524	0_2_0000014F6D6F3524
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6F4B74	0_2_0000014F6D6F4B74
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6FB450	0_2_0000014F6D6FB450
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6F6E74	0_2_0000014F6D6F6E74
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6EBF48	0_2_0000014F6D6EBF48
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D717E44	0_2_0000014F6D717E44
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6F6874	0_2_0000014F6D6F6874
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D71407C	0_2_0000014F6D71407C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D706FE0	0_2_0000014F6D706FE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6F57C0	0_2_0000014F6D6F57C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6FA794	0_2_0000014F6D6FA794
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6EA77C	0_2_0000014F6D6EA77C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D71E060	0_2_0000014F6D71E060
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6F404C	0_2_0000014F6D6F404C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D70AFF0	0_2_0000014F6D70AFF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6EB2E8	0_2_0000014F6D6EB2E8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D7239E4	0_2_0000014F6D7239E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D71C268	0_2_0000014F6D71C268
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A869A4C0	4_2_00007FF8A869A4C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A869AA30	4_2_00007FF8A869AA30
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868AF90	4_2_00007FF8A868AF90
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A87A2E50	4_2_00007FF8A87A2E50
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A869A100	4_2_00007FF8A869A100
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A869A250	4_2_00007FF8A869A250
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8684BE0	4_2_00007FF8A8684BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A869A360	4_2_00007FF8A869A360
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A869A3C0	4_2_00007FF8A869A3C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A869A6E0	4_2_00007FF8A869A6E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A869A8A0	4_2_00007FF8A869A8A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86842A0	4_2_00007FF8A86842A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868C7B0	4_2_00007FF8A868C7B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8688300	4_2_00007FF8A8688300
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86842A0	4_2_00007FF8A86842A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86842A0	4_2_00007FF8A86842A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8688300	4_2_00007FF8A8688300
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8688CC0	4_2_00007FF8A8688CC0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8688CC0	4_2_00007FF8A8688CC0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8688300	4_2_00007FF8A8688300
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A87938E0	4_2_00007FF8A87938E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682920	4_2_00007FF8A8682920
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86842A0	4_2_00007FF8A86842A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86840B0	4_2_00007FF8A86840B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86855B0	4_2_00007FF8A86855B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8681D60	4_2_00007FF8A8681D60
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683050	4_2_00007FF8A8683050
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8687020	4_2_00007FF8A8687020
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A87C8150	4_2_00007FF8A87C8150
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868E590	4_2_00007FF8A868E590
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A87B03E0	4_2_00007FF8A87B03E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868F5C0	4_2_00007FF8A868F5C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868D0C0	4_2_00007FF8A868D0C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8693970	4_2_00007FF8A8693970
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86954B0	4_2_00007FF8A86954B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868EB00	4_2_00007FF8A868EB00
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868FAC0	4_2_00007FF8A868FAC0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683870	4_2_00007FF8A8683870
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8684BE0	4_2_00007FF8A8684BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683870	4_2_00007FF8A8683870
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A87920B0	4_2_00007FF8A87920B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683870	4_2_00007FF8A8683870
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A869A0A0	4_2_00007FF8A869A0A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8687780	4_2_00007FF8A8687780
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A88A91F8	4_2_00007FF8A88A91F8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86945D0	4_2_00007FF8A86945D0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868CA50	4_2_00007FF8A868CA50
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A87A1410	4_2_00007FF8A87A1410
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868D4C0	4_2_00007FF8A868D4C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86918D0	4_2_00007FF8A86918D0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8681D70	4_2_00007FF8A8681D70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683790	4_2_00007FF8A8683790
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683C80	4_2_00007FF8A8683C80
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868F860	4_2_00007FF8A868F860
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868DAB0	4_2_00007FF8A868DAB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8687F10	4_2_00007FF8A8687F10
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8695890	4_2_00007FF8A8695890
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86818B0	4_2_00007FF8A86818B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8684F20	4_2_00007FF8A8684F20
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868B010	4_2_00007FF8A868B010
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868E680	4_2_00007FF8A868E680
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868E680	4_2_00007FF8A868E680
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86859E0	4_2_00007FF8A86859E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86964E0	4_2_00007FF8A86964E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683790	4_2_00007FF8A8683790
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86838E0	4_2_00007FF8A86838E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A88B78A4	4_2_00007FF8A88B78A4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868B780	4_2_00007FF8A868B780
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8685160	4_2_00007FF8A8685160
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683830	4_2_00007FF8A8683830
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86855E0	4_2_00007FF8A86855E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868B090	4_2_00007FF8A868B090
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86888B0	4_2_00007FF8A86888B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8685160	4_2_00007FF8A8685160
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86960E0	4_2_00007FF8A86960E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868C930	4_2_00007FF8A868C930
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A87AC200	4_2_00007FF8A87AC200
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86960E0	4_2_00007FF8A86960E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86857B0	4_2_00007FF8A86857B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8681710	4_2_00007FF8A8681710
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86876B0	4_2_00007FF8A86876B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683450	4_2_00007FF8A8683450
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683450	4_2_00007FF8A8683450
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8681AA0	4_2_00007FF8A8681AA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683450	4_2_00007FF8A8683450
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8682210	4_2_00007FF8A8682210
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A8683450	4_2_00007FF8A8683450
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018004437C	4_2_000000018004437C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180037788	4_2_0000000180037788
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800147EC	4_2_00000001800147EC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180008D6C	4_2_0000000180008D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180048E5A	4_2_0000000180048E5A
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180024F60	4_2_0000000180024F60
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180019020	4_2_0000000180019020
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003D08C	4_2_000000018003D08C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800193F0	4_2_00000001800193F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800097A8	4_2_00000001800097A8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800197C0	4_2_00000001800197C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800158A0	4_2_00000001800158A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003D91C	4_2_000000018003D91C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180045A60	4_2_0000000180045A60
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180029D90	4_2_0000000180029D90
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180015EA0	4_2_0000000180015EA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018002600C	4_2_000000018002600C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018002A01C	4_2_000000018002A01C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800462C4	4_2_00000001800462C4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000A314	4_2_000000018000A314
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800423EC	4_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001A47C	4_2_000000018001A47C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180012550	4_2_0000000180012550
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003A554	4_2_000000018003A554
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003E704	4_2_000000018003E704
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180016744	4_2_0000000180016744
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180026890	4_2_0000000180026890
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003A904	4_2_000000018003A904
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800329B4	4_2_00000001800329B4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180042A10	4_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180032E14	4_2_0000000180032E14
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180036E70	4_2_0000000180036E70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000AF74	4_2_000000018000AF74
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180013078	4_2_0000000180013078
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800330A8	4_2_00000001800330A8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001B138	4_2_000000018001B138
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003713C	4_2_000000018003713C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180033278	4_2_0000000180033278
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001F28C	4_2_000000018001F28C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003B294	4_2_000000018003B294
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003B508	4_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018004363C	4_2_000000018004363C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800176E4	4_2_00000001800176E4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180047834	4_2_0000000180047834
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001B924	4_2_000000018001B924
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800279B8	4_2_00000001800279B8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001FA9C	4_2_000000018001FA9C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180013BA0	4_2_0000000180013BA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018002FF50	4_2_000000018002FF50
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABE57C0	4_2_000002CA6ABE57C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABE4B74	4_2_000002CA6ABE4B74
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABE6874	4_2_000002CA6ABE6874
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABEA794	4_2_000002CA6ABEA794
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABDA77C	4_2_000002CA6ABDA77C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABD9D40	4_2_000002CA6ABD9D40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6AC0E060	4_2_000002CA6AC0E060
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABEB450	4_2_000002CA6ABEB450
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABE3524	4_2_000002CA6ABE3524
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABDB2E8	4_2_000002CA6ABDB2E8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABFAD64	4_2_000002CA6ABFAD64
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABFAFF0	4_2_000002CA6ABFAFF0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018004437C	5_2_000000018004437C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180037788	5_2_0000000180037788
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000001800147EC	5_2_00000001800147EC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018002600C	5_2_000000018002600C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018002A01C	5_2_000000018002A01C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180019020	5_2_0000000180019020
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180047834	5_2_0000000180047834
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180013078	5_2_0000000180013078
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018003D08C	5_2_000000018003D08C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180026890	5_2_0000000180026890
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000001800158A0	5_2_00000001800158A0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000001800330A8	5_2_00000001800330A8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018003A904	5_2_000000018003A904
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018003D91C	5_2_000000018003D91C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018001B924	5_2_000000018001B924
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018001B138	5_2_000000018001B138
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018003713C	5_2_000000018003713C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000001800329B4	5_2_00000001800329B4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000001800279B8	5_2_00000001800279B8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180042A10	5_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180045A60	5_2_0000000180045A60
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180033278	5_2_0000000180033278
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018001F28C	5_2_000000018001F28C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018003B294	5_2_000000018003B294
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018001FA9C	5_2_000000018001FA9C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000001800462C4	5_2_00000001800462C4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018000A314	5_2_000000018000A314
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180013BA0	5_2_0000000180013BA0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000001800193F0	5_2_00000001800193F0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000001800423EC	5_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018001A47C	5_2_000000018001A47C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018003B508	5_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180012550	5_2_0000000180012550
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018003A554	5_2_000000018003A554
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180008D6C	5_2_0000000180008D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180029D90	5_2_0000000180029D90
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180032E14	5_2_0000000180032E14
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018004363C	5_2_000000018004363C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180048E5A	5_2_0000000180048E5A
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180036E70	5_2_0000000180036E70
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180015EA0	5_2_0000000180015EA0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000001800176E4	5_2_00000001800176E4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018003E704	5_2_000000018003E704
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180016744	5_2_0000000180016744
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018002FF50	5_2_000000018002FF50
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180024F60	5_2_0000000180024F60
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018000AF74	5_2_000000018000AF74
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000001800097A8	5_2_00000001800097A8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000001800197C0	5_2_00000001800197C0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B8BF48	5_2_00000214B7B8BF48
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B8A77C	5_2_00000214B7B8A77C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7BB7E44	5_2_00000214B7BB7E44
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B96E74	5_2_00000214B7B96E74
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B89D40	5_2_00000214B7B89D40
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B93524	5_2_00000214B7B93524
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7BAAD64	5_2_00000214B7BAAD64
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7BBC4DC	5_2_00000214B7BBC4DC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B9B450	5_2_00000214B7B9B450
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B94B74	5_2_00000214B7B94B74
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B8B2E8	5_2_00000214B7B8B2E8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7BBC268	5_2_00000214B7BBC268
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7BC39E4	5_2_00000214B7BC39E4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B9404C	5_2_00000214B7B9404C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7BB407C	5_2_00000214B7BB407C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B96874	5_2_00000214B7B96874
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7BBE060	5_2_00000214B7BBE060
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B957C0	5_2_00000214B7B957C0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B9A794	5_2_00000214B7B9A794
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7BAAFF0	5_2_00000214B7BAAFF0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7BA6FE0	5_2_00000214B7BA6FE0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018004437C	11_2_000000018004437C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180037788	11_2_0000000180037788
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000001800147EC	11_2_00000001800147EC
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018002600C	11_2_000000018002600C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018002A01C	11_2_000000018002A01C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180019020	11_2_0000000180019020
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180047834	11_2_0000000180047834
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180013078	11_2_0000000180013078
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018003D08C	11_2_000000018003D08C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180026890	11_2_0000000180026890
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000001800158A0	11_2_00000001800158A0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000001800330A8	11_2_00000001800330A8
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018003A904	11_2_000000018003A904
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018003D91C	11_2_000000018003D91C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018001B924	11_2_000000018001B924
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018001B138	11_2_000000018001B138
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018003713C	11_2_000000018003713C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000001800329B4	11_2_00000001800329B4
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000001800279B8	11_2_00000001800279B8
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180042A10	11_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180045A60	11_2_0000000180045A60
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180033278	11_2_0000000180033278
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018001F28C	11_2_000000018001F28C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018003B294	11_2_000000018003B294
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018001FA9C	11_2_000000018001FA9C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000001800462C4	11_2_00000001800462C4
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018000A314	11_2_000000018000A314
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180013BA0	11_2_0000000180013BA0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000001800193F0	11_2_00000001800193F0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000001800423EC	11_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018001A47C	11_2_000000018001A47C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018003B508	11_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180012550	11_2_0000000180012550
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018003A554	11_2_000000018003A554
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180008D6C	11_2_0000000180008D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180029D90	11_2_0000000180029D90
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180032E14	11_2_0000000180032E14
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018004363C	11_2_000000018004363C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180048E5A	11_2_0000000180048E5A
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180036E70	11_2_0000000180036E70
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180015EA0	11_2_0000000180015EA0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000001800176E4	11_2_00000001800176E4
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018003E704	11_2_000000018003E704
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180016744	11_2_0000000180016744
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018002FF50	11_2_000000018002FF50
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180024F60	11_2_0000000180024F60
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018000AF74	11_2_000000018000AF74
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000001800097A8	11_2_00000001800097A8
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000001800197C0	11_2_00000001800197C0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070144C268	11_2_000002070144C268
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070141B2E8	11_2_000002070141B2E8
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000207014539E4	11_2_00000207014539E4
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070142B450	11_2_000002070142B450
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000020701423524	11_2_0000020701423524
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070144C4DC	11_2_000002070144C4DC
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000020701424B74	11_2_0000020701424B74
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000020701426E74	11_2_0000020701426E74
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000020701447E44	11_2_0000020701447E44
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000020701419D40	11_2_0000020701419D40
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070143AD64	11_2_000002070143AD64
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000020701426874	11_2_0000020701426874
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070144407C	11_2_000002070144407C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070142404C	11_2_000002070142404C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070144E060	11_2_000002070144E060
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070141A77C	11_2_000002070141A77C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070142A794	11_2_000002070142A794
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070141BF48	11_2_000002070141BF48
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002070143AFF0	11_2_000002070143AFF0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00000207014257C0	11_2_00000207014257C0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000020701436FE0	11_2_0000020701436FE0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF12BB0	11_2_000002077FF12BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF055C0	11_2_000002077FF055C0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF09120	11_2_000002077FF09120
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF0A100	11_2_000002077FF0A100
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FEF9500	11_2_000002077FEF9500
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF0B4E0	11_2_000002077FF0B4E0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF21490	11_2_000002077FF21490
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF22820	11_2_000002077FF22820
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF0CBE0	11_2_000002077FF0CBE0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF1FBC0	11_2_000002077FF1FBC0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF113A3	11_2_000002077FF113A3
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF22F60	11_2_000002077FF22F60
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FEFA730	11_2_000002077FEFA730
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF21F40	11_2_000002077FF21F40
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF166E0	11_2_000002077FF166E0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF0BED0	11_2_000002077FF0BED0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FEF66C0	11_2_000002077FEF66C0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF182A0	11_2_000002077FF182A0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF016A0	11_2_000002077FF016A0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF042A0	11_2_000002077FF042A0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF17220	11_2_000002077FF17220
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF20210	11_2_000002077FF20210
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FEF99D0	11_2_000002077FEF99D0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF1B5E0	11_2_000002077FF1B5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF155E0	11_2_000002077FF155E0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF04DB0	11_2_000002077FF04DB0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FEF5D60	11_2_000002077FEF5D60
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF14550	11_2_000002077FF14550

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000000180007B54 appears 51 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000000018002CC54 appears 117 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00000001800389F4 appears 48 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A86ACF20 appears 62 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A86AA4B0 appears 324 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A89B0390 appears 72 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A8690370 appears 32 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A86ABAB0 appears 196 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000000180007B1C appears 114 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00000001800020F0 appears 42 times
Source: C:\Windows\System32\loaddll64.exe	Code function: String function: 0000000180007B1C appears 38 times
Source: C:\Windows\System32\loaddll64.exe	Code function: String function: 000000018002CC54 appears 39 times

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7424 -s 496

Source: gpufault.dll.dll

Static PE information: Number of sections : 12 > 10

Source: gpufault.dll.dll

Binary or memory string: OriginalFilenameGfeXCode.dll` vs gpufault.dll.dll

Source: classification engine

Classification label: mal100.troj.evad.winDLL@44/18@7/2

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8A8691180 FreeLibrary,FreeLibrary,GetModuleFileNameW,GetLastError,FormatMessageW,

4_2_00007FF8A8691180

Source: C:\Windows\System32\rundll32.exe

Code function: 11_3_00007DF410EF0000 CreateToolhelp32Snapshot,Process32First,Process32Next,

11_3_00007DF410EF0000

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8A868CA80 CoCreateInstance,

4_2_00007FF8A868CA80

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\user\NTUSER.DAT.Not

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7408
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7424
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7700
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7320:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7968

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9c383dc9-dcc8-4145-b10c-8f6b72cc2cc8

Jump to behavior

Source: gpufault.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,DllMain

Source: gpufault.dll.dll

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\gpufault.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,DllMain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7424 -s 496
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7408 -s 488
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,GfeXcodeFunc
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,GfeXcodeFuncEx
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7700 -s 492
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",DllMain
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeFunc
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeFuncEx
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NvOptimusEnablementCuda
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_Shutdown
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_ReleaseFeature
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_Init
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_GetScratchBufferSize
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_GetParameters
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_EvaluateFeature
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_CreateFeature
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeMontage
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeImageEx
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeImage
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7968 -s 496
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,DllMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,GfeXcodeFunc	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,GfeXcodeFuncEx	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",DllMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeFunc	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeFuncEx	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NvOptimusEnablementCuda	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_Shutdown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_ReleaseFeature	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_Init	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_GetScratchBufferSize	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_GetParameters	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_EvaluateFeature	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_CreateFeature	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeMontage	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeImageEx	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeImage	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsrole.dll

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: gpufault.dll.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: gpufault.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: gpufault.dll.dll

Static file information: File size 3954176 > 1048576

Source: gpufault.dll.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x251200

Source: gpufault.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: gpufault.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: gpufault.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: gpufault.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: gpufault.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: gpufault.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: gpufault.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source: gpufault.dll.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\dvs\p4\build\sw\rel\gfclient\rel_03&3!ZxZQ9rbTQA!n8N>7T3de\GfeXCode\win7_amd64_release\GfeXCode64.pdb source: rundll32.exe, 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2383872587.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3480190804.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2383576702.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2381287077.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.3480884922.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2374550913.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2433732268.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2377836699.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2375651734.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2378915632.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2367865472.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, gpufault.dll.dll
Source:	Binary string: de\GfeXCode\win7_amd64_release\GfeXCode64.pdb source: rundll32.exe, 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2383872587.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3480190804.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2383576702.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2381287077.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.3480884922.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2374550913.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2433732268.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2377836699.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2375651734.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2378915632.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2367865472.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmp, gpufault.dll.dll

Source: gpufault.dll.dll

Static PE information: real checksum: 0x32b556 should be: 0x3d4d56

Source: gpufault.dll.dll	Static PE information: section name: .giats
Source: gpufault.dll.dll	Static PE information: section name: minATL
Source: gpufault.dll.dll	Static PE information: section name: .00cfg

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002CF10 push rsp; iretd	0_2_000000018002CF11
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000014F6D6F8D98 push ebp; iretd	0_2_0000014F6D6F8D9C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018002CF10 push rsp; iretd	4_2_000000018002CF11
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002CA6ABE8D98 push ebp; iretd	4_2_000002CA6ABE8D9C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000000018002CF10 push rsp; iretd	5_2_000000018002CF11
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000214B7B98D98 push ebp; iretd	5_2_00000214B7B98D9C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000000018002CF10 push rsp; iretd	11_2_000000018002CF11
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000020701428D98 push ebp; iretd	11_2_0000020701428D9C

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00000001800329B4 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00000001800329B4

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\rundll32.exe

Code function: GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,

11_2_000002077FF14D00

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 682
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 657

Source: C:\Windows\System32\rundll32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\System32\loaddll64.exe	API coverage: 7.6 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 1.1 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 7.7 %

Source: C:\Windows\System32\loaddll64.exe TID: 7316

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A86856A0 FindFirstFileExW,		4_2_00007FF8A86856A0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_000002077FF12BB0 FindFirstFileW,CreateFileW,SystemTimeToTzSpecificLocalTime,CreateFileW,SystemTimeToTzSpecificLocalTime,FindNextFileW,		11_2_000002077FF12BB0

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8A868D230 GetSystemInfo,

4_2_00007FF8A868D230

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_gpu_2cb5eecfada0578fd925b8fb75f122dc2c902f5e_790b1338_4a6e8b3f-d00d-4ffe-b52c-7069997444b1\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_59ea469c9cde70e5cc5fc8dc983f2f16bebbf3_85207d7d_99f64cc5-220c-40a6-a443-ae1f0170b272\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior

Source: explorer.exe, 00000027.00000002.3480242871.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: explorer.exe, 00000027.00000000.3159058846.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: explorer.exe, 00000027.00000002.3483451712.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000027.00000002.3475320833.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: rundll32.exe, 00000010.00000003.2712641891.00000260BFB65000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB65000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%
Source: rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FA6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2712641891.00000260BFB65000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFAD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB65000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB65000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: explorer.exe, 00000027.00000002.3483451712.0000000009B95000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: explorer.exe, 00000027.00000002.3483451712.0000000009B95000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: explorer.exe, 00000027.00000002.3483451712.0000000009B95000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: explorer.exe, 00000027.00000002.3483451712.0000000009B95000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000027.00000002.3478004014.0000000003554000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: explorer.exe, 00000027.00000002.3480242871.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: explorer.exe, 00000027.00000002.3478004014.0000000003554000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: explorer.exe, 00000027.00000002.3478004014.0000000003554000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: explorer.exe, 00000027.00000002.3483451712.0000000009B95000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 00000027.00000002.3475320833.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000027.00000002.3483451712.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000027.00000000.3156801722.000000000769A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node	graph_0-50943
Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node	graph_0-50800
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node	graph_4-96122
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_000002077FEFCCE0 LdrGetProcedureAddress,

11_2_000002077FEFCCE0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000180035B54 IsDebuggerPresent,

0_2_0000000180035B54

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000018003EEEC EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_000000018003EEEC

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000180047394 _lseeki64_nolock,_lseeki64_nolock,GetProcessHeap,HeapAlloc,_errno,_errno,_setmode_nolock,_write_nolock,__doserrno,_errno,_setmode_nolock,GetProcessHeap,HeapFree,_lseeki64_nolock,_get_osfhandle,SetEndOfFile,_errno,__doserrno,GetLastError,_lseeki64_nolock,

0_2_0000000180047394

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180032DD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0000000180032DD8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8A868F120 __scrt_fastfail,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF8A868F120
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180032DD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0000000180032DD8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000000180032DD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0000000180032DD8
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000000180032DD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0000000180032DD8

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.46.11 8817			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.40.41 8817			Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\explorer.exe base: 2E80000 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\explorer.exe base: 8510000 protect: page execute and read and write			Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Windows\System32\rundll32.exe

Code function: 11_3_00007DF410EF0100 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,

11_3_00007DF410EF0100

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\rundll32.exe	Thread created: C:\Windows\explorer.exe EIP: 2E80000			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread created: C:\Windows\explorer.exe EIP: 8510000			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 2E80000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 8510000 value starts with: 4D5A			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 1028 base: 2E80000 value: 4D			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 1028 base: 8510000 value: 4D			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 7408	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 7408	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 7700	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 7700	Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\rundll32.exe

Thread register set: 7408 1

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 2E80000			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 8510000			Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",#1

Jump to behavior

Source: explorer.exe, 00000027.00000000.3159058846.0000000009B95000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009B95000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 00000027.00000000.3144135536.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000027.00000002.3476686727.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000027.00000002.3479846046.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3144135536.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000027.00000002.3476686727.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000027.00000000.3144135536.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000027.00000002.3476686727.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000027.00000000.3144135536.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000027.00000002.3476686727.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000027.00000002.3475320833.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3142664172.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman

Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	0_2_00000001800354AC
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	0_2_0000000180042858
Source: C:\Windows\System32\loaddll64.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	0_2_00000001800298D8
Source: C:\Windows\System32\loaddll64.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	0_2_00000001800400E0
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	0_2_0000000180043100
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,	0_2_000000018004290C
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	0_2_00000001800419E8
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	0_2_0000000180042A10
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000000018004324C
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,GetLocaleInfoW,	0_2_00000001800432FC
Source: C:\Windows\System32\loaddll64.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_0000000180041B54
Source: C:\Windows\System32\loaddll64.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	0_2_000000018002E394
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	0_2_00000001800433A4
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_00000001800353EC
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	0_2_00000001800423EC
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	0_2_00000001800384A0
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	0_2_000000018003B508
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_0000000180042D88
Source: C:\Windows\System32\loaddll64.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	0_2_0000000180040DB0
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_0000000180042E3C
Source: C:\Windows\System32\loaddll64.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	0_2_000000018004064C
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	0_2_0000000180042ED0
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	0_2_0000014F6D71C4DC
Source: C:\Windows\System32\loaddll64.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	0_2_0000014F6D70A8AC
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	0_2_0000014F6D72382C
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	0_2_0000014F6D7239E4
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00007FF8A88B09A8
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00007FF8A88B0F30
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00007FF8A88B08A8
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00007FF8A8683260
Source: C:\Windows\System32\rundll32.exe	Code function: try_get_function,try_get_function,GetLocaleInfoW,	4_2_00007FF8A868C4B0
Source: C:\Windows\System32\rundll32.exe	Code function: try_get_function,try_get_function,GetLocaleInfoW,	4_2_00007FF8A868C4B0
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,GetLocaleInfoW,	4_2_00007FF8A868ACC0
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	4_2_00000001800354AC
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	4_2_00000001800400E0
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	4_2_00000001800384A0
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	4_2_000000018004064C
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	4_2_0000000180040DB0
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00000001800353EC
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	4_2_00000001800298D8
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	4_2_00000001800419E8
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_0000000180041B54
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	4_2_000000018002E394
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	4_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	4_2_0000000180042858
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	4_2_000000018004290C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	4_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	4_2_0000000180042D88
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	4_2_0000000180042E3C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	4_2_0000000180042ED0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	4_2_0000000180043100
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_000000018004324C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	4_2_00000001800432FC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	4_2_00000001800433A4
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	4_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	4_2_000002CA6ABFA8AC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	4_2_000002CA6AC1382C
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	5_2_00000001800354AC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	5_2_0000000180042858
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	5_2_00000001800298D8
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	5_2_00000001800400E0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	5_2_0000000180043100
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	5_2_000000018004290C
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	5_2_00000001800419E8
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	5_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_000000018004324C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	5_2_00000001800432FC
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_0000000180041B54
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	5_2_000000018002E394
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	5_2_00000001800433A4
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	5_2_00000001800353EC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	5_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	5_2_00000001800384A0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	5_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	5_2_0000000180042D88
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	5_2_0000000180040DB0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	5_2_0000000180042E3C
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	5_2_000000018004064C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	5_2_0000000180042ED0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	5_2_00000214B7BBC4DC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	5_2_00000214B7BC39E4
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	5_2_00000214B7BAA8AC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	5_2_00000214B7BC382C
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	11_2_00000001800354AC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	11_2_0000000180042858
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	11_2_00000001800298D8
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	11_2_00000001800400E0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	11_2_0000000180043100
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	11_2_000000018004290C
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	11_2_00000001800419E8
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	11_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_000000018004324C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	11_2_00000001800432FC
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	11_2_0000000180041B54
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	11_2_000000018002E394
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	11_2_00000001800433A4
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	11_2_00000001800353EC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	11_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	11_2_00000001800384A0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	11_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	11_2_0000000180042D88
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	11_2_0000000180040DB0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	11_2_0000000180042E3C
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	11_2_000000018004064C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	11_2_0000000180042ED0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	11_2_00000207014539E4
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	11_2_000002070144C4DC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	11_2_000002070145382C
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	11_2_000002070143A8AC

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000180039844 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0000000180039844

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_000002077FF14D00 GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,

11_2_000002077FF14D00

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000018003E704 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,_malloc_crt,_invoke_watson,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,

0_2_000000018003E704

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected BruteRatel

Source: Yara match	File source: 00000010.00000002.3479968792.00000260C38BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3478193493.00000207037A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3477789509.000002070365C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3479968792.00000260C392C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.3412211804.00000260C37DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3477789509.0000020703704000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3479757956.00000260C37AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7940, type: MEMORYSTR

Remote Access Functionality

Yara detected BruteRatel

Source: Yara match	File source: 00000010.00000002.3479968792.00000260C38BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3478193493.00000207037A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3477789509.000002070365C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3479968792.00000260C392C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.3412211804.00000260C37DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3477789509.0000020703704000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3479757956.00000260C37AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7940, type: MEMORYSTR

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8A86834A0 Concurrency::details::WorkItem::BindTo,

4_2_00007FF8A86834A0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	912 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	51 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	912 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	2 File and Directory Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	13 System Information Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gpufault.dll.dll	24%	ReversingLabs	Win64.Trojan.Latrodectus

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cronoze.com	94.232.40.41	true	false		high
muuxxu.com	94.232.46.11	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://cronoze.com:8817/pentium.phpz	rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://word.office.comon	explorer.exe, 00000027.00000002.3483451712.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false	high
http://r11.o.lencr.org0#	rundll32.exe, 0000000B.00000003.3137981944.000002077FB30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138142453.000002077FB32000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3479115762.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3172595213.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFBA5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411892440.00000260BFBA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://muuxxu.com:8817/pentium.php	rundll32.exe, 0000000B.00000002.3478798849.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cronoze.com/y	rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://r11.o.lencr.2	rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://powerpoint.office.comcember	explorer.exe, 00000027.00000002.3491179741.000000000C460000.00000004.00000001.00020000.00000000.sdmp	false	high
https://cronoze.com:8817/pentium.phpu	rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://muuxxu.com:8817/intel.phpP	rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://muuxxu.com/n	rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://muuxxu.com:8817/pentium.phpu	rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://upx.sf.net	Amcache.hve.10.dr	false	high
https://cronoze.com:8817/pentium.php	rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB57000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://excel.office.com	explorer.exe, 00000027.00000000.3159058846.0000000009B95000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009B95000.00000004.00000001.00020000.00000000.sdmp	false	high
https://cronoze.com/%	rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cronoze.com/e	rundll32.exe, 00000010.00000003.2712641891.00000260BFB3A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://muuxxu.com/1	rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.micro	explorer.exe, 00000027.00000002.3482760380.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000027.00000002.3482706289.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000027.00000002.3481832203.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp	false	high
https://cronoze.com:8817/pentium.phpB	rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://outlook.com	explorer.exe, 00000027.00000000.3159058846.0000000009B95000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009D42000.00000004.00000001.00020000.00000000.sdmp	false	high
http://r11.i.lencr.org/0	rundll32.exe, 0000000B.00000003.3137981944.000002077FB30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138142453.000002077FB32000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3479115762.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3172595213.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFBA5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411892440.00000260BFBA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB1E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	false	high
https://muuxxu.com/	rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cronoze.com:8817/intel.php	rundll32.exe, 00000010.00000003.2712641891.00000260BFB3A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2712641891.00000260BFB1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dogirafer.com/test/	explorer.exe, 00000027.00000002.3487535607.000000000AF1D000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://cronoze.com/	rundll32.exe, 00000010.00000003.2712641891.00000260BFB3A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://muuxxu.com:8817/pentium.php;	rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://x1.c.lencr.org/0	rundll32.exe, 0000000B.00000003.3137981944.000002077FB30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138142453.000002077FB32000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3479115762.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3172595213.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFBA5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411892440.00000260BFBA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	rundll32.exe, 0000000B.00000003.3137981944.000002077FB30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138031677.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3138142453.000002077FB32000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3479115762.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAFA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.3172595213.000002077FB33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFBA5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411892440.00000260BFBA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	false	high
https://android.notify.windows.com/iOS	explorer.exe, 00000027.00000000.3156801722.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3480242871.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	false	high
https://cronoze.com:8817/intel.phpn	rundll32.exe, 00000010.00000003.2712641891.00000260BFB3A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB33000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dogirafer.com/test/t/	explorer.exe, 00000027.00000002.3487535607.000000000AF1D000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000027.00000002.3491179741.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3162188864.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	false	high
https://api.msn.com/	explorer.exe, 00000027.00000000.3159058846.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3483451712.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	false	high
https://cronoze.com:8817/pentium.php.	rundll32.exe, 00000010.00000003.3411915498.00000260BFB56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.3477075468.00000260BFB57000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://x1.c.le	rundll32.exe, 00000010.00000002.3477075468.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.3411915498.00000260BFB73000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.v	explorer.exe, 00000027.00000000.3142664172.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.3475320833.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cronoze.com:8817/	rundll32.exe, 0000000B.00000002.3478798849.000002077FA6E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://muuxxu.com:8817/intel.phpm	rundll32.exe, 0000000B.00000003.3138031677.000002077FACE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3478798849.000002077FAC4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wns.windows.com/)s	explorer.exe, 00000027.00000002.3483451712.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000027.00000000.3159058846.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.232.46.11	muuxxu.com	Russian Federation		44477	WELLWEBNL	false
94.232.40.41	cronoze.com	Russian Federation		44477	WELLWEBNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578369
Start date and time:	2024-12-19 16:08:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gpufault.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	gpufault.dll.exe
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@44/18@7/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 244

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 40.126.53.7, 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: gpufault.dll.dll

Simulations

Behavior and APIs

Time	Type	Description
10:09:33	API Interceptor	1x Sleep call for process: loaddll64.exe modified
10:09:37	API Interceptor	4x Sleep call for process: WerFault.exe modified
10:10:55	API Interceptor	251x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
94.232.46.11	lavita.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse
	appgpuset.dll.dll	Get hash	malicious	BruteRatel	Browse
	45c62e.msi	Get hash	malicious	Unknown	Browse
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse
94.232.40.41	lavita.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse
	appgpuset.dll.dll	Get hash	malicious	BruteRatel	Browse
	45c62e.msi	Get hash	malicious	Unknown	Browse
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
muuxxu.com	lavita.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.46.11
	appgpuset.dll.dll	Get hash	malicious	BruteRatel	Browse	94.232.46.11
	45c62e.msi	Get hash	malicious	Unknown	Browse	94.232.46.11
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse	94.232.46.11
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse	94.232.46.11
cronoze.com	lavita.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.40.41
	appgpuset.dll.dll	Get hash	malicious	BruteRatel	Browse	94.232.40.41
	45c62e.msi	Get hash	malicious	Unknown	Browse	94.232.40.41
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse	94.232.40.41
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse	94.232.40.41

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WELLWEBNL	lavita.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.40.41
	appgpuset.dll.dll	Get hash	malicious	BruteRatel	Browse	94.232.40.41
	45c62e.msi	Get hash	malicious	Unknown	Browse	94.232.40.41
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse	94.232.40.41
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse	94.232.40.41
	avutil.dll.dll	Get hash	malicious	BruteRatel	Browse	94.232.43.224
	fes.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.43.224
	wait.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.43.224
	sqx.dll.dll	Get hash	malicious	Unknown	Browse	94.232.40.38
	merd.msi	Get hash	malicious	Unknown	Browse	94.232.40.38
WELLWEBNL	lavita.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.40.41
	appgpuset.dll.dll	Get hash	malicious	BruteRatel	Browse	94.232.40.41
	45c62e.msi	Get hash	malicious	Unknown	Browse	94.232.40.41
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse	94.232.40.41
	TiNgny4xSB.dll	Get hash	malicious	BruteRatel	Browse	94.232.40.41
	avutil.dll.dll	Get hash	malicious	BruteRatel	Browse	94.232.43.224
	fes.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.43.224
	wait.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.43.224
	sqx.dll.dll	Get hash	malicious	Unknown	Browse	94.232.40.38
	merd.msi	Get hash	malicious	Unknown	Browse	94.232.40.38

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_59ea469c9cde70e5cc5fc8dc983f2f16bebbf3_85207d7d_78f1e90e-9d4b-4061-a0d3-256187e7c363\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5833716794526708
Encrypted:	false
SSDEEP:	96:UXFGyKyUsQhMov7JfNQXIDcQ4c6fcE+cw3tZAX/d5FMT2SlPkpXmTAKf/VXT5NHr:CMyUs0WbkQzuiF4Z24lO8b
MD5:	6A9A5FB4E2C4B976AFDD2F0F3088CA5F
SHA1:	264E440B305F3F98140D8F7BB7B86825502205BE
SHA-256:	3C39BFF077EF30507C56B054BC774D154CD972D9FD6C464A7672BE315ED8644A
SHA-512:	74AE2CF153E133BB39584DE1E638AB2F7A3B2579903B6905C45C36EFCF30E9F6075970B8C142318548EC0ADE7E13C1C800A6C40C135673E31A49AB13E22679B0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.0.9.4.5.6.5.2.4.8.0.3.6.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.0.9.4.5.6.9.7.1.6.7.8.6.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.8.f.1.e.9.0.e.-.9.d.4.b.-.4.0.6.1.-.a.0.d.3.-.2.5.6.1.8.7.e.7.c.3.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.2.5.2.e.8.1.6.-.5.c.3.6.-.4.f.b.c.-.b.d.f.4.-.f.1.2.1.e.9.9.e.2.3.f.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.b.a.d._.m.o.d.u.l.e._.i.n.f.o.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.0.0.-.0.0.0.1.-.0.0.1.4.-.0.9.a.8.-.f.f.f.b.2.7.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.r.u.n.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.1.0.3././.0.8././.0.7.:.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_59ea469c9cde70e5cc5fc8dc983f2f16bebbf3_85207d7d_99f64cc5-220c-40a6-a443-ae1f0170b272\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5831864812554831
Encrypted:	false
SSDEEP:	96:0UMfF+tyKyEsQhMov7JfNQXIDcQ4c6fcE+cw3tZAX/d5FMT2SlPkpXmTAKf/VXT/:kIyEs0WbkQzuiF4Z24lO8b
MD5:	0BA4770A3CBDCFDD0E2D20253AC0E1EB
SHA1:	7E24845AF5F6911AA2477BD173D399EB65CE097D
SHA-256:	F8C765C1F73379F9C8DE77E33540B4B161BD22EECA4EFDC375AA9A4F50599718
SHA-512:	6E965FC08AD6B156D6FF6AB6E71089A3400243A96F05F5AADACA587CCB8EC67914AD4FA0FBEF8AE883344A236DEF8E26BC92FFBF8545C06A0236E5D827373CA4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.0.9.4.5.6.5.0.8.1.1.8.1.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.0.9.4.5.6.9.7.2.1.8.0.5.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.9.f.6.4.c.c.5.-.2.2.0.c.-.4.0.a.6.-.a.4.4.3.-.a.e.1.f.0.1.7.0.b.2.7.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.3.c.2.5.4.e.b.-.f.f.e.a.-.4.a.1.0.-.9.b.0.c.-.3.e.2.b.7.9.7.3.b.5.6.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.b.a.d._.m.o.d.u.l.e._.i.n.f.o.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.f.0.-.0.0.0.1.-.0.0.1.4.-.7.c.0.f.-.f.9.f.b.2.7.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.r.u.n.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.1.0.3././.0.8././.0.7.:.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_gpu_2130faadf4e1a2532f2bde70d18604255ed2b85_790b1338_d96f171d-db8c-4086-ae5d-8c2cefa17d47\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8345162800296176
Encrypted:	false
SSDEEP:	192:gVjODifyRk0Hw7irjwZFPxzuiF4Z24lO8xn:gBODi6RfHw7irj4zuiF4Y4lO8x
MD5:	97F7BFDCCADC500C95ADA9F05D9AD55E
SHA1:	61A9A37C3553BB771828E79FB611F1501F442657
SHA-256:	38B69A5F8EDD5BD87B1FB99E62CED76837ECC9AFB93B5E446E29D99ABA789EE0
SHA-512:	3A6B6CDB5C59E205134C8AE03F94BBE36862AEFC273695EFBBA632756833B2AED963DE649B9446DBB00FB6065E9C0B9D6360A5D22BBF3803508C2C2AC4FE2476
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.0.9.4.5.7.6.8.9.1.2.0.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.0.9.4.5.7.7.9.2.2.4.4.7.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.9.6.f.1.7.1.d.-.d.b.8.c.-.4.0.8.6.-.a.e.5.d.-.8.c.2.c.e.f.a.1.7.d.4.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.7.e.4.b.6.7.3.-.7.c.f.4.-.4.1.e.1.-.8.7.b.8.-.0.5.a.d.f.9.e.0.e.d.7.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.g.p.u.f.a.u.l.t...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.2.0.-.0.0.0.1.-.0.0.1.4.-.f.4.3.2.-.1.c.0.2.2.8.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_gpu_2cb5eecfada0578fd925b8fb75f122dc2c902f5e_790b1338_4a6e8b3f-d00d-4ffe-b52c-7069997444b1\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8244914664525909
Encrypted:	false
SSDEEP:	192:LUEiDyS1z0kVLXEjwZFPxzuiF4Z24lO8+:7i2S1gkVL0j4zuiF4Y4lO8+
MD5:	580916DB41C848CA138C2192FAB19959
SHA1:	6299F99BC43A8FE051DC777074994EF2D80CD17E
SHA-256:	C5F1D4B7C78599AC982653CDA0924F5C6B80555150EF20E1769A80E4FE180E5D
SHA-512:	7D57B58DA4EFA8D1988C21C3AB1023695836E60FBCAF7D3369B64888FEA703DF08AE25963F7B1C650A2E4FB3AE81BE353E3D0B7B1BDD6D300459F15BC30ED36B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.0.9.4.5.6.9.2.0.0.9.7.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.0.9.4.5.6.9.8.5.7.2.2.5.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.a.6.e.8.b.3.f.-.d.0.0.d.-.4.f.f.e.-.b.5.2.c.-.7.0.6.9.9.9.7.4.4.4.b.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.d.8.2.f.7.3.5.-.c.e.8.b.-.4.b.b.9.-.8.b.3.c.-.b.f.8.0.f.8.0.5.4.d.2.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.g.p.u.f.a.u.l.t...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.1.4.-.0.0.0.1.-.0.0.1.4.-.e.e.a.5.-.a.9.f.f.2.7.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAF6.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 19 15:09:29 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59830
Entropy (8bit):	1.7026582230226297
Encrypted:	false
SSDEEP:	96:5a8Feo9Bknlv10S4MTPsRsoPRh8k07eoi7MOBQ/RCk9r9OMwvKs1gPaMOgRRVhWl:nLd07XOM7R9r9uFgPavuRV657hsb
MD5:	5FFEC342AAC2DDA0AC8E39FB43D0D5F4
SHA1:	DE2A8FA48BC402A7C85D21FBA69495A639DB240F
SHA-256:	F34AAE3591BDE67B3B852A31F1B913EF431240EFF8B05313194A793C15B99EEC
SHA-512:	A4CA3EB536B8018663A9245E4DE725F8F50DF23660B23EC8E0BE8D6009E7C16220D1EBAEFD08C2702B98C9E9623B1405A2B3B6857D5B645D016E6682300621F7
Malicious:	false
Preview:	MDMP..a..... .......)7dg........................@................,..........T.......8...........T.......................................................................................................................eJ......`.......Lw......................T...........(7dg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB36.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8924
Entropy (8bit):	3.6872915606046317
Encrypted:	false
SSDEEP:	192:R6l7wVeJW8P8gR6Y2xhLgmfsWpDZ89bDCyfGhm:R6lXJVP16YYtgmfsVDPfR
MD5:	2832DED71E98D50B66B1FD877BF36973
SHA1:	6CD35A508C7FE68476E57D14AD2095918B7FF78B
SHA-256:	CDFFDFB28688B3F38B26D79D7B2B8C709D7D2D71B1657AB1B7B281CB42F9707E
SHA-512:	189B058B0284D92CEC6E3D07B235F284EE5C92A30E125B55D628CBBAE0C44055B94DC137713C34711B3CAD7E6CE5D0B8E142A5D4534A91F4BFAEE727C09618D0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBA3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8736
Entropy (8bit):	3.6853038390864845
Encrypted:	false
SSDEEP:	192:R6l7wVeJY8V36YwslI0gmfsWpD389bDcTfihm:R6lXJ7V36YhTgmfs7DAft
MD5:	580A17DB8E375B1CB7CD5CCD5A77B0BE
SHA1:	9B3A25DEFC3A0FB6F9832F280BA263860CA0AD7A
SHA-256:	225A8C14523C1E1F8877BF259313E3BC25BB81E33D9FEA196A6F043F1700E0C1
SHA-512:	0E8AD5333CA79574EB7442BEAC0AC8261ABA9F18FBA0E676C13A692A3EE00BA8CF0CADC5F7DC96C8E2D90A13C0DBB5A494EC909DEF1E8135412F95144CDE58CF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBC4.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4621
Entropy (8bit):	4.4358406662652206
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I90fWpW8VYzPYm8M4JTNFC2yq85p4ptSTSid:uIjf6I7nO7VPJh1poOid
MD5:	9FE950D77116DCEA67605ADFF1027B01
SHA1:	EC548D413FC028A96B0F5D215BD8E0727420D159
SHA-256:	65D683ED93CDFE5BFC761AA641A2B978093D5AD109A3B7B0A0377B51887FE5ED
SHA-512:	0970D5DB1F48BA80567AA9781B53EE2C185F0DA7654C4A1C0D35D71D7009793DEED1D23578F18FAE896370D1FE57C851A82AEF512842AFB0A6E1F5782F56DF5B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="638292" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBE3.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4621
Entropy (8bit):	4.436381020842161
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I90fWpW8VYbYm8M4JTNFpyq85pc1ptSTSNmd:uIjf6I7nO7V7JFlpoONmd
MD5:	D80844807E7B88BEFEF322D999351FBB
SHA1:	14D90CCD4838714E334021C32F7B04F24A87BF63
SHA-256:	44E0C7CE53AC32B0EBD916EF07F6D5B375702EB6E5B944C5960E28D85DAC8996
SHA-512:	B160A69EE543577B0D9C4B964DEBA3038E0F4B126226DBED4FBB3B432BC1047347DDB1E0D4C9F84F190C8B46B2C8F7F50544622238A7888BF5D9AF8D9F6DCB1F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="638292" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC6E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8540
Entropy (8bit):	3.6973903315662633
Encrypted:	false
SSDEEP:	192:R6l7wVeJ1ZJI6Y28hLgmfKuXgprT89bDIcfNvhm:R6lXJ7JI6YFtgmfKuhDLfq
MD5:	21E278D6614467A980D1304BB2479DF2
SHA1:	2B404BF9D6F9F8E444C424B9CAF76C19F0C5CD56
SHA-256:	5901ED028197A318AF70CAEDF9431D012770E83AE099D76BBA40150E4543C416
SHA-512:	6D4B0EF88A3F7B8C313988CC24DBC00C32BC33474BA24B3F91A28823DC63856D4439BF708CFD0627656DB6921FF30203CB3242242D7971F2B8B827E0A7B8209A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCCC.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4763
Entropy (8bit):	4.477431954462836
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I90fWpW8VYWYm8M4JCTCrEFhVyq85mkRzptSTSnd:uIjf6I7nO7VqJ0MzpoOnd
MD5:	43F6A4A43487EFCF8599346F1B3FBFF1
SHA1:	ACF1F1D2852907E7CBA6BE31AC572D5FA9773291
SHA-256:	BA5165DFAB0D57BEE78E5F0EFA882CE554D3338ED500C66B7C51E802D41A7C69
SHA-512:	A592FD4295F65B1AAE9D63919ECF230ECC01F95335BEEDA6859C597D0CDCA97E39DB40D60B3864D85DFF6A7BAFB7B880593C28D70048C3809A64C355D587754E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="638292" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF92C.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 19 15:09:37 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	51686
Entropy (8bit):	1.499827621702265
Encrypted:	false
SSDEEP:	96:5C8OmJSvXBknlv10S4MTPsRsoPRh8gCxoi7MOBQ/RgTKLpdrQQWxqfwwr+28Z+l+:/OmSL7OM7gKLpdrQQWf28Q5bsr
MD5:	779D561462E50B3CD4E3CF00B5EDFCE7
SHA1:	5A05A93915047D9622531212F3A80C6F91B8D337
SHA-256:	881AC81C2AEED87A85586827C842387AABA3AA00733CE672F7CE5BFF309B5A64
SHA-512:	DAC5FD5747C2CB73573E6A7595C78E58CF1D386CD255E1729EC7132DDA3572889D7E0879CF6825CD92612D100253CB271B4D0AC2EC5FA58EF46572079DEC5204
Malicious:	false
Preview:	MDMP..a..... .......17dg........................@................,..........T.......8...........T...........p...v.......................................................................................................eJ......`.......Lw......................T....... ...,7dg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA65.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8908
Entropy (8bit):	3.7000107601607146
Encrypted:	false
SSDEEP:	192:R6l7wVeJlfb6Y2wVgmfjiNsVpDn89bcUSfsUm:R6lXJtb6YxVgmfjiNs4cxfW
MD5:	EA7F7DDAD83EF926805107CD6DE7C00D
SHA1:	F49476C316D3D8EAA5F02B10BC65B9ABB9F94F48
SHA-256:	2A41BA2E258BE4026B20397C51C5B62D1C4CABE9FBE64C33E3AF89A60A178CCA
SHA-512:	558CC4B39EF6CB7148D884F2F124726F74F05A70AA70FEE274028DD3FBCA011D4A7D590621E93EBA5ACF0766643FF6D6F87FB451D601FEC84D39C18AB11FE1E3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB41.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4885
Entropy (8bit):	4.46211395611954
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I90fWpW8VYpn5Ym8M4JCTCrYgFGyq8vhrYiHptSTSSd:uIjf6I7nO7VeoJ4W/HpoOSd
MD5:	BC72E5F870877AE83C12284A0C9D3D93
SHA1:	48D725677DF87BC93A9BF3B8451A6873F52E66CC
SHA-256:	3B6BFE3AE962A6EA591CE218C2E9BB77D8144E659C271099468C66D33BC5316C
SHA-512:	67086427BBAFC83EE1EA7588A48CF8D7FE0434602E96E118FCF3A7FF028680D4D55284C973368F5DACA27C6F49AFE545DDAA1C70635D9EFAE953232A8EC2F6B4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="638292" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\WERCB37.tmp.WERDataCollectionStatus.txt

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4772
Entropy (8bit):	3.2531291319513476
Encrypted:	false
SSDEEP:	96:pwpIiRkXkkXGklEuWN0Qm0QT0Qgn0QXl0Qh0Qeo7egvXe58szeuzSzbxGQI5YmES:pklvvuiTtW8oeyOkNn
MD5:	E638BA3F3D1B464CE32FFDD54F624481
SHA1:	07BDB931172AD52D9A6DF35181EE8D4D41D6B297
SHA-256:	A5120D7313B2EB33B9FD71EF4F89BAD9AB4667ADDDF7BBFFF3D61F52744F36EC
SHA-512:	4988C4FC7620519A9A6F9585076EA63976E9766A51A94641052FCE2C7CDF3B8B6F7EDD43E0463446AFBE5C1282D114DB5B87B574FA9ABA2CC675978E16324E52
Malicious:	false
Preview:	......S.n.a.p.s.h.o.t. .s.t.a.t.i.s.t.i.c.s.:.....-. .S.i.g.n.a.t.u.r.e. . . . . . . . . . . . . . . . .:. .P.S.S.D.......-. .F.l.a.g.s./.C.a.p.t.u.r.e.F.l.a.g.s. . . . . . . .:. .0.0.0.0.0.0.0.1./.d.0.0.0.3.9.f.f.......-. .A.u.x. .p.a.g.e.s. . . . . . . . . . . . . . . . .:. .1. .e.n.t.r.i.e.s. .l.o.n.g.......-. .V.A. .s.p.a.c.e. .s.t.r.e.a.m. . . . . . . . . . .:. .4.5.2.2.4. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .H.a.n.d.l.e. .t.r.a.c.e. .s.t.r.e.a.m. . . . . . .:. .0. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .H.a.n.d.l.e. .s.t.r.e.a.m. . . . . . . . . . . . .:. .7.6.8.2. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .T.h.r.e.a.d.s. . . . . . . . . . . . . . . . . . .:. .4. .t.h.r.e.a.d.s.......-. .T.h.r.e.a.d. .s.t.r.e.a.m. . . . . . . . . . . . .:. .5.4.4.0. .b.y.t.e.s. .i.n. .s.i.z.e...........S.n.a.p.s.h.o.t. .p.e.r.f.o.r.m.a.n.c.e. .c.o.u.n.t.e.r.s.:.....-. .T.o.t.a.l.C.y.c.l.e.C.o.u.n.t. . . . . . . . . . .:. .1.7.6.8.5.7.4.6. .c.y.c.l.e.s.......-. .V.a.C.l.o.n.e.C.y.c.l.e.C.o.u.n.t. . . . . .

C:\Users\user\AppData\Local\Temp\WERCBA5.tmp.WERDataCollectionStatus.txt

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4756
Entropy (8bit):	3.2457702116292815
Encrypted:	false
SSDEEP:	96:pwpIitkXkkX/kYFuWv0QF0Qd0Qgr0QXf0Ql0QsQaajgnXodszeuzSzbxGQI5/m/e:pIlmpubhE+oeyOkNf
MD5:	688151D0408010986BB3EE72DF36040A
SHA1:	B0CA167E90319EC7E2C8A7CB53DDEAC392EBA417
SHA-256:	222A625F0238979929C8DCA1D00676CB25DA643BD3881AE70819CA3436298AA4
SHA-512:	FF0CBC4629DAECFDD016AA1411DA24B77B5257FC6F3C81004818A5C793D0ECE470BDB6E484452AD13C5472D8C15531B9B04899B5563125A81F0EFC673B1D1AE6
Malicious:	false
Preview:	......S.n.a.p.s.h.o.t. .s.t.a.t.i.s.t.i.c.s.:.....-. .S.i.g.n.a.t.u.r.e. . . . . . . . . . . . . . . . .:. .P.S.S.D.......-. .F.l.a.g.s./.C.a.p.t.u.r.e.F.l.a.g.s. . . . . . . .:. .0.0.0.0.0.0.0.1./.d.0.0.0.3.9.f.f.......-. .A.u.x. .p.a.g.e.s. . . . . . . . . . . . . . . . .:. .1. .e.n.t.r.i.e.s. .l.o.n.g.......-. .V.A. .s.p.a.c.e. .s.t.r.e.a.m. . . . . . . . . . .:. .4.5.0.8.0. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .H.a.n.d.l.e. .t.r.a.c.e. .s.t.r.e.a.m. . . . . . .:. .0. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .H.a.n.d.l.e. .s.t.r.e.a.m. . . . . . . . . . . . .:. .7.8.5.0. .b.y.t.e.s. .i.n. .s.i.z.e.......-. .T.h.r.e.a.d.s. . . . . . . . . . . . . . . . . . .:. .3. .t.h.r.e.a.d.s.......-. .T.h.r.e.a.d. .s.t.r.e.a.m. . . . . . . . . . . . .:. .4.0.8.0. .b.y.t.e.s. .i.n. .s.i.z.e...........S.n.a.p.s.h.o.t. .p.e.r.f.o.r.m.a.n.c.e. .c.o.u.n.t.e.r.s.:.....-. .T.o.t.a.l.C.y.c.l.e.C.o.u.n.t. . . . . . . . . . .:. .1.8.0.3.1.1.6.6. .c.y.c.l.e.s.......-. .V.a.C.l.o.n.e.C.y.c.l.e.C.o.u.n.t. . . . . .

C:\Users\user\NTUSER.DAT.Not

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	108
Entropy (8bit):	5.189768812561628
Encrypted:	false
SSDEEP:	3:TnmyWAWCwlzdGmTEg/9sAtBydVyjiSlyLrci5gn:TmeWCwpYBg/9KijPET+n
MD5:	ECDEA81B175DF29A16A38BBB276FD5F6
SHA1:	3E0FBC07E7D472F10AFDBA95B683395CC2926AE4
SHA-256:	269A910899496599B87D2DED3BC17FE54F70CD0F1EAA98B07F626039824B92BD
SHA-512:	5F0A4C07CFAAFE6773EC09DD981EAA2F1D0122400263BD710AD6BD9C443581A2181D1F211D091BBA9A0866AEF195A218D05514894036DAC4C8217B8D0CA5A419
Malicious:	false
Preview:	{Z3B1ZmF1bHQuZGxsLmRsbA==, IkM6XFVzZXJzXGFsZm9uc1xEZXNrdG9wXGdwdWZhdWx0LmRsbC5kbGwi, MQ==, R2ZlWGNvZGVGdW5j}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.42240622238528
Encrypted:	false
SSDEEP:	6144:BSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNa0uhiTw:YvloTMW+EZMM6DFy003w
MD5:	120DD683246D898C52A58FAB77C459A6
SHA1:	8022B32C2AD960D442017585189130B71658ED90
SHA-256:	BC3D905F0B2518A6E0A9183882478139AA582FD1DE6EBACCFFD166D50187A180
SHA-512:	806DC1FAB7104667CED5E689F2779FB951AC79A66281C234C29301896E4D372D17C714461A6D102CD6C7C5118A41F11A2932CEA944932DCF6F2D4849CE80E33A
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...'R..............................................................................................................................................................................................................................................................................................................................................gk..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.141170391700714
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	gpufault.dll.dll
File size:	3'954'176 bytes
MD5:	72462ae450bb675eae4ec1ba6bcb8305
SHA1:	c14355446cdc6786e9ef69180fc699d8cc17aecd
SHA256:	1bcf12604f49243fbb260f7e52b485fef7e215c5462e63ba2106bcbb7f68e3fa
SHA512:	68fca442b0a19c46407f7863c92f6639f5954dc250aad9a6f1ce5c57d6d2bc14876c3160480ff8c0fd7149abd9cd3980b49a35dbd2726d8e8794434a29184b93
SSDEEP:	49152:uUhs9XR3wxZXRTZUcuVHleFPH1FBJtFfmHrgdvs+s9bj5ZDhN4q:SagbONF30blJ7B
TLSH:	9E069D5AF7A81048D17B917D8AAB4B4AEA72F40187315BCF019442EE1F63BE50D3E7B1
File Content Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......#?U.g^;.g^;.g^;..:8.j^;..:?.\|^;..:>..^;.t88.n^;.t8>..^;.t8?.D^;.....f^;.....d^;...>.b^;.\|...w^;.....f^;.....e^;.....z^;.g^:..^;

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180019fa0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Time Stamp:	0x66687C67 [Tue Jun 11 16:33:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	50e60cb08521b483a152f5300e46b8e7

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push esp
push eax
push ebx
push ecx
push edx
push esi
push edi
inc ecx
push eax
inc ecx
push ecx
inc ecx
push edx
inc ecx
push ebx
inc ecx
push esp
inc ecx
push ebp
inc ecx
push esi
inc ecx
push edi
dec eax
mov eax, edx
dec eax
xor eax, esp
dec eax
sub eax, esp
dec eax
mov ecx, esi
dec eax
or eax, ebx
dec ecx
mov eax, esp
dec ebp
xor eax, eax
dec ax
movd edx, mm0
dec eax
sub edx, eax
dec eax
add edx, 00000132h
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
dec edx
dec eax
inc ecx
dec eax
add edx, ecx
dec eax
cmp edx, ecx
dec eax
cmp eax, ecx
dec esp
cmp edx, esp
dec esp
test eax, ebp
xorps xmm1, xmm1
dec eax
mov eax, edi
setne dl
setne dl
inc esp
mov ecx, esi
shr ecx, 0Ah
inc ecx
add edi, edx
ror ecx, 07h
inc ecx
ror eax, 13h
inc ecx
xor eax, ecx
shr ecx, 03h
inc ecx
ror eax, 13h
ror edx, 12h
add edx, ebp
dec eax
add eax, FFFFFFD4h
dec eax
add eax, FFFFFFD4h
dec eax
add edx, FFFFFFD4h
ror eax, 0Bh
inc ecx
pop edi
inc ecx
pop esi
inc ecx
pop ebp
inc ecx
pop esp
inc ecx
pop ebx
inc ecx
pop edx
inc ecx
pop ecx
inc ecx
pop eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
pop esp
dec eax
cmp edx, 01h
je 00007F2138E35ADAh
dec eax
mov eax, 00000001h
ret
push ebp
dec eax
sub esp, 00000090h
push esp
push eax
push ebx
push ecx
push edx
push esi
push edi
inc ecx

Rich Headers

Programming Language:

[C++] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2f5b80	0x358	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x330de8	0x12c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x33c000	0xa4c3c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x315000	0x17d9c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x321000	0x2628	.pdata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e1000	0x208c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b7870	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2b9e38	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2b78b0	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x330000	0xde8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x251051	0x251200	f540f5591a49b467ced498036d3f4d1d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x253000	0xa2ed8	0xa3000	5e7f7f61f7e25594fc59137c9a47ba36	False	0.3123322469325153	data	4.743581618389728	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2f6000	0x1e250	0x6200	7b032f630f6c3069375cf388ef849a7b	False	0.14190051020408162	DIY-Thermocam raw data (Lepton 2.x), scale 26673-10880, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.836933	3.865732095199724	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x315000	0x1a4f0	0x1a600	d725a30faec48ea01072f8c22e02b360	False	0.48789247630331756	data	5.914896767169826	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x330000	0x33b3	0x3400	a7da85c02bab675e06ff41413f954480	False	0.23760516826923078	OpenPGP Secret Key	3.7389867108154293	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0x334000	0x3124	0x3200	6311f57e3dfd2a8e8a72d9c548e7575b	False	0.283125	data	3.679119352047938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.giats	0x338000	0x108	0x200	4cc405a3bc0d47a4f8fdff591662692b	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
minATL	0x339000	0x329	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x33a000	0x11b	0x200	0157595f914df79257793a9922d03c21	False	0.044921875	data	0.18415065608732903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x33b000	0x309	0x400	c573bd7cea296a9c5d230ca6b5aee1a6	False	0.021484375	data	0.011173818721219527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x33c000	0xa4c3c	0xa4e00	8556040774f462165ffb5bdcff02cfff	False	0.8276822521796816	data	7.837978893359296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3e1000	0x45cc	0x4600	1e86dbc4305ed9fab1872aeaa4cf2d3c	False	0.19771205357142857	data	3.4195163329958143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0x33c0e8	0x30	data	English	United States	0.625
RT_VERSION	0x33c118	0x350	data	English	United States	0.4257075471698113
RT_VXD	0x33c468	0xa47d4	data			0.8289508837131984

Imports

DLL	Import
SHELL32.dll	SHGetFolderPathW, SHGetKnownFolderPath, SHCreateDirectoryExW, SHFileOperationA, SHGetPropertyStoreFromParsingName
USER32.dll	GetWindowThreadProcessId, SetRectEmpty, GetDC, MessageBoxA, GetDesktopWindow, MessageBoxW, SetRect
ADVAPI32.dll	RegCloseKey, RegQueryValueExW, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegOpenKeyExW
SHLWAPI.dll	PathFileExistsW, SHCreateStreamOnFileEx
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CoUninitialize, CoInitializeEx, PropVariantClear, CoCreateInstance
gdiplus.dll	GdipAlloc, GdipFree, GdipCreateHBITMAPFromBitmap, GdiplusShutdown, GdipCloneImage, GdipDisposeImage, GdipSetPropertyItem, GdipCreateBitmapFromScan0, GdipCreateBitmapFromGdiDib, GdipGetImageEncodersSize, GdipGetImageEncoders, GdiplusStartup
GDI32.dll	CreateDIBSection, GetDeviceCaps, DeleteObject
KERNEL32.dll	GetProcessHeap, SetCurrentDirectoryW, GetCurrentDirectoryW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, GetTimeZoneInformation, HeapQueryInformation, SetEnvironmentVariableW, FlushFileBuffers, GetConsoleCP, SetConsoleCtrlHandler, SetEndOfFile, SetFilePointerEx, ReadConsoleW, GetConsoleMode, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetDateFormatW, GetDriveTypeW, FreeEnvironmentStringsW, GetEnvironmentStringsW, HeapSize, GetCommandLineW, ResumeThread, ExitThread, SetStdHandle, WriteConsoleW, GetFileType, GetModuleHandleExW, ExitProcess, RaiseException, RtlPcToFileHeader, RtlUnwindEx, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, WriteFile, AcquireSRWLockExclusive, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, WaitForMultipleObjectsEx, CreateFileW, DeleteFileW, CloseHandle, CreateDirectoryW, ExpandEnvironmentStringsW, GetLastError, InitializeCriticalSection, DeleteCriticalSection, SetEvent, WaitForSingleObject, CreateEventW, Sleep, CreateThread, GetCurrentThread, SetThreadPriority, WaitForMultipleObjects, MulDiv, ResetEvent, FreeLibrary, GetProcAddress, LoadLibraryW, DebugBreak, EnterCriticalSection, LeaveCriticalSection, CopyFileW, OutputDebugStringW, QueryPerformanceCounter, QueryPerformanceFrequency, GetCurrentThreadId, GetSystemTime, GetVersionExW, SystemTimeToTzSpecificLocalTime, ReadFile, SetFilePointer, VerSetConditionMask, GetFileAttributesW, GetFullPathNameW, SetLastError, CreateProcessA, CreateProcessW, GetSystemDirectoryW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleW, LoadLibraryExW, LocalAlloc, LocalFree, VerifyVersionInfoW, GetLocalTime, SetEnvironmentVariableA, GetEnvironmentVariableA, VirtualQuery, VirtualAlloc, VirtualFree, VirtualProtect, GetSystemInfo, GlobalMemoryStatusEx, LoadLibraryA, GetNativeSystemInfo, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryEnterCriticalSection, InitializeSRWLock, AcquireSRWLockShared, RtlCaptureStackBackTrace, TryAcquireSRWLockShared, TryAcquireSRWLockExclusive, ReleaseSRWLockShared, ReleaseSRWLockExclusive, GetCurrentProcessId, CreateSemaphoreA, ReleaseSemaphore, SwitchToThread, CreateEventA, CreateDirectoryA, RemoveDirectoryA, DeleteFileA, GetFileAttributesExA, LockFileEx, UnlockFileEx, GetCurrentDirectoryA, HeapDestroy, HeapAlloc, HeapFree, HeapReAlloc, GetComputerNameA, SetThreadAffinityMask, GetProcessAffinityMask, GetCurrentProcess, GetModuleHandleA, FreeLibraryAndExitThread, GetModuleHandleExA, HeapCreate, CompareFileTime, ReleaseMutex, CreateMutexA, FormatMessageW, lstrcmpA, FileTimeToSystemTime, WideCharToMultiByte, GetStdHandle, OutputDebugStringA, AllocConsole, WriteConsoleA, SetConsoleTitleA, GetConsoleWindow, MultiByteToWideChar, GetStringTypeW, EncodePointer, DecodePointer, InitializeCriticalSectionAndSpinCount, GetSystemTimeAsFileTime, GetTickCount, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, GetThreadTimes, WaitForSingleObjectEx, SignalObjectAndWait, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, RegisterWaitForSingleObject, UnregisterWait, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, DuplicateHandle, InitializeSListHead, UnregisterWaitEx, SetProcessAffinityMask, CreateTimerQueue

Exports

Name	Ordinal	Address
DllMain	1	0x18001a200
GfeXcodeFunc	2	0x180008b40
GfeXcodeFuncEx	3	0x18000ee10
GfeXcodeImage	4	0x180014e10
GfeXcodeImageEx	5	0x18000b870
GfeXcodeMontage	6	0x18000c460
NVSDK_NGX_CUDA_CreateFeature	7	0x180003c30
NVSDK_NGX_CUDA_EvaluateFeature	8	0x18002f5a0
NVSDK_NGX_CUDA_GetParameters	9	0x1800091a0
NVSDK_NGX_CUDA_GetScratchBufferSize	10	0x180026a00
NVSDK_NGX_CUDA_Init	11	0x180005ec0
NVSDK_NGX_CUDA_ReleaseFeature	12	0x180013020
NVSDK_NGX_CUDA_Shutdown	13	0x18000a7e0
NvOptimusEnablementCuda	14	0x1802f60c8

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 16:09:40.072671890 CET	49756	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:09:40.192272902 CET	8817	49756	94.232.40.41	192.168.2.5
Dec 19, 2024 16:09:40.192521095 CET	49756	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:09:40.204405069 CET	49756	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:09:40.323968887 CET	8817	49756	94.232.40.41	192.168.2.5
Dec 19, 2024 16:10:12.346417904 CET	49756	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:10:32.719744921 CET	49881	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:10:32.839874029 CET	8817	49881	94.232.40.41	192.168.2.5
Dec 19, 2024 16:10:32.839952946 CET	49881	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:10:32.854129076 CET	49881	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:10:32.975079060 CET	8817	49881	94.232.40.41	192.168.2.5
Dec 19, 2024 16:10:34.103348017 CET	8817	49881	94.232.40.41	192.168.2.5
Dec 19, 2024 16:10:34.103498936 CET	49881	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:10:34.103626013 CET	8817	49881	94.232.40.41	192.168.2.5
Dec 19, 2024 16:10:34.103636980 CET	8817	49881	94.232.40.41	192.168.2.5
Dec 19, 2024 16:10:34.103682995 CET	49881	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:10:34.103725910 CET	49881	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:10:34.128722906 CET	49881	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:10:34.250289917 CET	8817	49881	94.232.40.41	192.168.2.5
Dec 19, 2024 16:10:34.519413948 CET	8817	49881	94.232.40.41	192.168.2.5
Dec 19, 2024 16:10:34.519494057 CET	49881	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:10:34.558026075 CET	49881	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:10:34.678745985 CET	8817	49881	94.232.40.41	192.168.2.5
Dec 19, 2024 16:10:41.706362009 CET	8817	49881	94.232.40.41	192.168.2.5
Dec 19, 2024 16:10:41.706448078 CET	49881	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:10:42.137440920 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:42.256917953 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:42.257003069 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:42.259841919 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:42.379342079 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:46.710115910 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:46.710191011 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:46.710216999 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:46.710239887 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:46.710256100 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:46.710370064 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:46.716013908 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:46.836786032 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:47.142482042 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:47.142595053 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:47.143165112 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:47.262654066 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.233139992 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.233282089 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.233283997 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.233290911 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.233299017 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.233329058 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.233335972 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.233349085 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.233403921 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.233403921 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.241692066 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.241772890 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.241823912 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.241909027 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.249979973 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.250111103 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.250130892 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.250242949 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.258285046 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.258331060 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.258400917 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.258400917 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.346503973 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.346664906 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.352982998 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.353106976 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.353122950 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.353199005 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.424853086 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.424998999 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.425003052 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.425091028 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.429034948 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.429043055 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.429117918 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.437128067 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.437210083 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.439663887 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.439672947 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.439910889 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.447298050 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.447411060 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.447428942 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.447674990 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.455059052 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.455144882 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.455179930 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.455275059 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.463403940 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.463430882 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.463622093 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.470674038 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.470766068 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.470771074 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.470855951 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.478478909 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.478591919 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.478674889 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.478702068 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.486335039 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.486376047 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.486388922 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.486572027 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.494115114 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.494242907 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.494456053 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.494543076 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.499808073 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.499852896 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.499918938 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.499918938 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.505245924 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.505425930 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.541166067 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.541178942 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.541384935 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.543777943 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.543975115 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.543992043 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.544150114 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.549452066 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.549619913 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.617311001 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.617321014 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.617389917 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.619348049 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.619430065 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.619498968 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.619498968 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.624275923 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.624283075 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.624401093 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.628779888 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.628837109 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.628880024 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.628880024 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.633424997 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.633557081 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.633564949 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.633614063 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.637885094 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.637974024 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.638052940 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.638336897 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.642492056 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.642575026 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.642623901 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.642852068 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.646981955 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.646990061 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.647068977 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.651423931 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.651566029 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.651612997 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.651997089 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.656610966 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.656618118 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.656692028 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.660379887 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.660490036 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.660554886 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.660599947 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.664825916 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.664999008 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.665110111 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.665204048 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.669461012 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.669847012 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.669872999 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.669945002 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.674532890 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.674540997 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.674603939 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.678534031 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.678597927 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.678678036 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.678720951 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.682785988 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.682826042 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.682883978 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.682883978 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.687365055 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.687372923 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.687443018 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.691971064 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.691978931 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.692233086 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.696743965 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.696752071 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.696831942 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.700953007 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.700962067 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.701037884 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.705466986 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.705473900 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.706830978 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.709651947 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.710206985 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.710277081 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.737706900 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.737716913 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.739161015 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.739173889 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.739213943 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.739213943 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.744138002 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.744152069 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.744237900 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.744237900 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.748290062 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.748300076 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.748356104 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.808917999 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.808939934 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.809062958 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.809062958 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.810504913 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.810520887 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.810664892 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.813235998 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.813298941 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.814985991 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.814997911 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.815107107 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.817228079 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.817665100 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.817698002 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.817825079 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.820151091 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.820718050 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.820753098 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.820945978 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.823344946 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.823354006 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.823564053 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.825844049 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.825884104 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.825911045 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.825965881 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.828721046 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.828754902 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.828795910 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.828847885 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.831367016 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.831485033 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.831815958 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.831955910 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.834042072 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.834115028 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.834156990 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.834218025 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.836879015 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.837044954 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.837085009 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.837137938 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.839468956 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.839617968 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.839618921 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.839804888 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.842008114 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.842154980 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.842194080 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.842370987 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.844888926 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.845043898 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.845083952 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.845143080 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.847404003 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.847414970 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.847731113 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.849889994 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.849893093 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.849956989 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.852444887 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.853615999 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.853657961 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.853884935 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.856451988 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.856462955 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.856525898 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.857511044 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.857578993 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.857665062 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.860141039 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.860272884 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.860935926 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.861026049 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.863060951 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.863076925 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.863127947 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.866202116 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.866214037 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.866266012 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.867358923 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.867454052 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.867758036 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.867990017 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.868989944 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.869426966 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.869466066 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.869872093 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.871114016 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.871125937 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.871350050 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.872680902 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.872759104 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.872808933 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.873126984 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.874593019 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.874748945 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.874782085 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.874860048 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.876899958 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.876909971 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.877017975 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.878555059 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.878570080 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.878757954 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.880677938 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.880690098 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.880749941 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.882189989 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.882210016 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.882292032 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.883796930 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.883898973 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.884089947 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.885783911 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.885797977 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.885937929 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.887522936 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.887636900 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.887967110 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.888226986 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.889489889 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.889566898 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.889710903 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.889810085 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.891264915 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.891278982 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.891366005 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.891366005 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:10:54.893476963 CET	8817	49904	94.232.46.11	192.168.2.5
Dec 19, 2024 16:10:54.893651009 CET	49904	8817	192.168.2.5	94.232.46.11
Dec 19, 2024 16:11:01.564516068 CET	49949	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:01.684164047 CET	8817	49949	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:01.684253931 CET	49949	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:01.686969995 CET	49949	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:01.806432009 CET	8817	49949	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:02.923441887 CET	8817	49949	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:02.923460960 CET	8817	49949	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:02.923466921 CET	8817	49949	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:02.923506021 CET	49949	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:02.923557997 CET	49949	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:02.935631990 CET	49949	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:03.055186033 CET	8817	49949	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:03.326082945 CET	8817	49949	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:03.326204062 CET	49949	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:03.652566910 CET	49949	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:03.772094965 CET	8817	49949	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:12.037342072 CET	8817	49949	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:12.037571907 CET	49949	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:12.038686991 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:12.158236980 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:12.158483982 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:12.158735991 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:12.278249025 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:13.432588100 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:13.432679892 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:13.433183908 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:13.434201002 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:13.553196907 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:13.554207087 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.058166027 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.058180094 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.058202028 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.058217049 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.058284044 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.058332920 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.058449030 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.058487892 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.058499098 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.058504105 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.058516979 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.058526039 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.058531046 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.058542967 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.058568954 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.064254999 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.064320087 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.064359903 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.064407110 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.178188086 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.178270102 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.178286076 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.178314924 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.182357073 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.182483912 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.294198036 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.294222116 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.294346094 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.298115015 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.298203945 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.298239946 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.298279047 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.304377079 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.304480076 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.304589033 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.304625034 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.312411070 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.312436104 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.312464952 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.312491894 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.320457935 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.320548058 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.320570946 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.320590973 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.327687025 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.327769041 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.327797890 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.327840090 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.335177898 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.335310936 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.335350990 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.335391998 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.342257977 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.342292070 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.342335939 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.342367887 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.349519014 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.349577904 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.349613905 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.349653959 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.356781006 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.356844902 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.356898069 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.356935978 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.363971949 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.364033937 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.364077091 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.364114046 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.371257067 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.371340990 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.371364117 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.371404886 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.378438950 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.378504992 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.561306000 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.561369896 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.561364889 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.561484098 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.564085007 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.564156055 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.564182997 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.564249039 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.568268061 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.568316936 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.568356991 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.568393946 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.573756933 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.573815107 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.573863029 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.573944092 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.579250097 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.579298019 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.579591036 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.579636097 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.584750891 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.584861994 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.584902048 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.584942102 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.590251923 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.590310097 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.590315104 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.590351105 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.595721960 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.595796108 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.595799923 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.595837116 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.601229906 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.601341009 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.601468086 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.601512909 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.606838942 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.606856108 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.606885910 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.606990099 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.612205029 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.612252951 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.612308025 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.612346888 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.617733955 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.617783070 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.617800951 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.617839098 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.623183966 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.623233080 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.623240948 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.623286963 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.628680944 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.628707886 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.628725052 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.628750086 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.634109974 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.634156942 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.634190083 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.634237051 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.639647007 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.639720917 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.639837027 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.639877081 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.645149946 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.645206928 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.645236015 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.645278931 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.650607109 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.650652885 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.650665045 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.650692940 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.753392935 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.753495932 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.753510952 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.753576994 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.755706072 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.755781889 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.755790949 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.755841970 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.760405064 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.760441065 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.760499001 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.760535955 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.764812946 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.764895916 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.764905930 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.764951944 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.769505024 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.769589901 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.769623995 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.769664049 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.884349108 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.884368896 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.884416103 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.884459972 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:21.889125109 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.889137030 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:21.889189005 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.004276037 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.004329920 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.004376888 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.004411936 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.008969069 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.008982897 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.009038925 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.102202892 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102222919 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102245092 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102257967 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102268934 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102282047 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102283955 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.102308989 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102322102 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102333069 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102336884 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.102346897 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.102348089 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102370024 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102379084 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.102382898 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102394104 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102404118 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102406025 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.102416039 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102427006 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102435112 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.102462053 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.102503061 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102535009 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.102972031 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102986097 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.102997065 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103008986 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103014946 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.103032112 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.103039026 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.103151083 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103163004 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103174925 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103182077 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.103230953 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.103804111 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103816986 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103827000 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103848934 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103858948 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.103871107 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.103879929 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103893042 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103902102 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.103930950 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.103948116 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103960991 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.103985071 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.103986979 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.104012012 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.104027033 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.105232954 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105248928 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105314970 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.105382919 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105396032 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105407953 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105411053 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.105418921 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.105421066 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105433941 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105439901 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105441093 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.105452061 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105467081 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.105616093 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.105935097 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105947971 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105958939 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105972052 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105983019 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.105984926 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.105994940 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.106007099 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.106008053 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.106028080 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.106034040 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.106045008 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.106056929 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.106079102 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.106141090 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.106153011 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.106183052 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.106194019 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.107021093 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.107033968 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.107063055 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.107074022 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.107084036 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.107095003 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.107100964 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.107106924 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.107109070 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.107112885 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.107117891 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.107130051 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.107155085 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.107156992 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.107194901 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.124217033 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.124320984 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.129328012 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.129386902 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.129434109 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.129482031 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.224680901 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.224740982 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.224839926 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.224886894 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.226751089 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.226814032 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.226928949 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.226975918 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.230854034 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.230900049 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.230911970 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.230945110 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.234685898 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.234745026 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.234746933 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.234791994 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.238725901 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.238792896 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.238892078 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.238945961 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.241280079 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.241336107 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.241379023 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.241420984 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.243781090 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.243837118 CET	49973	8817	192.168.2.5	94.232.40.41
Dec 19, 2024 16:11:22.243880033 CET	8817	49973	94.232.40.41	192.168.2.5
Dec 19, 2024 16:11:22.243927956 CET	49973	8817	192.168.2.5	94.232.40.41

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 16:09:29.990662098 CET	51795	53	192.168.2.5	1.1.1.1
Dec 19, 2024 16:09:30.991822004 CET	51795	53	192.168.2.5	1.1.1.1
Dec 19, 2024 16:09:32.028578043 CET	51795	53	192.168.2.5	1.1.1.1
Dec 19, 2024 16:09:32.958163977 CET	53	51795	1.1.1.1	192.168.2.5
Dec 19, 2024 16:09:32.958184004 CET	53	51795	1.1.1.1	192.168.2.5
Dec 19, 2024 16:09:34.701870918 CET	53	51795	1.1.1.1	192.168.2.5
Dec 19, 2024 16:09:39.929554939 CET	51680	53	192.168.2.5	1.1.1.1
Dec 19, 2024 16:09:40.067774057 CET	53	51680	1.1.1.1	192.168.2.5
Dec 19, 2024 16:09:54.898652077 CET	52406	53	192.168.2.5	1.1.1.1
Dec 19, 2024 16:09:55.780354023 CET	53	52406	1.1.1.1	192.168.2.5
Dec 19, 2024 16:10:31.802315950 CET	57071	53	192.168.2.5	1.1.1.1
Dec 19, 2024 16:10:32.714694977 CET	53	57071	1.1.1.1	192.168.2.5
Dec 19, 2024 16:10:41.984606028 CET	56168	53	192.168.2.5	1.1.1.1
Dec 19, 2024 16:10:42.123823881 CET	53	56168	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 16:09:29.990662098 CET	192.168.2.5	1.1.1.1	0xe422	Standard query (0)	muuxxu.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:09:30.991822004 CET	192.168.2.5	1.1.1.1	0xe422	Standard query (0)	muuxxu.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:09:32.028578043 CET	192.168.2.5	1.1.1.1	0xe422	Standard query (0)	muuxxu.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:09:39.929554939 CET	192.168.2.5	1.1.1.1	0xa8fd	Standard query (0)	cronoze.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:09:54.898652077 CET	192.168.2.5	1.1.1.1	0xf41c	Standard query (0)	cronoze.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:31.802315950 CET	192.168.2.5	1.1.1.1	0x71d6	Standard query (0)	cronoze.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:41.984606028 CET	192.168.2.5	1.1.1.1	0x573f	Standard query (0)	muuxxu.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 16:09:32.958163977 CET	1.1.1.1	192.168.2.5	0xe422	Server failure (2)	muuxxu.com	none	none	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:09:32.958184004 CET	1.1.1.1	192.168.2.5	0xe422	Server failure (2)	muuxxu.com	none	none	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:09:34.701870918 CET	1.1.1.1	192.168.2.5	0xe422	Server failure (2)	muuxxu.com	none	none	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:09:40.067774057 CET	1.1.1.1	192.168.2.5	0xa8fd	No error (0)	cronoze.com		94.232.40.41	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:09:55.780354023 CET	1.1.1.1	192.168.2.5	0xf41c	No error (0)	cronoze.com		94.232.40.41	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:32.714694977 CET	1.1.1.1	192.168.2.5	0x71d6	No error (0)	cronoze.com		94.232.40.41	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:42.123823881 CET	1.1.1.1	192.168.2.5	0x573f	No error (0)	muuxxu.com		94.232.46.11	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:09:21
Start date:	19/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\gpufault.dll.dll"
Imagebase:	0x7ff60a0a0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:09:21
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:09:22
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",#1
Imagebase:	0x7ff6c9d10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:09:22
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,DllMain
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:09:22
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",#1
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:09:24
Start date:	19/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7424 -s 496
Imagebase:	0x7ff6899f0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:09:24
Start date:	19/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7408 -s 488
Imagebase:	0x7ff6899f0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:09:25
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,GfeXcodeFunc
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 0000000B.00000002.3478193493.00000207037A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 0000000B.00000002.3477789509.000002070365C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 0000000B.00000002.3477789509.0000020703704000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	10:09:28
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\gpufault.dll.dll,GfeXcodeFuncEx
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:09:29
Start date:	19/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7700 -s 492
Imagebase:	0x7ff6899f0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",DllMain
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeFunc
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000010.00000002.3479968792.00000260C38BC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000010.00000002.3479968792.00000260C392C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000010.00000003.3412211804.00000260C37DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000010.00000002.3479757956.00000260C37AC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeFuncEx
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NvOptimusEnablementCuda
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_Shutdown
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_ReleaseFeature
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_Init
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_GetScratchBufferSize
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_GetParameters
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_EvaluateFeature
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",NVSDK_NGX_CUDA_CreateFeature
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:09:32
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeMontage
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:09:33
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeImageEx
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:09:33
Start date:	19/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\gpufault.dll.dll",GfeXcodeImage
Imagebase:	0x7ff7a5170000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:09:36
Start date:	19/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7968 -s 496
Imagebase:	0x7ff6899f0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:10:54
Start date:	19/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	16.9%
Total number of Nodes:	260
Total number of Limit Nodes:	8

Executed Functions

Function 00000001800026C0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 269
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000180002CB0: GetModuleFileNameW.KERNEL32 ref: 0000000180002CFC

GetModuleFileNameW.KERNEL32 ref: 000000018000276F
SHGetSpecialFolderPathW.SHELL32 ref: 0000000180002786
lstrcatW.KERNEL32 ref: 000000018000279A
lstrcatW.KERNEL32 ref: 00000001800027AE
lstrcatW.KERNEL32 ref: 00000001800027C2
lstrcatW.KERNEL32 ref: 00000001800027D6
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0000000180002B4F

Strings

GfeXcodeFunc, xrefs: 0000000180002A43
\NTUSER.DAT.Not, xrefs: 000000018000278C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: lstrcat$FileModuleName$FolderIos_base_dtorPathSpecialstd::ios_base::_
String ID: GfeXcodeFunc$\NTUSER.DAT.Not
API String ID: 2606783807-3673055099
Opcode ID: f4fb330f2fce6a57cdb251511d5a633e98aa520d2ba9185056906fd6c2a3254f
Instruction ID: 5b91f0b68c497ecbefdd096ad22c36a01d1dfa7b74f7b8fae1d4cb91b2026b10
Opcode Fuzzy Hash: f4fb330f2fce6a57cdb251511d5a633e98aa520d2ba9185056906fd6c2a3254f
Instruction Fuzzy Hash: 0EE15B32224B8989EBA1DF24D8943DD3761F7897C8F809126F64D47AA9DF74C64DC740

Function 0000014F6D6E0B00 Relevance: 4.1, APIs: 3, Instructions: 371
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000014F6D6E0C5E
VirtualAlloc.KERNELBASE ref: 0000014F6D6E0CCC

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7479d515978b8398c8f18a7fbb8c6ce0b9f2a044b6e8d29228c90f9ede51720f
Instruction ID: e47c8d53f0584fd3eb663a74ad941ac586dcface026ce69fbc804d2ebe05827c
Opcode Fuzzy Hash: 7479d515978b8398c8f18a7fbb8c6ce0b9f2a044b6e8d29228c90f9ede51720f
Instruction Fuzzy Hash: 67E1EC30218B489FE794DB18C498B6AB7E0FB9C359F50496DE489C73A1DB75D8C2CB06

Non-executed Functions

Function 00000001800330A8 Relevance: 29.1, APIs: 19, Instructions: 555
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00000001800341D7

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_malloc_crt.LIBCMT ref: 00000001800341FE

Part of subcall function 0000000180031B68: malloc.LIBCMT ref: 0000000180031B93
Part of subcall function 0000000180031B68: Sleep.KERNEL32(?,?,00000000,00000001800302E4,?,?,00000000,00000001800301E3,?,?,00000000,0000000180038B02,?,?,00000000,0000000180038A6E), ref: 0000000180031BA6

_invoke_watson.LIBCMT ref: 0000000180034821
_invoke_watson.LIBCMT ref: 0000000180034837
_invoke_watson.LIBCMT ref: 000000018003484D
_invoke_watson.LIBCMT ref: 0000000180034863
_invoke_watson.LIBCMT ref: 0000000180034879
_invoke_watson.LIBCMT ref: 000000018003488F
_invoke_watson.LIBCMT ref: 00000001800348A5
_invoke_watson.LIBCMT ref: 00000001800348BB
_invoke_watson.LIBCMT ref: 00000001800348D1
_invoke_watson.LIBCMT ref: 00000001800348E7
_invoke_watson.LIBCMT ref: 00000001800348FD
_invoke_watson.LIBCMT ref: 0000000180034913
_invoke_watson.LIBCMT ref: 0000000180034929
_invoke_watson.LIBCMT ref: 000000018003493F
_invoke_watson.LIBCMT ref: 0000000180034955
_invoke_watson.LIBCMT ref: 000000018003496B
_invoke_watson.LIBCMT ref: 0000000180034981

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _invoke_watson$Locale$SleepUpdateUpdate::___updatetlocinfo__updatetmbcinfo_getptd_malloc_crtmalloc
String ID:
API String ID: 3294838543-0
Opcode ID: 521078f5cd82ac0f084921f5033d007348db3b2902225dc428b05784ca17b11c
Instruction ID: 084eb429915106ff2183acdcc5e5956807c1a06688872eada26f31bf39ac8827
Opcode Fuzzy Hash: 521078f5cd82ac0f084921f5033d007348db3b2902225dc428b05784ca17b11c
Instruction Fuzzy Hash: C8220332320A4882EBA7DA65E51A3EF2391F7497C4F45D126EF4E8E695DF38D6098300

Function 00000001800176E4 Relevance: 22.1, APIs: 10, Strings: 2, Instructions: 1114COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000F2A8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2C9
Part of subcall function 000000018000F2A8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2EE

_Mpunct.LIBCPMT ref: 00000001800178AF
_Mpunct.LIBCPMT ref: 0000000180017E71
_Mpunct.LIBCPMT ref: 0000000180017E94
_Mpunct.LIBCPMT ref: 0000000180017F99
_Mpunct.LIBCPMT ref: 0000000180017FFE
_Mpunct.LIBCPMT ref: 0000000180018024
_Mpunct.LIBCPMT ref: 000000018001812B
_Mpunct.LIBCPMT ref: 0000000180018191
_Mpunct.LIBCPMT ref: 00000001800181D6
_Mpunct.LIBCPMT ref: 000000018001821B

Strings

, xrefs: 000000018001850A
0123456789-, xrefs: 000000018001783F, 00000001800179A1, 0000000180017BCB, 0000000180017DB4

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID: $0123456789-
API String ID: 491317670-700845222
Opcode ID: bfea4566b3dd4f2453845a7a2c0565e6247bc10b50b38d8d916d4313fb2cf9fb
Instruction ID: a70e222771d2648924d77d9fb61618b5019d1f7d64ecee5f6b6d25d0e3028cf4
Opcode Fuzzy Hash: bfea4566b3dd4f2453845a7a2c0565e6247bc10b50b38d8d916d4313fb2cf9fb
Instruction Fuzzy Hash: 99A26D32704A8885EBA68B65D0503ED27B1FB49BC8F54D016EE4E1BB96DF34CB99D340

Function 0000000180016744 Relevance: 22.1, APIs: 10, Strings: 2, Instructions: 1110COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000F048: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F069
Part of subcall function 000000018000F048: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F08E

_Mpunct.LIBCPMT ref: 000000018001690F
_Mpunct.LIBCPMT ref: 0000000180016ED1
_Mpunct.LIBCPMT ref: 0000000180016EF4
_Mpunct.LIBCPMT ref: 0000000180016FF9
_Mpunct.LIBCPMT ref: 000000018001705E
_Mpunct.LIBCPMT ref: 0000000180017084
_Mpunct.LIBCPMT ref: 000000018001718B
_Mpunct.LIBCPMT ref: 00000001800171F1
_Mpunct.LIBCPMT ref: 0000000180017236
_Mpunct.LIBCPMT ref: 000000018001727B

Strings

0123456789-, xrefs: 000000018001689F, 0000000180016A01, 0000000180016C2B, 0000000180016E14
, xrefs: 000000018001756A

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID: $0123456789-
API String ID: 491317670-700845222
Opcode ID: 7023ceb1d819ec1a1cf44c7629e55f05b0496f09250da5da42953131b9d5b64b
Instruction ID: 80943f5e6f8277e2c6515c65fe0f4c286d5afc9ab992b988177440c4078c9487
Opcode Fuzzy Hash: 7023ceb1d819ec1a1cf44c7629e55f05b0496f09250da5da42953131b9d5b64b
Instruction Fuzzy Hash: 3FA26F32B04A8885EBA68B65D4503ED27B1FB49BC8F54D416FE4E17BA5DF34CA99C300

Function 0000000180024F60 Relevance: 22.1, APIs: 10, Strings: 2, Instructions: 1051COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180023DE4: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E05
Part of subcall function 0000000180023DE4: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E2A

_Mpunct.LIBCPMT ref: 0000000180025125
_Mpunct.LIBCPMT ref: 0000000180025675
_Mpunct.LIBCPMT ref: 0000000180025692
_Mpunct.LIBCPMT ref: 0000000180025784
_Mpunct.LIBCPMT ref: 00000001800257BB
_Mpunct.LIBCPMT ref: 00000001800257DF
_Mpunct.LIBCPMT ref: 00000001800258D3
_Mpunct.LIBCPMT ref: 0000000180025908
_Mpunct.LIBCPMT ref: 0000000180025948
_Mpunct.LIBCPMT ref: 0000000180025988

Strings

0123456789-, xrefs: 00000001800250C1, 0000000180025202, 000000018002540A, 00000001800255C0
, xrefs: 0000000180025C35

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID: $0123456789-
API String ID: 491317670-700845222
Opcode ID: 5b1f11ae308e5f978eadb6c2e653d3aa161437b62689c1e79878b92cd71a40da
Instruction ID: 357b8073b20dd1810e5d3b735acf5af2621e0edfda92cd437dcbf710b5a8daa8
Opcode Fuzzy Hash: 5b1f11ae308e5f978eadb6c2e653d3aa161437b62689c1e79878b92cd71a40da
Instruction Fuzzy Hash: 10A2C032604A8889FBA7CB65C4503EC27A1F749BC9F94C516EE8A1B7D6CF79C649C304

Function 0000014F6D6F4B74 Relevance: 10.2, APIs: 2, Strings: 3, Instructions: 1427COMMON

Download Yara Rule

APIs

Part of subcall function 0000014F6D6F099C: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F09BD
Part of subcall function 0000014F6D6F099C: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F09E2

_Mpunct.LIBCPMT ref: 0000014F6D6F4C12
localeconv.LIBCMT ref: 0000014F6D6F52AB

Strings

$, xrefs: 0000014F6D6F51C2
$, xrefs: 0000014F6D6F5419
$, xrefs: 0000014F6D6F4F8E

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunctlocaleconv
String ID: $$$$$
API String ID: 3643605086-798797307
Opcode ID: de7f32cb9cfaedb0ef4f0bd285982f3d11804978a18d4d72b42dcd5140998823
Instruction ID: 9f92e7532cd93d23b386d412047ce8ed8b6fafe4137dda24d7f8ee14cb7f6e81
Opcode Fuzzy Hash: de7f32cb9cfaedb0ef4f0bd285982f3d11804978a18d4d72b42dcd5140998823
Instruction Fuzzy Hash: 36A29030218E4A8EEB64DB18C0517B977E2FF59304F65816DE486C77E2DB62EC878781

Function 0000014F6D6F57C0 Relevance: 10.2, APIs: 2, Strings: 3, Instructions: 1427COMMON

Download Yara Rule

APIs

Part of subcall function 0000014F6D6F0ACC: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0AED
Part of subcall function 0000014F6D6F0ACC: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0B12

_Mpunct.LIBCPMT ref: 0000014F6D6F585E
localeconv.LIBCMT ref: 0000014F6D6F5EF7

Strings

$, xrefs: 0000014F6D6F5BDA
$, xrefs: 0000014F6D6F5E0E
$, xrefs: 0000014F6D6F6065

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunctlocaleconv
String ID: $$$$$
API String ID: 3643605086-798797307
Opcode ID: 739dda484fa1ff785b454b709008984a0ecd5e28b60eb90b212d17772f0f97fb
Instruction ID: 09dd3d580d3076b75cfdd255743970d9d96740ef80b0c2e64ec8b4460287ede5
Opcode Fuzzy Hash: 739dda484fa1ff785b454b709008984a0ecd5e28b60eb90b212d17772f0f97fb
Instruction Fuzzy Hash: B7A24E30218E4A8EEB68DB58C0517B977E2FF59304F65916DE486C73E2DB22DC878781

Function 0000014F6D6EA77C Relevance: 10.1, APIs: 2, Strings: 3, Instructions: 1364COMMON

Download Yara Rule

APIs

Part of subcall function 0000014F6D6E9304: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E9325
Part of subcall function 0000014F6D6E9304: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E934A

_Mpunct.LIBCPMT ref: 0000014F6D6EA816
localeconv.LIBCMT ref: 0000014F6D6EAE3B

Strings

$, xrefs: 0000014F6D6EAD6B
$, xrefs: 0000014F6D6EAB50
$, xrefs: 0000014F6D6EAF8A

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunctlocaleconv
String ID: $$$$$
API String ID: 3643605086-798797307
Opcode ID: 46d5899b347bd0327edc0bc1417850ad2dee7be2ed0c972db27f3b5199f6fb28
Instruction ID: 150d0d8087091b91544893a6f74e2d482aef63f19d98ebab66a486b0bf11d1e3
Opcode Fuzzy Hash: 46d5899b347bd0327edc0bc1417850ad2dee7be2ed0c972db27f3b5199f6fb28
Instruction Fuzzy Hash: 65A27F3061CA898FEB59DB1C8051BB9B7E1FF55304F6641ACD49AC73E2D722D8878781

Function 0000014F6D6F3524 Relevance: 10.1, APIs: 2, Strings: 3, Instructions: 1307COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000014F6D6F35E1

Part of subcall function 0000014F6D6F4B74: _Mpunct.LIBCPMT ref: 0000014F6D6F4C12

Strings

$, xrefs: 0000014F6D6F3CAC
$, xrefs: 0000014F6D6F381A
$, xrefs: 0000014F6D6F3A55

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID: $$$$$
API String ID: 4240859931-798797307
Opcode ID: dea8d81eb90b03ea093bd0c9c32d4d62896bdf0c9c8810b07f5e772d70f40c4e
Instruction ID: 4cd3912bd5cb1b5602975ded68cde231558fc745e5198af10d631fd5d24dc1ca
Opcode Fuzzy Hash: dea8d81eb90b03ea093bd0c9c32d4d62896bdf0c9c8810b07f5e772d70f40c4e
Instruction Fuzzy Hash: AD926130618E4E8FEB689B18C0517B977E2FF59304F65516DE486C73E2DB22D8878782

Function 0000014F6D6F404C Relevance: 10.1, APIs: 2, Strings: 3, Instructions: 1307COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000014F6D6F4109

Part of subcall function 0000014F6D6F57C0: _Mpunct.LIBCPMT ref: 0000014F6D6F585E

Strings

$, xrefs: 0000014F6D6F47D4
$, xrefs: 0000014F6D6F457D
$, xrefs: 0000014F6D6F4342

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID: $$$$$
API String ID: 4240859931-798797307
Opcode ID: a45883884af2f9092d6930d5bc0ae63167e6dbfecd7940f0f8a18dacc5b11785
Instruction ID: 080b1c85f6f879bb8ab7362655ded4f362d89c41e7cd819ee02b471677535a5f
Opcode Fuzzy Hash: a45883884af2f9092d6930d5bc0ae63167e6dbfecd7940f0f8a18dacc5b11785
Instruction Fuzzy Hash: EE929430218E4E8FEB64DB1881517B973E2FF59304F65516DE486C7BE2DB62E8838781

Function 0000014F6D6E9D40 Relevance: 10.0, APIs: 2, Strings: 3, Instructions: 1240COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000014F6D6E9DFC

Part of subcall function 0000014F6D6EA77C: _Mpunct.LIBCPMT ref: 0000014F6D6EA816

Strings

$, xrefs: 0000014F6D6E9FFF
$, xrefs: 0000014F6D6EA428
$, xrefs: 0000014F6D6EA216

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID: $$$$$
API String ID: 4240859931-798797307
Opcode ID: 250d299e7546f7b33e44016f3427d9e28b995195a33efc58c9659dec02ea6d6c
Instruction ID: c2d57581c51562ef668978be7aaa7caf55874e67342c4e8a7e9eedf02bf08b57
Opcode Fuzzy Hash: 250d299e7546f7b33e44016f3427d9e28b995195a33efc58c9659dec02ea6d6c
Instruction Fuzzy Hash: E092BF3061CA498FEB69DB2C8051BE8B7F2FF56304F6541ADD496C73E2D622D8878781

Function 000000018001B924 Relevance: 6.5, APIs: 4, Instructions: 543COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 000000018001BA07
_Mpunct.LIBCPMT ref: 000000018001BB21
_Mpunct.LIBCPMT ref: 000000018001BBAA

Part of subcall function 000000018000F2A8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2C9
Part of subcall function 000000018000F2A8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2EE

_Mpunct.LIBCPMT ref: 000000018001BB3A

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID:
API String ID: 491317670-0
Opcode ID: 32a054681ada761a3f21b934110cbacde2a58451cc4452ceb2e2b32a685144d7
Instruction ID: ae333f1357bb5ac04765cce638402cad7685101a5c7d4aa2e7d208c612dcf27a
Opcode Fuzzy Hash: 32a054681ada761a3f21b934110cbacde2a58451cc4452ceb2e2b32a685144d7
Instruction Fuzzy Hash: 1F32B032604E9885EBA68F25D8453ED63A4F75CBC8F548111FB8957B99EF38CA89C340

Function 000000018001B138 Relevance: 6.5, APIs: 4, Instructions: 543COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 000000018001B21B
_Mpunct.LIBCPMT ref: 000000018001B335
_Mpunct.LIBCPMT ref: 000000018001B3BE

Part of subcall function 000000018000F048: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F069
Part of subcall function 000000018000F048: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F08E

_Mpunct.LIBCPMT ref: 000000018001B34E

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID:
API String ID: 491317670-0
Opcode ID: d8653a78ccc0500016ee3a39bc8ed8050953f96735a7a63760c9342397005fa0
Instruction ID: 4647e442d3bcfc851c9f4701ce4f14d67acf718bc96bb144a9f397481643842c
Opcode Fuzzy Hash: d8653a78ccc0500016ee3a39bc8ed8050953f96735a7a63760c9342397005fa0
Instruction Fuzzy Hash: 9C32B132604E9886EBA29F25D8453ED63A5F758BC8F54C111FF8957B99EF38C689C300

Function 0000000180026890 Relevance: 6.5, APIs: 4, Instructions: 524COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 000000018002696A
_Mpunct.LIBCPMT ref: 0000000180026AA6
_Mpunct.LIBCPMT ref: 0000000180026B14

Part of subcall function 0000000180023DE4: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E05
Part of subcall function 0000000180023DE4: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E2A

_Mpunct.LIBCPMT ref: 0000000180026AC2

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID:
API String ID: 491317670-0
Opcode ID: 72a7ac2e2c1f111e1b61ae734374779d00f08ed685c08311d7ac3453d226d6ed
Instruction ID: 2589bcd918802237b5c990292f2751727b1abcad383ca43231b0e5c6f6b0472f
Opcode Fuzzy Hash: 72a7ac2e2c1f111e1b61ae734374779d00f08ed685c08311d7ac3453d226d6ed
Instruction Fuzzy Hash: 93324E72A04BC885EB678F25C4503ED6761F399BC8F54C112EA8D57BAADF39C689C340

Function 00000001800147EC Relevance: 6.2, APIs: 2, Strings: 1, Instructions: 962COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000FAF8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB19
Part of subcall function 000000018000FAF8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB3E

_Mpunct.LIBCPMT ref: 000000018001488A
localeconv.LIBCMT ref: 0000000180014F23

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 00000001800148DA, 0000000180014C1B, 0000000180014E4D, 0000000180015096, 00000001800153AC

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunctlocaleconv
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 3643605086-3606100449
Opcode ID: 94432bfd2f8d95df277d2e9dbc6edac5d8f0baf28bc49a8a7a32c7f5d36230e7
Instruction ID: 5ab51ccc94a7dab44ec95765bb0b019680b649c223dae5af60e6b35ee96dccf9
Opcode Fuzzy Hash: 94432bfd2f8d95df277d2e9dbc6edac5d8f0baf28bc49a8a7a32c7f5d36230e7
Instruction Fuzzy Hash: C8925E37204A88C5EBA68B65C1503FD37A1FB49BC4F54C016EE9A1BBA5DF35CA5AC310

Function 0000000180013BA0 Relevance: 6.2, APIs: 2, Strings: 1, Instructions: 962COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000F9C8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F9E9
Part of subcall function 000000018000F9C8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FA0E

_Mpunct.LIBCPMT ref: 0000000180013C3E
localeconv.LIBCMT ref: 00000001800142D7

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 0000000180013C8E, 0000000180013FCF, 0000000180014201, 000000018001444A, 0000000180014760

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunctlocaleconv
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 3643605086-3606100449
Opcode ID: 2b3747df4bcc6815d0ca050ff0a1d26fc9399c5a2f48bb3d04cf2418fda5afce
Instruction ID: 15170c7321f925de93854cd2b60bf2d9794a6949502e19fd89cf563b34aba275
Opcode Fuzzy Hash: 2b3747df4bcc6815d0ca050ff0a1d26fc9399c5a2f48bb3d04cf2418fda5afce
Instruction Fuzzy Hash: 46927E37204A88C5EBA68B66D1503FD27A1FB49BC8F54C415EF5A1B7A1CF35CA9AC310

Function 00000001800097A8 Relevance: 6.2, APIs: 2, Strings: 1, Instructions: 928COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180008330: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008351
Part of subcall function 0000000180008330: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008376

_Mpunct.LIBCPMT ref: 0000000180009842
localeconv.LIBCMT ref: 0000000180009E67

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 0000000180009892, 0000000180009B91, 0000000180009D26, 0000000180009F44, 000000018000A219

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunctlocaleconv
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 3643605086-3606100449
Opcode ID: ee78207987aaf8e6898c223f5fdc8bfa83aea163ec8c7af802b6eb0c56abaefe
Instruction ID: 0951dfdd3adb040bfd2425e3f0e5ac157d4fc1802d06d2afbb1654cb7f49c3dd
Opcode Fuzzy Hash: ee78207987aaf8e6898c223f5fdc8bfa83aea163ec8c7af802b6eb0c56abaefe
Instruction Fuzzy Hash: A782B4323096888AFBA6CBA581503FD3BA1F74ABC4F54C115EF9907796CF25CA5AC310

Function 0000000180013078 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 870COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000000180013135

Part of subcall function 00000001800147EC: _Mpunct.LIBCPMT ref: 000000018001488A

Strings

0123456789-+Ee, xrefs: 0000000180013192, 0000000180013383, 00000001800135BC, 0000000180013805, 0000000180013B1B

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID: 0123456789-+Ee
API String ID: 4240859931-1347306980
Opcode ID: d972bc5eca4d0b82fe2e94bffa6b7d9434b9e5222b7b794ba326fb571b0aa537
Instruction ID: 7fa30803b5596d2040c40fa2d6deab6b9b1eebdfa1222772e05d0cd440f79c75
Opcode Fuzzy Hash: d972bc5eca4d0b82fe2e94bffa6b7d9434b9e5222b7b794ba326fb571b0aa537
Instruction Fuzzy Hash: E882A032208A8886FBA68B65C1523FD37A1FB49BC4F54C416EF4A17B95DF39CA59C310

Function 0000000180012550 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 870COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 000000018001260D

Part of subcall function 0000000180013BA0: _Mpunct.LIBCPMT ref: 0000000180013C3E

Strings

0123456789-+Ee, xrefs: 000000018001266A, 000000018001285B, 0000000180012A94, 0000000180012CDD, 0000000180012FF3

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID: 0123456789-+Ee
API String ID: 4240859931-1347306980
Opcode ID: 821b9d4d01ecd75d4b1e2aa44c8194800fa5c52a50f71f3b929308d42d9b6223
Instruction ID: 541b46e9ef04b4a6691a8844132f360519d1f98d966391b6e758a932985ee6d9
Opcode Fuzzy Hash: 821b9d4d01ecd75d4b1e2aa44c8194800fa5c52a50f71f3b929308d42d9b6223
Instruction Fuzzy Hash: CF829036204A888AFBA68B65C1503FD37A1FB49BC4F54D416EF4A17795EF34CA69C310

Function 0000000180032E14 Relevance: 6.1, APIs: 4, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180032E3E

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_malloc_crt.LIBCMT ref: 0000000180032E7E
_invoke_watson.LIBCMT ref: 0000000180032F3C

Part of subcall function 0000000180035CD8: _call_reportfault.LIBCMT ref: 0000000180035D00

_invoke_watson.LIBCMT ref: 0000000180032F52

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID:
API String ID: 1584724053-0
Opcode ID: bb9541adda1de7d3445963b5d25e419d471c8ff25f1e67a4739099756cf48ec5
Instruction ID: 3aca14fc27a6a15d1b1d6d791e791982332b7847b4ff029bd85a204ab66ebf99
Opcode Fuzzy Hash: bb9541adda1de7d3445963b5d25e419d471c8ff25f1e67a4739099756cf48ec5
Instruction Fuzzy Hash: A331C53232078885EB97DB26D5093DE7795E789BC4F19C135BE8E4BB9ACE38C1068304

Function 0000000180008D6C Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 834COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000000180008E28

Part of subcall function 00000001800097A8: _Mpunct.LIBCPMT ref: 0000000180009842

Strings

0123456789-+Ee, xrefs: 0000000180008E7D, 000000018000903F, 00000001800091D0, 00000001800093E2, 00000001800096B6

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID: 0123456789-+Ee
API String ID: 4240859931-1347306980
Opcode ID: e67974f2d9ac711acb042ba2c3b51c72e12c7e8c571ddf96fbd68d540ecca808
Instruction ID: e252262f3d62f599d6f49dd2fa522cb368fb81fbd5ecc78d30e2ce65ba09eaa7
Opcode Fuzzy Hash: e67974f2d9ac711acb042ba2c3b51c72e12c7e8c571ddf96fbd68d540ecca808
Instruction Fuzzy Hash: 9372A23260A68899FB96CBA681503EC3BA1BB49BC8F54C155EF99077D6CF35C65EC300

Function 00000001800158A0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 467COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000F9C8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F9E9
Part of subcall function 000000018000F9C8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FA0E

_Mpunct.LIBCPMT ref: 00000001800158FB

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 0000000180015936, 0000000180015C83

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2786813426-2799312399
Opcode ID: 310c16e434c6fb425f377aa5a3344d56e60155a5009237bc210dd0dc5f72e661
Instruction ID: 5fe4dd189a2d79ce61165057c9ebb2e090cd9d14d433b9fec00325c66f72dead
Opcode Fuzzy Hash: 310c16e434c6fb425f377aa5a3344d56e60155a5009237bc210dd0dc5f72e661
Instruction Fuzzy Hash: F0129C36704A88C9FBA28F65D0507ED27A1EB49BC9F54C112EE8A1F789DF35CA49C350

Function 0000000180015EA0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 467COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000FAF8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB19
Part of subcall function 000000018000FAF8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB3E

_Mpunct.LIBCPMT ref: 0000000180015EFB

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 0000000180015F36, 0000000180016283

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2786813426-2799312399
Opcode ID: 7f9bde8d58b3e2620bf608a5cc9520c0ecd61f189b4a8a455c5414453c571840
Instruction ID: 027a829814d0a7af50161521d001647e6a208036f76e6a0cfd0a3acd19813199
Opcode Fuzzy Hash: 7f9bde8d58b3e2620bf608a5cc9520c0ecd61f189b4a8a455c5414453c571840
Instruction Fuzzy Hash: 3312C036B04A8885FBA3CB65C4507ED37A1E749BC8F58C016EE4A1B7A5CF35CA49C340

Function 000000018000A314 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 451COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180008330: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008351
Part of subcall function 0000000180008330: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008376

_Mpunct.LIBCPMT ref: 000000018000A36E

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 000000018000A3A5, 000000018000A6A9

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2786813426-2799312399
Opcode ID: cc0dd99451e0eb2a4836ac02799361a5a9bcabcee1e262923024bb7c99d54d77
Instruction ID: f7f63c79d1b94fbb45dab63fbf242b30916648d9a31090d02f6495e4854cce8f
Opcode Fuzzy Hash: cc0dd99451e0eb2a4836ac02799361a5a9bcabcee1e262923024bb7c99d54d77
Instruction Fuzzy Hash: B9129036708A8889FB92CA75C4503EC3BB1A74ABD8F58C115EE491B796CF75CA4EC350

Function 0000014F6D71407C Relevance: 3.9, APIs: 2, Instructions: 885COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000014F6D7151AB

Part of subcall function 0000014F6D710320: _getptd.LIBCMT ref: 0000014F6D710336
Part of subcall function 0000014F6D710320: __updatetlocinfo.LIBCMT ref: 0000014F6D71036B
Part of subcall function 0000014F6D710320: __updatetmbcinfo.LIBCMT ref: 0000014F6D710392

_malloc_crt.LIBCMT ref: 0000014F6D7151D2

Part of subcall function 0000014F6D712B3C: malloc.LIBCMT ref: 0000014F6D712B67

Part of subcall function 0000014F6D716920: _errno.LIBCMT ref: 0000014F6D716938
Part of subcall function 0000014F6D716920: _invalid_parameter_noinfo.LIBCMT ref: 0000014F6D716944

Part of subcall function 0000014F6D716920: _errno.LIBCMT ref: 0000014F6D716971

Part of subcall function 0000014F6D71F1EC: _errno.LIBCMT ref: 0000014F6D71F208
Part of subcall function 0000014F6D71F1EC: _invalid_parameter_noinfo.LIBCMT ref: 0000014F6D71F214

Part of subcall function 0000014F6D71F1EC: _errno.LIBCMT ref: 0000014F6D71F247

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_getptd_malloc_crtmalloc
String ID:
API String ID: 2296220707-0
Opcode ID: 6aa674c8055749afedaf64fe2c3a3141dc6f8a211f07435de9dbe9f590e5f553
Instruction ID: f7c3889b3240cb0e23ee4aa196729cc093d927e78dc09e0c0d38c7c65f42a835
Opcode Fuzzy Hash: 6aa674c8055749afedaf64fe2c3a3141dc6f8a211f07435de9dbe9f590e5f553
Instruction Fuzzy Hash: AA42D331624E084BEB6CEE79AC453FA73E9FB54305F46473DD48AC22E2DE3594878582

Function 0000014F6D6F6E74 Relevance: 2.2, APIs: 1, Instructions: 691COMMON

Download Yara Rule

APIs

Part of subcall function 0000014F6D6F0ACC: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0AED
Part of subcall function 0000014F6D6F0ACC: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0B12

_Mpunct.LIBCPMT ref: 0000014F6D6F6ECF

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID:
API String ID: 2786813426-0
Opcode ID: 338b4745d7817e22ed531aa30d34ef30cb1126a406b7a7250f786f6465d72d79
Instruction ID: f3d6b478e89e107b2cd8eafa4ada459008229c986a675fe935dd55ec07a16b1f
Opcode Fuzzy Hash: 338b4745d7817e22ed531aa30d34ef30cb1126a406b7a7250f786f6465d72d79
Instruction Fuzzy Hash: 07327230A18E4D8BEB69DB18C0907B977E2EF55300F6541BDD44ACB3E6DA22D887C791

Function 0000014F6D6F6874 Relevance: 2.2, APIs: 1, Instructions: 691COMMON

Download Yara Rule

APIs

Part of subcall function 0000014F6D6F099C: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F09BD
Part of subcall function 0000014F6D6F099C: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F09E2

_Mpunct.LIBCPMT ref: 0000014F6D6F68CF

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID:
API String ID: 2786813426-0
Opcode ID: 7da99b54e66c58221cba23ee18baf8fd8b5afb48f2245d11b60346141f264282
Instruction ID: 1fa6abc7561bae9610d6f80f87ec70e5e463a44283fc7ca4200e438f3463a3da
Opcode Fuzzy Hash: 7da99b54e66c58221cba23ee18baf8fd8b5afb48f2245d11b60346141f264282
Instruction Fuzzy Hash: 44329130618E4D8FEB68DB58C0917B973E2EF55304F5641BCD48ACB2E6DA22D88787C5

Function 0000014F6D6EB2E8 Relevance: 2.2, APIs: 1, Instructions: 662COMMON

Download Yara Rule

APIs

Part of subcall function 0000014F6D6E9304: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E9325
Part of subcall function 0000014F6D6E9304: std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E934A

_Mpunct.LIBCPMT ref: 0000014F6D6EB342

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID:
API String ID: 2786813426-0
Opcode ID: 55fa26b6ddb77e03625ea25e3373fd4eec46ccdb51fc570c3a42f5167ddaa1fd
Instruction ID: b643f618861db18edc9282209f4e4e6ad342e913cd15e01c1baf1eb1f17f4996
Opcode Fuzzy Hash: 55fa26b6ddb77e03625ea25e3373fd4eec46ccdb51fc570c3a42f5167ddaa1fd
Instruction Fuzzy Hash: 9C22B33061CB488FEB65DB6C80917E977E1EF55304F6941ACD48ACB3E7D622D8878B81

Function 0000000180019020 Relevance: 1.8, APIs: 1, Instructions: 283COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000000180019172

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID:
API String ID: 4240859931-0
Opcode ID: 63fef931675e363a9749f96429758758dd3006f32cce81dee63d7a14f1cdfd87
Instruction ID: b4b31d92be3c4c8e502b6ea2e0a282e668397faed0ae34e767a83c581478e39b
Opcode Fuzzy Hash: 63fef931675e363a9749f96429758758dd3006f32cce81dee63d7a14f1cdfd87
Instruction Fuzzy Hash: FBC1A232B06A9899FB52CFB5C4013EC63B1BB5DB88F448111EE4967A99DF39C64EC340

Function 00000001800193F0 Relevance: 1.8, APIs: 1, Instructions: 283COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000000180019542

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID:
API String ID: 4240859931-0
Opcode ID: 9787ca75ca63df748a1499e8dd1c5abcefd6f6751ff6d03e7f7fc609e9ac6cfc
Instruction ID: 7c40f0623f709e12c7f828199f14d4f1bd29be792234f51f62a64cc8c6a646a4
Opcode Fuzzy Hash: 9787ca75ca63df748a1499e8dd1c5abcefd6f6751ff6d03e7f7fc609e9ac6cfc
Instruction Fuzzy Hash: B2C1A332B06E9889FB52CFB5D4017EC63B1BB59788F448511EE4967A89EF38C64EC340

Function 00000001800353EC Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,?,?,00000001800423DB,?,?,00000140,0000000180042AAB), ref: 000000018003541D

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: ef170b939dcdfe0a6fa8f39585badaf32e39fbe27d88ffb3e5b79058c9fef6a5
Instruction ID: a17f45a68611e7ce09ab532a4d12380a5d0071377e1487d1a7a9af1b51f9b2a3
Opcode Fuzzy Hash: ef170b939dcdfe0a6fa8f39585badaf32e39fbe27d88ffb3e5b79058c9fef6a5
Instruction Fuzzy Hash: 5EE0EC35A05A0C81F7C74B12FCD57C623A0A75D3C6FE19601E44C56A70CE7883DD8B00

Function 0000000180032DD8 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0000000180032DE3

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8ebd1b43ab214313b2ad0a09dfd0eba3f354677c67a457a5e5e63f9d14e391ab
Instruction ID: 12656fcb5de8b69835b2dd3a9c331cf0c0323df84e8e99bcec695bc93526836d
Opcode Fuzzy Hash: 8ebd1b43ab214313b2ad0a09dfd0eba3f354677c67a457a5e5e63f9d14e391ab
Instruction Fuzzy Hash: 3DC09B33758D0CC2FB6D1BF274953751111D31DB94F0954349D17053508D2C81DD570C

Function 000000018001F28C Relevance: .6, Instructions: 618COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: 11ca8ba6c9e4bc976ad0728efb636439ff8e0f3983e089c52a7ed5c8f874d3e2
Instruction ID: 84605ef311baa56bc5b68e2491e6a8dcf644c937c9e5222fdf1f18ce1bf163ab
Opcode Fuzzy Hash: 11ca8ba6c9e4bc976ad0728efb636439ff8e0f3983e089c52a7ed5c8f874d3e2
Instruction Fuzzy Hash: 0A427A72604A8886FBA68F25D5503BD3361FB89BC8F54D602EF8A17B95DF38C659C300

Function 000000018001FA9C Relevance: .6, Instructions: 618COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: de02513275ad1c1a37e0096a818261c58a998aecf4f08ba4a5899afd53db8295
Instruction ID: 7802ca9db5044afc23cb1f38c8e105cc531337a4395501fdb7ec6a4e23d2f7b6
Opcode Fuzzy Hash: de02513275ad1c1a37e0096a818261c58a998aecf4f08ba4a5899afd53db8295
Instruction Fuzzy Hash: 3D427C32604B4886FBA68B25D5803BD7361FB89BC8F54C512EF8A17B96DF39C659C300

Function 00000001800279B8 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Stollx
String ID:
API String ID: 3628700584-0
Opcode ID: eb53157097b9bda4a8a3cf500f3039b16533609824c5f9a5ce3e351e3c28d2aa
Instruction ID: 42b5d6b38fa8120ab5fcb54182bbeb98c0f4066ebeec1de4c937208e3a875605
Opcode Fuzzy Hash: eb53157097b9bda4a8a3cf500f3039b16533609824c5f9a5ce3e351e3c28d2aa
Instruction Fuzzy Hash: B8428D72704A8885EBA78B29C5403AD3762FB89BC8F14C616EF9D17796DF39C659C300

Function 0000014F6D70FF14 Relevance: 24.2, APIs: 16, Instructions: 157
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_callnewh.LIBCMT ref: 0000014F6D70FF22
malloc.LIBCMT ref: 0000014F6D70FF2E

Part of subcall function 0000014F6D70EA4C: _FF_MSGBANNER.LIBCMT ref: 0000014F6D70EA7C
Part of subcall function 0000014F6D70EA4C: _NMSG_WRITE.LIBCMT ref: 0000014F6D70EA86
Part of subcall function 0000014F6D70EA4C: _callnewh.LIBCMT ref: 0000014F6D70EABA
Part of subcall function 0000014F6D70EA4C: _errno.LIBCMT ref: 0000014F6D70EAC5
Part of subcall function 0000014F6D70EA4C: _errno.LIBCMT ref: 0000014F6D70EAD0

_CxxThrowException.LIBCMT ref: 0000014F6D70FF77
_heap_init.LIBCMT ref: 0000014F6D70FF92
_mtinit.LIBCMT ref: 0000014F6D70FFA2
_RTC_Initialize.LIBCMT ref: 0000014F6D70FFB2
__crtGetEnvironmentStringsA.LIBCMT ref: 0000014F6D70FFC4

Part of subcall function 0000014F6D71A8C4: _malloc_crt.LIBCMT ref: 0000014F6D71A944
Part of subcall function 0000014F6D71A8C4: free.LIBCMT ref: 0000014F6D71A97C

_ioinit.LIBCMT ref: 0000014F6D70FFD0

Part of subcall function 0000014F6D7173B0: _lock.LIBCMT ref: 0000014F6D7173DA
Part of subcall function 0000014F6D7173B0: _calloc_crt.LIBCMT ref: 0000014F6D7173EE

_setenvp.LIBCMT ref: 0000014F6D70FFE9
_cinit.LIBCMT ref: 0000014F6D70FFF4
_ioterm.LIBCMT ref: 0000014F6D710008

Part of subcall function 0000014F6D7176E0: free.LIBCMT ref: 0000014F6D717731

_ioterm.LIBCMT ref: 0000014F6D710040
_calloc_crt.LIBCMT ref: 0000014F6D710082

Part of subcall function 0000014F6D712ABC: _calloc_impl.LIBCMT ref: 0000014F6D712AEA

_initptd.LIBCMT ref: 0000014F6D7100AA
free.LIBCMT ref: 0000014F6D7100BE

Part of subcall function 0000014F6D70E5C8: _errno.LIBCMT ref: 0000014F6D70E5E8

_freeptd.LIBCMT ref: 0000014F6D7100CF

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: _errnofree$_callnewh_calloc_crt_ioterm$EnvironmentExceptionInitializeStringsThrow__crt_calloc_impl_cinit_freeptd_heap_init_initptd_ioinit_lock_malloc_crt_mtinit_setenvpmalloc
String ID:
API String ID: 712202392-0
Opcode ID: f606bec95c8351cef9193d2c7a4d89ca438d0247e1a5451a6bfea034d3d10262
Instruction ID: 90bee469cacdccf154b277813f9524bd1b6a9d408072cb1dd91a237a740ea656
Opcode Fuzzy Hash: f606bec95c8351cef9193d2c7a4d89ca438d0247e1a5451a6bfea034d3d10262
Instruction Fuzzy Hash: 3651A2706046068AFB64BB798C457E971D8AB58340F5B473DA406D23F3EE29D5C78323

Function 00000001800368B0 Relevance: 18.1, APIs: 12, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(?,?,?,000000018002F067), ref: 00000001800368C1
free.LIBCMT ref: 00000001800368DE

Part of subcall function 000000018002D5F4: HeapFree.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D60A
Part of subcall function 000000018002D5F4: _errno.LIBCMT ref: 000000018002D614
Part of subcall function 000000018002D5F4: GetLastError.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D61C

free.LIBCMT ref: 00000001800368F3
free.LIBCMT ref: 0000000180036914
free.LIBCMT ref: 0000000180036929
free.LIBCMT ref: 000000018003693D
free.LIBCMT ref: 0000000180036949
free.LIBCMT ref: 0000000180036974
EncodePointer.KERNEL32(?,?,?,000000018002F067), ref: 000000018003697C
free.LIBCMT ref: 0000000180036995
free.LIBCMT ref: 00000001800369AE
free.LIBCMT ref: 00000001800369DF

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID:
API String ID: 4099253644-0
Opcode ID: c236f47fa00f1eb095f464021b61fc5b1928e1c18c896dc44bc4746b0c097f4e
Instruction ID: e2653a9f16c68cd9db8ac6c19f3406fb9b710f8bb8de90df47967776b1696018
Opcode Fuzzy Hash: c236f47fa00f1eb095f464021b61fc5b1928e1c18c896dc44bc4746b0c097f4e
Instruction Fuzzy Hash: 6B314E31601A4C89FED7DB11E9613E563A0BB4D7D4F19C226BA190AAE5DFBCC68D8301

Function 00000001800012F0 Relevance: 15.1, APIs: 10, Instructions: 85
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000132B

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000018000136C

Part of subcall function 000000018000775C: setlocale.LIBCMT ref: 0000000180007770
Part of subcall function 000000018000775C: setlocale.LIBCMT ref: 0000000180007799

_Getcvt.LIBCPMT ref: 0000000180001376

Part of subcall function 00000001800073D0: ___lc_codepage_func.LIBCMT ref: 00000001800073F4
Part of subcall function 00000001800073D0: ___mb_cur_max_func.LIBCMT ref: 00000001800073FB
Part of subcall function 00000001800073D0: ___lc_locale_name_func.LIBCMT ref: 0000000180007403

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 000000018000139E

Part of subcall function 00000001800077C8: setlocale.LIBCMT ref: 00000001800077E2

free.LIBCMT ref: 00000001800013AC

Part of subcall function 000000018002D5F4: HeapFree.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D60A
Part of subcall function 000000018002D5F4: _errno.LIBCMT ref: 000000018002D614
Part of subcall function 000000018002D5F4: GetLastError.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D61C

free.LIBCMT ref: 00000001800013BE
free.LIBCMT ref: 00000001800013D0
free.LIBCMT ref: 00000001800013E2
free.LIBCMT ref: 00000001800013F4
free.LIBCMT ref: 0000000180001406

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: free$setlocalestd::_$Locinfo::_$ErrorFreeGetcvtHeapLastLocinfo_ctorLocinfo_dtorLockitLockit::____lc_codepage_func___lc_locale_name_func___mb_cur_max_func_errno_lock
String ID:
API String ID: 3682056076-0
Opcode ID: ca3fb0b8572f38f04c8e7f887ed93a46820372b37fb06955fdddff351c3b93c0
Instruction ID: 0d852a346218120d3da4cb41429ba606f2c3b38bf25389faa73f1b0c9af31080
Opcode Fuzzy Hash: ca3fb0b8572f38f04c8e7f887ed93a46820372b37fb06955fdddff351c3b93c0
Instruction Fuzzy Hash: 87416B32B45B8889EB52DBB4D4503DC33B9AB687C8F05811AAA4927A9ADE70C659C340

Function 0000014F6D717884 Relevance: 12.6, APIs: 10, Instructions: 116
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 0000014F6D7178B2

Part of subcall function 0000014F6D70E5C8: _errno.LIBCMT ref: 0000014F6D70E5E8

free.LIBCMT ref: 0000014F6D7178C7
free.LIBCMT ref: 0000014F6D7178E8
free.LIBCMT ref: 0000014F6D7178FD
free.LIBCMT ref: 0000014F6D717911
free.LIBCMT ref: 0000014F6D71791D
free.LIBCMT ref: 0000014F6D717948
free.LIBCMT ref: 0000014F6D717969
free.LIBCMT ref: 0000014F6D717982
free.LIBCMT ref: 0000014F6D7179B3

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: c236f47fa00f1eb095f464021b61fc5b1928e1c18c896dc44bc4746b0c097f4e
Instruction ID: bfb4689386885776663a1a0875e2294b7e2fe44c92156bc50c5a04cc7d152752
Opcode Fuzzy Hash: c236f47fa00f1eb095f464021b61fc5b1928e1c18c896dc44bc4746b0c097f4e
Instruction Fuzzy Hash: 7C413D30664A098FFB98FB58DCA57A532E2F759311F49012CE006D22E1DA6C98C7CB23

Function 000000018000E7F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E819

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E83E
ctype.LIBCPMT ref: 000000018000E8C1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000E8D8
_CxxThrowException.LIBCMT ref: 000000018000E8E9
std::_Facet_Register.LIBCPMT ref: 000000018000E907

Strings

bad cast, xrefs: 000000018000E8CC

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3320480354-3145022300
Opcode ID: 997303cdb5246af4f3804dbc33bfa6d28888dcc0a64c4145d567fdc2599bd8a0
Instruction ID: 7396700a3e2aa9f6dcc0ca259bbfacf4549d370ee844549db4e676bec1950651
Opcode Fuzzy Hash: 997303cdb5246af4f3804dbc33bfa6d28888dcc0a64c4145d567fdc2599bd8a0
Instruction Fuzzy Hash: 35315E31604A8881FA97DB15E4503D97761F798BE0F58C322FA6D176E9DF38C68AC700

Function 000000018000F048 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F069

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F08E
moneypunct.LIBCPMT ref: 000000018000F111
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F128
_CxxThrowException.LIBCMT ref: 000000018000F139
std::_Facet_Register.LIBCPMT ref: 000000018000F157

Strings

bad cast, xrefs: 000000018000F11C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: 2f04781c0b5e18591815ebcc6c292dda38492b9e83a825390bd61a302c4df626
Instruction ID: 2e1ae5781fe8c05b86cdc7ffb40e0608430781eac327408133958ab252574f1b
Opcode Fuzzy Hash: 2f04781c0b5e18591815ebcc6c292dda38492b9e83a825390bd61a302c4df626
Instruction Fuzzy Hash: 07314332604A4881EAA6DB15E4503E97760F798BE4F648322F66D03BE6DE38C68DD700

Function 000000018000F898 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F8B9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F8DE
messages.LIBCPMT ref: 000000018000F961
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F978
_CxxThrowException.LIBCMT ref: 000000018000F989
std::_Facet_Register.LIBCPMT ref: 000000018000F9A7

Strings

bad cast, xrefs: 000000018000F96C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: ba301de617691a25de1568d6629764ce47dc5661472e619ef08b9ca5d15eff40
Instruction ID: bf50277651feb23a4f13a6c5a880b1d27c86798fa76ed2e6007adde15329282e
Opcode Fuzzy Hash: ba301de617691a25de1568d6629764ce47dc5661472e619ef08b9ca5d15eff40
Instruction Fuzzy Hash: C1314F72604A4891FAA2DB15E4407E97760F79CBE0F148322FA6D13BE5DF38C68AD700

Function 00000001800080D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800080F1

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008116
messages.LIBCPMT ref: 0000000180008199
std::bad_exception::bad_exception.LIBCMT ref: 00000001800081B0
_CxxThrowException.LIBCMT ref: 00000001800081C1
std::_Facet_Register.LIBCPMT ref: 00000001800081DF

Strings

bad cast, xrefs: 00000001800081A4

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: de1c21e832a76d84b7319f342fcfc80a87732f041ca1253d4a316bfc9e9b560d
Instruction ID: 747a8e2e6dad2d90b1f0716f744283a3e44b8922fd48889ad8a5bc8a8dfd0f0f
Opcode Fuzzy Hash: de1c21e832a76d84b7319f342fcfc80a87732f041ca1253d4a316bfc9e9b560d
Instruction Fuzzy Hash: 5D314F31604B4891FA93DB15E8503D973A5FB98BE4F588322FA9D076E5DE38C68E9700

Function 0000000180023924 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023945

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018002396A
collate.LIBCPMT ref: 00000001800239ED
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023A04
_CxxThrowException.LIBCMT ref: 0000000180023A15
std::_Facet_Register.LIBCPMT ref: 0000000180023A33

Strings

bad cast, xrefs: 00000001800239F8

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3240839640-3145022300
Opcode ID: 34fdc018d8a8ec6bee2b747dce8489b826a34589efca71191b1f9c2b58655a0b
Instruction ID: 6f35ace6046a98efa2fc2a7e222986f193aa6cacab9ff511322773bfe6909e8d
Opcode Fuzzy Hash: 34fdc018d8a8ec6bee2b747dce8489b826a34589efca71191b1f9c2b58655a0b
Instruction Fuzzy Hash: 34318F72605A4C81FAD7DB15E4413D96360F39CBE0F548226FA9D036E5DE78CA8DC700

Function 000000018000E928 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E949

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E96E
messages.LIBCPMT ref: 000000018000E9F1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000EA08
_CxxThrowException.LIBCMT ref: 000000018000EA19
std::_Facet_Register.LIBCPMT ref: 000000018000EA37

Strings

bad cast, xrefs: 000000018000E9FC

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 6dc5dc1771d10e344de0ccb396d5e2778d4d018ff2c769379d7feb57f0715546
Instruction ID: d7988e17b3725b2409f932854fd4a3b422a4396c3d031bda681015576420d7f9
Opcode Fuzzy Hash: 6dc5dc1771d10e344de0ccb396d5e2778d4d018ff2c769379d7feb57f0715546
Instruction Fuzzy Hash: DE314F32604A8881FAD6DB15E4403D97761F79DBE0F548222F65D636E5DE38C78DC700

Function 000000018000F178 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F199

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F1BE
moneypunct.LIBCPMT ref: 000000018000F241
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F258
_CxxThrowException.LIBCMT ref: 000000018000F269
std::_Facet_Register.LIBCPMT ref: 000000018000F287

Strings

bad cast, xrefs: 000000018000F24C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: c1ad271fe33d91cd47d2852839b2ce4b5c05dbc669564f68ca22ba5cf5126d8f
Instruction ID: 05c0de9255826c6bef9e5404167eb3cddf1f87d963d99c9ec1c58014a44890e4
Opcode Fuzzy Hash: c1ad271fe33d91cd47d2852839b2ce4b5c05dbc669564f68ca22ba5cf5126d8f
Instruction Fuzzy Hash: 44314176604A4881EAA6DB15E4503E97760F79C7E0F548322FA6D03BE9DE38C78EC700

Function 000000018000F9C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F9E9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FA0E
numpunct.LIBCPMT ref: 000000018000FA91
std::bad_exception::bad_exception.LIBCMT ref: 000000018000FAA8
_CxxThrowException.LIBCMT ref: 000000018000FAB9
std::_Facet_Register.LIBCPMT ref: 000000018000FAD7

Strings

bad cast, xrefs: 000000018000FA9C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4068408745-3145022300
Opcode ID: 03e76c395403f9925dd663e28b75ce9b1ad016ac71419344fc38d9e9773d2bc8
Instruction ID: ece7884c02b4ebca02d2dba318e864f23f9d4b6102c45f6ad76164ea4142065f
Opcode Fuzzy Hash: 03e76c395403f9925dd663e28b75ce9b1ad016ac71419344fc38d9e9773d2bc8
Instruction Fuzzy Hash: 1B315272704B4881EAA3DB15E4403E97760E79DBE4F548221FA5D17BE9DE38C68AC700

Function 0000000180008200 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008221

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008246
messages.LIBCPMT ref: 00000001800082C9
std::bad_exception::bad_exception.LIBCMT ref: 00000001800082E0
_CxxThrowException.LIBCMT ref: 00000001800082F1
std::_Facet_Register.LIBCPMT ref: 000000018000830F

Strings

bad cast, xrefs: 00000001800082D4

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: d2e83e9231d16ea01c07958aeaaaa4caef9aee7f5abb66e199b44a73ff621b09
Instruction ID: fc80639a25eda0d0840aad3c647064db7dd1c62e6b2bd08ed960b1421dfd7e0d
Opcode Fuzzy Hash: d2e83e9231d16ea01c07958aeaaaa4caef9aee7f5abb66e199b44a73ff621b09
Instruction Fuzzy Hash: 81313D31605B4881EA92DB15E4443D977A1FB98BE0F548221FA9D176E9DF38C68E9700

Function 0000000180023A54 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023A75

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023A9A
messages.LIBCPMT ref: 0000000180023B1D
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023B34
_CxxThrowException.LIBCMT ref: 0000000180023B45
std::_Facet_Register.LIBCPMT ref: 0000000180023B63

Strings

bad cast, xrefs: 0000000180023B28

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 64fc0b7241fd2fa6ecba5e4239454da0e7d9bf1393a0a330c2f65e3e5c872203
Instruction ID: 24dc92240a733358afca9a5473095d117544f2bced7408c023fd1db7623d7554
Opcode Fuzzy Hash: 64fc0b7241fd2fa6ecba5e4239454da0e7d9bf1393a0a330c2f65e3e5c872203
Instruction Fuzzy Hash: 6D316F71604A4881EA97DB15E8513DA6760F79CBE0F548322FB9D136E6DF38CA8DC700

Function 000000018000EA58 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EA79

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EA9E
messages.LIBCPMT ref: 000000018000EB21
std::bad_exception::bad_exception.LIBCMT ref: 000000018000EB38
_CxxThrowException.LIBCMT ref: 000000018000EB49
std::_Facet_Register.LIBCPMT ref: 000000018000EB67

Strings

bad cast, xrefs: 000000018000EB2C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: fa39000a9970348669bddc9ddd868ce9499a2a0f09ae09316945077eb49df745
Instruction ID: 256997454fb0768d937e5236695cd4a42c3911470dfc27f4f3246bfe781b264e
Opcode Fuzzy Hash: fa39000a9970348669bddc9ddd868ce9499a2a0f09ae09316945077eb49df745
Instruction Fuzzy Hash: 52315E72704B8881FA96DB15E8403DA7361F79DBE0F588222BA5E176E5DF38D68DC700

Function 000000018000F2A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2C9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2EE
moneypunct.LIBCPMT ref: 000000018000F371
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F388
_CxxThrowException.LIBCMT ref: 000000018000F399
std::_Facet_Register.LIBCPMT ref: 000000018000F3B7

Strings

bad cast, xrefs: 000000018000F37C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: 0e73463bbbdd58031d34cd0dacd00404d5dd0a9fded515b625f2b8c72c3f4f6e
Instruction ID: 109307e02aa07442a5533241676dd05e444ebde23d5f59b864ab3c21283e98e5
Opcode Fuzzy Hash: 0e73463bbbdd58031d34cd0dacd00404d5dd0a9fded515b625f2b8c72c3f4f6e
Instruction Fuzzy Hash: 9E313072604A4882EAA6DB15E4503E97361E798BE0F588221FA6D437E5DF78C78E9700

Function 000000018000FAF8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB19

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB3E
numpunct.LIBCPMT ref: 000000018000FBC1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000FBD8
_CxxThrowException.LIBCMT ref: 000000018000FBE9
std::_Facet_Register.LIBCPMT ref: 000000018000FC07

Strings

bad cast, xrefs: 000000018000FBCC

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4068408745-3145022300
Opcode ID: f1f315d357278705815692d30c91284999734579805cd6aac418ab0c5791075c
Instruction ID: a5587e62e306e01d309a23b52e80ead7e7268470319b1834d7f7869813062665
Opcode Fuzzy Hash: f1f315d357278705815692d30c91284999734579805cd6aac418ab0c5791075c
Instruction Fuzzy Hash: 54313D71604A4881EAA7DB15E4507E97361E79CBE0F548222FA5E13BE9DF38C68ED700

Function 0000000180008330 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008351

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008376
numpunct.LIBCPMT ref: 00000001800083F9
std::bad_exception::bad_exception.LIBCMT ref: 0000000180008410
_CxxThrowException.LIBCMT ref: 0000000180008421
std::_Facet_Register.LIBCPMT ref: 000000018000843F

Strings

bad cast, xrefs: 0000000180008404

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4068408745-3145022300
Opcode ID: b99809600cb807d6792835c2380899c2947ebd0d65ddbedb7e4521f86c2dc54b
Instruction ID: 5f48a92dd4c4338798bd1fa2af2806e56aa42fdb72c7ea48e45cf4e83205126c
Opcode Fuzzy Hash: b99809600cb807d6792835c2380899c2947ebd0d65ddbedb7e4521f86c2dc54b
Instruction Fuzzy Hash: 3E314F31605A4881FA97DB15E4503DA77A1FB98BE0F548321FA9D036E5DE38C78ED700

Function 0000000180023B84 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023BA5

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023BCA
messages.LIBCPMT ref: 0000000180023C4D
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023C64
_CxxThrowException.LIBCMT ref: 0000000180023C75
std::_Facet_Register.LIBCPMT ref: 0000000180023C93

Strings

bad cast, xrefs: 0000000180023C58

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 2e6a52849d769a2e1413fd232250c65d1901f3564be83fb5643226a8b7ee650c
Instruction ID: 8ded690d922abd832e9d273035f0c347a84f20339b8b3f02e343dfb5c422cbb4
Opcode Fuzzy Hash: 2e6a52849d769a2e1413fd232250c65d1901f3564be83fb5643226a8b7ee650c
Instruction Fuzzy Hash: 84315E72604A4C81FAA7DB15E4513E96760F79CBE0F64C322BA5D176E5DE38CA8EC700

Function 000000018000EB88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EBA9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EBCE
messages.LIBCPMT ref: 000000018000EC51
std::bad_exception::bad_exception.LIBCMT ref: 000000018000EC68
_CxxThrowException.LIBCMT ref: 000000018000EC79
std::_Facet_Register.LIBCPMT ref: 000000018000EC97

Strings

bad cast, xrefs: 000000018000EC5C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: c0a4adc6c9eb2be6ab9aca49803a2461e551489b6d1e2fac807d288f8c8a4382
Instruction ID: b2b594c90fe963b09e6cff62a57c5274ba6f46d917d7b3e8eb7efe257ebbc62c
Opcode Fuzzy Hash: c0a4adc6c9eb2be6ab9aca49803a2461e551489b6d1e2fac807d288f8c8a4382
Instruction Fuzzy Hash: 06316132604A8C81FA97DB15E4407D97761F799BE0F54C222FA5D236E5DE39C68EC700

Function 000000018000F3D8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F3F9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F41E
moneypunct.LIBCPMT ref: 000000018000F4A1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F4B8
_CxxThrowException.LIBCMT ref: 000000018000F4C9
std::_Facet_Register.LIBCPMT ref: 000000018000F4E7

Strings

bad cast, xrefs: 000000018000F4AC

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: 9a263112a183061fb21462d9867a638ce62413c5ba775c98e0fc9ca059aadcfa
Instruction ID: 0429968c920f662819e1cb35532bae73eeb9a1535b330badf44fc322d12eeabc
Opcode Fuzzy Hash: 9a263112a183061fb21462d9867a638ce62413c5ba775c98e0fc9ca059aadcfa
Instruction Fuzzy Hash: 93316132604A4881EAA2DB15E4503EA7760F79CBE4F548322FA5D037E5DF78C68EC700

Function 000000018000E468 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E489

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E4AE
codecvt.LIBCPMT ref: 000000018000E531
std::bad_exception::bad_exception.LIBCMT ref: 000000018000E548
_CxxThrowException.LIBCMT ref: 000000018000E559
std::_Facet_Register.LIBCPMT ref: 000000018000E577

Strings

bad cast, xrefs: 000000018000E53C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcodecvtstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 2666907392-3145022300
Opcode ID: 8bf4df6cf43bf922fa39b87c50c5163b31fb7ab6ed35ac58d1c89d7f1da5f821
Instruction ID: e17c34a64e892375947f478ee5778eb12655eca52efa774ef1c8d2b73f90135f
Opcode Fuzzy Hash: 8bf4df6cf43bf922fa39b87c50c5163b31fb7ab6ed35ac58d1c89d7f1da5f821
Instruction Fuzzy Hash: 9E316F71604E8881EA97DB15E8403D97761F79DBE4F548322FA9D136E5DE38CA8EC700

Function 0000000180023CB4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023CD5

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023CFA
messages.LIBCPMT ref: 0000000180023D7D
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023D94
_CxxThrowException.LIBCMT ref: 0000000180023DA5
std::_Facet_Register.LIBCPMT ref: 0000000180023DC3

Strings

bad cast, xrefs: 0000000180023D88

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 9610e6b592e85278086d84bd98d7bd1b9d2e3fea67ca7d993f2e511d6aafebe0
Instruction ID: 42da7f15c0a14e143d39768027cbac4f10d9d296bb43efe929394bade188cc91
Opcode Fuzzy Hash: 9610e6b592e85278086d84bd98d7bd1b9d2e3fea67ca7d993f2e511d6aafebe0
Instruction Fuzzy Hash: 05315071604A4881EAA3DB19F4413D96761F79CBE0F548322FA6D476E9DF38CA8EC700

Function 000000018000ECB8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000ECD9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000ECFE
messages.LIBCPMT ref: 000000018000ED81
std::bad_exception::bad_exception.LIBCMT ref: 000000018000ED98
_CxxThrowException.LIBCMT ref: 000000018000EDA9
std::_Facet_Register.LIBCPMT ref: 000000018000EDC7

Strings

bad cast, xrefs: 000000018000ED8C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 84dfab6d8172c11f77b414dd97d6e914d8b7a96cc48963b32e03c45dc50c657e
Instruction ID: 2c6c7a7b1d17f320c1792f218ce074bad44cb980c5a52b758e2d6f8c93f6019b
Opcode Fuzzy Hash: 84dfab6d8172c11f77b414dd97d6e914d8b7a96cc48963b32e03c45dc50c657e
Instruction Fuzzy Hash: 7D316F72604A8881EA97DB15E8503D97761F798BE0F68C322FA5D176E5DF38C68DC700

Function 000000018000F508 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F529

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F54E
messages.LIBCPMT ref: 000000018000F5D1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F5E8
_CxxThrowException.LIBCMT ref: 000000018000F5F9
std::_Facet_Register.LIBCPMT ref: 000000018000F617

Strings

bad cast, xrefs: 000000018000F5DC

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 576065deb2ea874c3d036d3935cf1e4fa8ca15b2c119d416514965b14070bf2d
Instruction ID: afb1d25f7f6a659e3ccf1534ae0290ba0e63db629d8d0aed09161fb4d3141880
Opcode Fuzzy Hash: 576065deb2ea874c3d036d3935cf1e4fa8ca15b2c119d416514965b14070bf2d
Instruction Fuzzy Hash: FC315272604B4881EAA6DB15E8403E97760F75CBE0F548222FA5D037E5DF39C68DD700

Function 000000018000E598 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E5B9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E5DE
collate.LIBCPMT ref: 000000018000E661
std::bad_exception::bad_exception.LIBCMT ref: 000000018000E678
_CxxThrowException.LIBCMT ref: 000000018000E689
std::_Facet_Register.LIBCPMT ref: 000000018000E6A7

Strings

bad cast, xrefs: 000000018000E66C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3240839640-3145022300
Opcode ID: 029a85cc6c44bb4d66bb86a0cf056ae3c6a81e8a915a0f6ae689bc45c224e08a
Instruction ID: 1a7f724a00d2f7b0fab48cb1980e5d225c899bdba8727d32d58a9660333b923c
Opcode Fuzzy Hash: 029a85cc6c44bb4d66bb86a0cf056ae3c6a81e8a915a0f6ae689bc45c224e08a
Instruction Fuzzy Hash: FF315E72605A8881FA97DB15E4403D97361F7A9BE0F188322FA6D636E5DF39C68D8700

Function 0000000180023DE4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E05

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E2A
moneypunct.LIBCPMT ref: 0000000180023EAD
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023EC4
_CxxThrowException.LIBCMT ref: 0000000180023ED5
std::_Facet_Register.LIBCPMT ref: 0000000180023EF3

Strings

bad cast, xrefs: 0000000180023EB8

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: 57679f9ba60fcc5ce75ffc9d603da348049f1029f5d85e32f99d7f7ab94a2bcf
Instruction ID: 78d12ddad9cf2f961cbe0ee8d63102c276d5e5dadf0dca8cca31639c76c0ce51
Opcode Fuzzy Hash: 57679f9ba60fcc5ce75ffc9d603da348049f1029f5d85e32f99d7f7ab94a2bcf
Instruction Fuzzy Hash: 38316C72604A4981EE93DB19E4513D96760F79CBE0F558322BA6D076E5DF38CA8EC700

Function 000000018000EDE8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EE09

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EE2E
messages.LIBCPMT ref: 000000018000EEB1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000EEC8
_CxxThrowException.LIBCMT ref: 000000018000EED9
std::_Facet_Register.LIBCPMT ref: 000000018000EEF7

Strings

bad cast, xrefs: 000000018000EEBC

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: aa378d7cb7001d472e738dd575348e3f23e2d6fe110772f068ee53f9b38dc5f8
Instruction ID: d7191621a7ac0d800c40fe039645664729bb7d202f0113ab797f1482ed654799
Opcode Fuzzy Hash: aa378d7cb7001d472e738dd575348e3f23e2d6fe110772f068ee53f9b38dc5f8
Instruction Fuzzy Hash: D2314132604B8C81EA96DB15E8403D97761F79DBE4F54C222F66D236E6DE78CA8DC700

Function 000000018000F638 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F659

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F67E
messages.LIBCPMT ref: 000000018000F701
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F718
_CxxThrowException.LIBCMT ref: 000000018000F729
std::_Facet_Register.LIBCPMT ref: 000000018000F747

Strings

bad cast, xrefs: 000000018000F70C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 26f739fb2207adfad20dbe0ff4bbae510614515fb7231ebce967c9c2ccd2148c
Instruction ID: fe53bd809141ad4a8fb52fc0f94da26a0e072fde6bf583902698de3aa87a9790
Opcode Fuzzy Hash: 26f739fb2207adfad20dbe0ff4bbae510614515fb7231ebce967c9c2ccd2148c
Instruction Fuzzy Hash: 1A314172604A4C91EAA7DB15E4503E97760F7987E0F548222F6AD13BE9DF39C68DC700

Function 0000000180007E70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180007E91

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180007EB6
messages.LIBCPMT ref: 0000000180007F39
std::bad_exception::bad_exception.LIBCMT ref: 0000000180007F50
_CxxThrowException.LIBCMT ref: 0000000180007F61
std::_Facet_Register.LIBCPMT ref: 0000000180007F7F

Strings

bad cast, xrefs: 0000000180007F44

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 9d7bf26d82fda06f46ee10fef8c2a572636e6cb711f1b89eab47540aa2773390
Instruction ID: a39a07d489fe1709e7dffcf99ff87109f50278d4c8fcc2f6723dd5a18d2b7123
Opcode Fuzzy Hash: 9d7bf26d82fda06f46ee10fef8c2a572636e6cb711f1b89eab47540aa2773390
Instruction Fuzzy Hash: 1E313E31704B4981EA93DB15E4403E97361E7AC7E0F58C321FA5D176E6DE38CA8E8700

Function 000000018000E6C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E6E9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E70E
collate.LIBCPMT ref: 000000018000E791
std::bad_exception::bad_exception.LIBCMT ref: 000000018000E7A8
_CxxThrowException.LIBCMT ref: 000000018000E7B9
std::_Facet_Register.LIBCPMT ref: 000000018000E7D7

Strings

bad cast, xrefs: 000000018000E79C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3240839640-3145022300
Opcode ID: 15430af32cf9b8e486ed60e673d5b8c96ce199ac25e89687e12c1e0a6129dbb2
Instruction ID: 5a58921b38e1c11c7ee0b369c090a126d18666bc4abbd8cc74174dfd54e2cf80
Opcode Fuzzy Hash: 15430af32cf9b8e486ed60e673d5b8c96ce199ac25e89687e12c1e0a6129dbb2
Instruction Fuzzy Hash: 75314172608A8881FA96DB25E8403D97761F79DBE0F548322F66D136E5DF38C68EC700

Function 0000000180023F14 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023F35

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023F5A
moneypunct.LIBCPMT ref: 0000000180023FDD
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023FF4
_CxxThrowException.LIBCMT ref: 0000000180024005
std::_Facet_Register.LIBCPMT ref: 0000000180024023

Strings

bad cast, xrefs: 0000000180023FE8

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: ddc611d81091a771564436c8181557d018e8c1498031d48b19b0e2b44c0de1fc
Instruction ID: c3f08917b5860eaf3f746bb0bdc4995f0c3271c5a214842932c013d6c33afdca
Opcode Fuzzy Hash: ddc611d81091a771564436c8181557d018e8c1498031d48b19b0e2b44c0de1fc
Instruction Fuzzy Hash: 33316E72A04A4C81FAD7DB15E5813D96361F79CBE0F188222FA5D076E5DE38CA8EC700

Function 000000018000EF18 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EF39

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EF5E
messages.LIBCPMT ref: 000000018000EFE1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000EFF8
_CxxThrowException.LIBCMT ref: 000000018000F009
std::_Facet_Register.LIBCPMT ref: 000000018000F027

Strings

bad cast, xrefs: 000000018000EFEC

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 7b90b618fe9233f497b3e0b7bd34d426c4bb03d469434e90aa1f8f461423cc16
Instruction ID: 614366ad9a5ff6ac8348753e983fcd7fba9fd89e4481af51ce485f1e66cfaf53
Opcode Fuzzy Hash: 7b90b618fe9233f497b3e0b7bd34d426c4bb03d469434e90aa1f8f461423cc16
Instruction Fuzzy Hash: 31316172604B4D81FA96DB15E4403E97761E79CBE0F64C222BA5D177E6DE38CA8DC700

Function 000000018000F768 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F789

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F7AE
messages.LIBCPMT ref: 000000018000F831
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F848
_CxxThrowException.LIBCMT ref: 000000018000F859
std::_Facet_Register.LIBCPMT ref: 000000018000F877

Strings

bad cast, xrefs: 000000018000F83C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 10861fd70df80fbe258d715848b4cc285575eb1398c9eca244f814f54e188fda
Instruction ID: e62912da7a3f1217ce2cd131540612a25ba01e78ddaa4f611fc9381f458fc566
Opcode Fuzzy Hash: 10861fd70df80fbe258d715848b4cc285575eb1398c9eca244f814f54e188fda
Instruction Fuzzy Hash: 78313F32604B4881EAA6DB15E4403E97760F798BE4F64C322BA5D037E9DF38C68ED700

Function 0000000180007FA0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180007FC1

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180007FE6
ctype.LIBCPMT ref: 0000000180008069
std::bad_exception::bad_exception.LIBCMT ref: 0000000180008080
_CxxThrowException.LIBCMT ref: 0000000180008091
std::_Facet_Register.LIBCPMT ref: 00000001800080AF

Strings

bad cast, xrefs: 0000000180008074

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3320480354-3145022300
Opcode ID: 43311a8cd0d47b4e5385f9dc31fb32a05d0fe4ad0ecca51f2bef93aa2bd29225
Instruction ID: fec9e7a6d46bfa7b577852024225b762ed1cc773752eb01346846e8d91bbd71e
Opcode Fuzzy Hash: 43311a8cd0d47b4e5385f9dc31fb32a05d0fe4ad0ecca51f2bef93aa2bd29225
Instruction Fuzzy Hash: 74313D31604A4C81EA97DB15E8503D977A1FB98BE0F148322FAAD036E5DF78C68E9700

Function 0000000180006940 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180006961

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180006986
std::bad_exception::bad_exception.LIBCMT ref: 0000000180006A21
_CxxThrowException.LIBCMT ref: 0000000180006A32
std::_Facet_Register.LIBCPMT ref: 0000000180006A50

Strings

bad cast, xrefs: 0000000180006A15
ios_base::badbit set, xrefs: 0000000180006940

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast$ios_base::badbit set
API String ID: 1776536810-182444483
Opcode ID: 8350d050f5a0f01878a3f2d3d7fa6fc40c68057f815e104cabb17d988fe9a483
Instruction ID: 02ad155c9015395c238964cca4a8f2f47d031e4f92e59427d6e1992964da67f8
Opcode Fuzzy Hash: 8350d050f5a0f01878a3f2d3d7fa6fc40c68057f815e104cabb17d988fe9a483
Instruction Fuzzy Hash: 3D314C32600A4881EA97DB15E5403D97361E798BE0F589222FA6E577F9DE38C68AC700

Function 000000018003BAE0 Relevance: 12.2, APIs: 8, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 000000018003BB09

Part of subcall function 0000000180031B68: malloc.LIBCMT ref: 0000000180031B93
Part of subcall function 0000000180031B68: Sleep.KERNEL32(?,?,00000000,00000001800302E4,?,?,00000000,00000001800301E3,?,?,00000000,0000000180038B02,?,?,00000000,0000000180038A6E), ref: 0000000180031BA6

free.LIBCMT ref: 000000018003BC0A
free.LIBCMT ref: 000000018003BC26

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: 3fbd0b3e35addabc098f64ab091990d7b6a2871f8ac9e4cce4e35d3e8861d74a
Instruction ID: fc16e1660138297f9bb3e8678e6c16cd315b57137c63fc5872edf9e7c8194a9d
Opcode Fuzzy Hash: 3fbd0b3e35addabc098f64ab091990d7b6a2871f8ac9e4cce4e35d3e8861d74a
Instruction Fuzzy Hash: 30619F32301B4892EBA3DB16E94139A73A0F78CBD8F058125AF4D47B51DF78C66AC740

Function 0000000180005730 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0000000180005A4B
_CxxThrowException.LIBCMT ref: 0000000180005A66
std::exception::exception.LIBCMT ref: 0000000180005AC9
_CxxThrowException.LIBCMT ref: 0000000180005AE4

Part of subcall function 0000000180006440: std::_Xbad_alloc.LIBCPMT ref: 00000001800064CD

Strings

string too long, xrefs: 00000001800059B0, 00000001800059BD, 00000001800059D4, 00000001800059E1
bad conversion, xrefs: 0000000180005A36, 0000000180005AB4

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrowstd::exception::exception$Xbad_allocstd::_
String ID: bad conversion$string too long
API String ID: 1519488521-500853860
Opcode ID: 9110206936fc4ea39a0f310876ecb5f4ea0c8709850686dfa8f543131f57e917
Instruction ID: 3cc6c4512f05efe767561da1de7a9aa72e313d0346ffbdd664ceec63a1708898
Opcode Fuzzy Hash: 9110206936fc4ea39a0f310876ecb5f4ea0c8709850686dfa8f543131f57e917
Instruction Fuzzy Hash: 3DD17B32704B84C9FB42CFA4E4503ED37B5E7497A8F948626EAA927AD5DF34C649C340

Function 0000014F6D725B3C Relevance: 10.7, APIs: 7, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000014F6D725B67
_errno.LIBCMT ref: 0000014F6D725B5C

Part of subcall function 0000014F6D7102B0: _getptd_noexit.LIBCMT ref: 0000014F6D7102B4

_errno.LIBCMT ref: 0000014F6D725C0A
_invalid_parameter_noinfo.LIBCMT ref: 0000014F6D725C15

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 7afc2762c95521575d3116b194f351630dcc251883b617eb56e717d3dcf592c2
Instruction ID: d15c7be536779947c3711733bb2ceb9e36fb8f29b6dcfce536a9f5cfafab72b8
Opcode Fuzzy Hash: 7afc2762c95521575d3116b194f351630dcc251883b617eb56e717d3dcf592c2
Instruction Fuzzy Hash: 2251E930518B9A4BEB64AB1995413F573D0FB54312F96027FA486C73E9F624C9C38783

Function 0000014F6D71F528 Relevance: 10.6, APIs: 7, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000014F6D71F54E
_errno.LIBCMT ref: 0000014F6D71F543

Part of subcall function 0000014F6D7102B0: _getptd_noexit.LIBCMT ref: 0000014F6D7102B4

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000014F6D71F5CD
_errno.LIBCMT ref: 0000014F6D71F5DE
_invalid_parameter_noinfo.LIBCMT ref: 0000014F6D71F5E9

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: a56ef14d950493e927c3ef52fe0069bfafb8291851f1440a19a1a290c08364fa
Instruction ID: 92a1b6934c420ae3b2e623643191fc8cc5a4c68ea9063509ccc9f15725e17e27
Opcode Fuzzy Hash: a56ef14d950493e927c3ef52fe0069bfafb8291851f1440a19a1a290c08364fa
Instruction Fuzzy Hash: 6C413831418A1A4BEB64AB1988513F5F2E4FB54325F9E033EE495C72F5D72889C39283

Function 0000014F6D6E22C4 Relevance: 10.6, APIs: 7, Instructions: 134COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E22FF

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

Part of subcall function 0000014F6D6E83A4: ___lc_codepage_func.LIBCMT ref: 0000014F6D6E83C8
Part of subcall function 0000014F6D6E83A4: ___mb_cur_max_func.LIBCMT ref: 0000014F6D6E83CF
Part of subcall function 0000014F6D6E83A4: ___lc_locale_name_func.LIBCMT ref: 0000014F6D6E83D7

free.LIBCMT ref: 0000014F6D6E2380

Part of subcall function 0000014F6D70E5C8: _errno.LIBCMT ref: 0000014F6D70E5E8

free.LIBCMT ref: 0000014F6D6E2392
free.LIBCMT ref: 0000014F6D6E23A4
free.LIBCMT ref: 0000014F6D6E23B6
free.LIBCMT ref: 0000014F6D6E23C8
free.LIBCMT ref: 0000014F6D6E23DA

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: free$LockitLockit::____lc_codepage_func___lc_locale_name_func___mb_cur_max_func_errno_lockstd::_
String ID:
API String ID: 1142821818-0
Opcode ID: 1911704955e5e0ea99b43964440b80dd6f33ce142868086bf586ad4af8219b32
Instruction ID: 932220768a26f4024437c0643bb08bf2909b6a12ab56f3757c1bea89ed9ab750
Opcode Fuzzy Hash: 1911704955e5e0ea99b43964440b80dd6f33ce142868086bf586ad4af8219b32
Instruction Fuzzy Hash: A5413C70908A4D8FDB55EF98D4516EDB7B1FF98300F01026ED409E72A6DA3099868B91

Function 0000000180044B68 Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180044B93
_errno.LIBCMT ref: 0000000180044B88

Part of subcall function 000000018002F2DC: _getptd_noexit.LIBCMT ref: 000000018002F2E0

_errno.LIBCMT ref: 0000000180044C36
_invalid_parameter_noinfo.LIBCMT ref: 0000000180044C41

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 7b47a042eea3f3de49294c888d2e7f7195dfd9dc128bccc2e4caf73cebc8c57f
Instruction ID: f2ef72c2d081a62da6ba206108f7190fcdc76fe894ca0d405d2fc84784ff5a10
Opcode Fuzzy Hash: 7b47a042eea3f3de49294c888d2e7f7195dfd9dc128bccc2e4caf73cebc8c57f
Instruction Fuzzy Hash: 50411677A01A9D81EBE69B1191C03F972A0F7487DDF9AC116FA845B6C4DF38C7498308

Function 000000018003E554 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018003E57A
_errno.LIBCMT ref: 000000018003E56F

Part of subcall function 000000018002F2DC: _getptd_noexit.LIBCMT ref: 000000018002F2E0

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000000018003E5F9
_errno.LIBCMT ref: 000000018003E60A
_invalid_parameter_noinfo.LIBCMT ref: 000000018003E615

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 1996f2f9ceac77ac49b72366ba56ab82fbc49c57b1b3130c14664040d3ec86e6
Instruction ID: 8ce04cb9124dd54c6d4ddcc2c6da84841e497bcc28cebf8c8d46b4611f73f4df
Opcode Fuzzy Hash: 1996f2f9ceac77ac49b72366ba56ab82fbc49c57b1b3130c14664040d3ec86e6
Instruction Fuzzy Hash: 28415B72A106E881EBE3AB1180513FE33E0E359BE4F96C225B794076C5EF28CB59C700

Function 0000000180024044 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180024065

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018002408A
std::bad_exception::bad_exception.LIBCMT ref: 0000000180024124
_CxxThrowException.LIBCMT ref: 0000000180024135
std::_Facet_Register.LIBCPMT ref: 0000000180024153

Strings

bad cast, xrefs: 0000000180024118

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: a9291c87b619f3b996d60f5c6d623e361a3f3665819b2df7064c52e3dbe42ad7
Instruction ID: 91e638e8e58f5590816a3cc392cfc10599bec749f4e2be6b6ca140d2a25e3853
Opcode Fuzzy Hash: a9291c87b619f3b996d60f5c6d623e361a3f3665819b2df7064c52e3dbe42ad7
Instruction Fuzzy Hash: 8C314172604A4981EA97DB15E4903D97760F79CBE0F548322BA6D0B7E9DE38C6CDC700

Function 0000000180024174 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180024195

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800241BA
std::bad_exception::bad_exception.LIBCMT ref: 0000000180024254
_CxxThrowException.LIBCMT ref: 0000000180024265
std::_Facet_Register.LIBCPMT ref: 0000000180024283

Strings

bad cast, xrefs: 0000000180024248

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 12eb798131b44ed89ccc95a849e9259a6caec3e02f1d91c0b99d509edef29d89
Instruction ID: 90848ef588fa6780bc4661c9358ff58c986763a4f68afd91812fa81bb0acabc5
Opcode Fuzzy Hash: 12eb798131b44ed89ccc95a849e9259a6caec3e02f1d91c0b99d509edef29d89
Instruction Fuzzy Hash: 23315232604A4881EA97DB26E4403D967A1F798BE0F549322FA5D576E5DF38CA8DC700

Function 000000018000FC28 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FC49

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FC6E
std::bad_exception::bad_exception.LIBCMT ref: 000000018000FD08
_CxxThrowException.LIBCMT ref: 000000018000FD19
std::_Facet_Register.LIBCPMT ref: 000000018000FD37

Strings

bad cast, xrefs: 000000018000FCFC

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 695fa22a1d6d23245e75d15cd8436973dff841ec1e986202785ff3774109f988
Instruction ID: 09fe364ddf780e93d9049d4f58e0a1b9e30b89f7d2aa5cb162c798bc91164caf
Opcode Fuzzy Hash: 695fa22a1d6d23245e75d15cd8436973dff841ec1e986202785ff3774109f988
Instruction Fuzzy Hash: 69317032604A4D81FAA3DB15E4417E97361F7987E0F148222BA5D07BE9DF38CA8AC700

Function 000000018000FD58 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FD79

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FD9E
std::bad_exception::bad_exception.LIBCMT ref: 000000018000FE38
_CxxThrowException.LIBCMT ref: 000000018000FE49
std::_Facet_Register.LIBCPMT ref: 000000018000FE67

Strings

bad cast, xrefs: 000000018000FE2C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: c31faf9a16ab594d7b7d60b82c7fa3f9691752c0b0427a899f9a3bc7088db9e4
Instruction ID: 30961d9cbeee99d4b4c8c09e2762ce4d9037323df64a8bf6b53e01d37467889e
Opcode Fuzzy Hash: c31faf9a16ab594d7b7d60b82c7fa3f9691752c0b0427a899f9a3bc7088db9e4
Instruction Fuzzy Hash: 5C315232604A4C85EAA2DB15E8403E97761F75CBE4F548222F65D477E6DF38C68DC700

Function 000000018000FE88 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FEA9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FECE
std::bad_exception::bad_exception.LIBCMT ref: 000000018000FF68
_CxxThrowException.LIBCMT ref: 000000018000FF79
std::_Facet_Register.LIBCPMT ref: 000000018000FF97

Strings

bad cast, xrefs: 000000018000FF5C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 17fb9323fbc971b4fa346c04e9c882f087ef0fb30719fe252382272d9991794a
Instruction ID: 9582de70e770e37efabb6f113b678346e0295d584a42193a0e1ebcab5a9be77e
Opcode Fuzzy Hash: 17fb9323fbc971b4fa346c04e9c882f087ef0fb30719fe252382272d9991794a
Instruction Fuzzy Hash: A6315032604B4981EAA6DB15E4403E97760F799BE4F648231B66D077E5DE78C78EC700

Function 000000018000FFB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FFD9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FFFE
std::bad_exception::bad_exception.LIBCMT ref: 0000000180010098
_CxxThrowException.LIBCMT ref: 00000001800100A9
std::_Facet_Register.LIBCPMT ref: 00000001800100C7

Strings

bad cast, xrefs: 000000018001008C

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: f2e4760a716c2795633db2f004ed8ff4989bb75003c081aa226cd9fb3309a49b
Instruction ID: bb2cd3e7e7aa969297df1caed63585c35752593d0d986f492354a86db0af1576
Opcode Fuzzy Hash: f2e4760a716c2795633db2f004ed8ff4989bb75003c081aa226cd9fb3309a49b
Instruction Fuzzy Hash: 2E315032604E4881FB93DB15E8403D96361F79CBE0F288322B69D176E5DE79DA8EC700

Function 0000000180007180 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800071A1

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800071C6
std::bad_exception::bad_exception.LIBCMT ref: 0000000180007261
_CxxThrowException.LIBCMT ref: 0000000180007272
std::_Facet_Register.LIBCPMT ref: 0000000180007290

Strings

bad cast, xrefs: 0000000180007255

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 2c248766304681b0c2bab5ac96b723214e976363793dd3940de8d17814ddb4c4
Instruction ID: d5f3d85ad48d5269fabfe6c01bbad63a5faf147fba86dc7cd225a5bba448d346
Opcode Fuzzy Hash: 2c248766304681b0c2bab5ac96b723214e976363793dd3940de8d17814ddb4c4
Instruction Fuzzy Hash: 16315071700A4881FA97DB15E4403D97761F7A8BE0F58C321FA5D036E6DE38C68AC740

Function 000000018004772C Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180047760

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_errno.LIBCMT ref: 000000018004777B
_invalid_parameter_noinfo.LIBCMT ref: 0000000180047786

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: ec2a6dd435b50d5e993b3328a406cbf0fc12b9938289ae1a38fd3c4af6446b14
Instruction ID: 4b6da2c887b896db48c8bf2af78125f2489fc4292198535c1cc227c838a58a5b
Opcode Fuzzy Hash: ec2a6dd435b50d5e993b3328a406cbf0fc12b9938289ae1a38fd3c4af6446b14
Instruction Fuzzy Hash: 2B31CC72704B888AE6A39B5190847EDB7A4F348BE4F668125FE5803B96CF74CA49C704

Function 00000001800023F0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 0000000180002442
_CxxThrowException.LIBCMT ref: 000000018000247E
_CxxThrowException.LIBCMT ref: 00000001800024A6
_CxxThrowException.LIBCMT ref: 00000001800024CE

Strings

ios_base::badbit set, xrefs: 000000018000244F
ios_base::failbit set, xrefs: 0000000180002484
ios_base::eofbit set, xrefs: 00000001800024AC

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: a68a3c255015a623e0952fdafce5552ec4697e039a4adfb181130a635e184be4
Instruction ID: b3155ec887754ec426d41302e82ca1272bd2955ff3b21f2f7d625a5ccb09a45c
Opcode Fuzzy Hash: a68a3c255015a623e0952fdafce5552ec4697e039a4adfb181130a635e184be4
Instruction Fuzzy Hash: 51213071A11F59D8FB96DB64E8817EC3375B718388F908126F94922AA9EF35C74EC340

Function 0000000180001180 Relevance: 10.5, APIs: 7, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 000000018000118D

Part of subcall function 00000001800077C8: setlocale.LIBCMT ref: 00000001800077E2

free.LIBCMT ref: 000000018000119B

Part of subcall function 000000018002D5F4: HeapFree.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D60A
Part of subcall function 000000018002D5F4: _errno.LIBCMT ref: 000000018002D614
Part of subcall function 000000018002D5F4: GetLastError.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D61C

free.LIBCMT ref: 00000001800011AF
free.LIBCMT ref: 00000001800011C1
free.LIBCMT ref: 00000001800011D3
free.LIBCMT ref: 00000001800011E5
free.LIBCMT ref: 00000001800011F7

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_errnosetlocalestd::_
String ID:
API String ID: 1855319098-0
Opcode ID: 2f9469f7e86d9ed662453ed7390a40d8cb98c28b94d45fdd9a0046f49d435607
Instruction ID: b48272a0fe48caf80c68cbfff6fe37b1983f1ac57bfd09bfec3c9c3905106cea
Opcode Fuzzy Hash: 2f9469f7e86d9ed662453ed7390a40d8cb98c28b94d45fdd9a0046f49d435607
Instruction Fuzzy Hash: 85010831202A9888EF9FDF65D5917EC73A4EF59FC8F188116BA4906A86CE64CD94C740

Function 00000001800312AC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000001800312CD
_getptd.LIBCMT ref: 00000001800312DB
_getptd.LIBCMT ref: 00000001800312ED

Strings

RCC, xrefs: 00000001800312B3
csm, xrefs: 00000001800312C3
MOC, xrefs: 00000001800312BB

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 79c6bdfdf6facc246eee842b2de7a644aa034f1ac0e2309a20206dc5bd345c8d
Instruction ID: cee1693f68b0781dadb7962070319637af549046bf3e62ebc375f9a8a227fa41
Opcode Fuzzy Hash: 79c6bdfdf6facc246eee842b2de7a644aa034f1ac0e2309a20206dc5bd345c8d
Instruction Fuzzy Hash: 6DF0303550814CCAE6DB2B5484053FF2790EB9DB87F8BC1A2A30082382CFBC47989B57

Function 0000000180006DB0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 263COMMONLIBRARYCODE

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 00000001800070C2
_CxxThrowException.LIBCMT ref: 00000001800070FB
_CxxThrowException.LIBCMT ref: 0000000180007133

Part of subcall function 0000000180006940: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180006961
Part of subcall function 0000000180006940: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180006986

Strings

ios_base::badbit set, xrefs: 0000000180007094
ios_base::failbit set, xrefs: 00000001800070D2
ios_base::eofbit set, xrefs: 0000000180007101

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrow$LockitLockit::_std::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1691487403-1866435925
Opcode ID: 47dc98a40835983bb1699ece49d8b1051e63deae5354a9febec2b4376c92975c
Instruction ID: 7e3792396ecdcc1fac19a2e98736fc1bb3e923ca5e2df652966d8dc16d1af633
Opcode Fuzzy Hash: 47dc98a40835983bb1699ece49d8b1051e63deae5354a9febec2b4376c92975c
Instruction Fuzzy Hash: 61C16372600B49C5EBA6CF19E0903A977A1F788BD4F50C122EB4D437A5DF7AC64AC740

Function 0000000180006A80 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 210COMMONLIBRARYCODE

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 0000000180006CF2
_CxxThrowException.LIBCMT ref: 0000000180006D2B
_CxxThrowException.LIBCMT ref: 0000000180006D63

Strings

ios_base::badbit set, xrefs: 0000000180006CC4
ios_base::failbit set, xrefs: 0000000180006D02
ios_base::eofbit set, xrefs: 0000000180006D31

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: 929456a826c5cb86168c23e50031e89aca919ba6b7336e00f1ffe86e266b3d15
Instruction ID: 236ed865422d3fdca970c5237e1e28b9fcf6c9cb8c767a6c1dee54dc2b89609d
Opcode Fuzzy Hash: 929456a826c5cb86168c23e50031e89aca919ba6b7336e00f1ffe86e266b3d15
Instruction Fuzzy Hash: 9EA15672605B4885EBA6CF19D0903AD77A1F788BC4F50C112EA8D437B5DF3AC68AC700

Function 0000014F6D6F04DC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F04FD

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0522
messages.LIBCPMT ref: 0000014F6D6F05A5
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F05BC
_CxxThrowException.LIBCMT ref: 0000014F6D6F05CD
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F05EB

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: abaa451bbf9128479b128ef22488faa88a4a7ca70dc8d8c9ec040cfc4538b7c0
Instruction ID: a0673da0d3ac7b50b753bbb3e1a6e1f321e795b9bb067af11bd5abb0683efb31
Opcode Fuzzy Hash: abaa451bbf9128479b128ef22488faa88a4a7ca70dc8d8c9ec040cfc4538b7c0
Instruction Fuzzy Hash: D1414131118E0C8FE755EB19D4947A677E1FBA8310F510A7EE05AC32F2DA71D8878B81

Function 0000014F6D704C88 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D704CA9

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D704CCE
messages.LIBCPMT ref: 0000014F6D704D51
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D704D68
_CxxThrowException.LIBCMT ref: 0000014F6D704D79
std::_Facet_Register.LIBCPMT ref: 0000014F6D704D97

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 33120029e13e597c9436f25d0a0d0519267f463dbb34c2f4dbf7f077c465b499
Instruction ID: a3c3c684fd0030923410b1e9dbc3ad75a623350160a8ec6153681e1e661d6c7b
Opcode Fuzzy Hash: 33120029e13e597c9436f25d0a0d0519267f463dbb34c2f4dbf7f077c465b499
Instruction Fuzzy Hash: 9C414F71508E084FE755EB28D494AA673E1FBA8314F11066EE15AD33F2DA34DC87DB82

Function 0000014F6D6EFC8C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EFCAD

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EFCD2
messages.LIBCPMT ref: 0000014F6D6EFD55
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6EFD6C
_CxxThrowException.LIBCMT ref: 0000014F6D6EFD7D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6EFD9B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 233253f149e279e38e89f3a7e76266979d4b0c745f74142b2642ab861ab978b6
Instruction ID: 9b96670b0fb89c0bdd696f43771939048bbacbc03f3a0e37932988e4288b128b
Opcode Fuzzy Hash: 233253f149e279e38e89f3a7e76266979d4b0c745f74142b2642ab861ab978b6
Instruction Fuzzy Hash: 1B41413161CE094FE755EB28E4846E677E1FBA8310F110A6EE056C32F6DA3198878B85

Function 0000014F6D6EF56C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EF58D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EF5B2
collate.LIBCPMT ref: 0000014F6D6EF635
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6EF64C
_CxxThrowException.LIBCMT ref: 0000014F6D6EF65D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6EF67B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID:
API String ID: 3240839640-0
Opcode ID: aa24ee5a496f3eccf8c40c5a857f936f456db878295ea4d5143e493ac5b1c9e7
Instruction ID: 30036db46f8f8609fdf884e379966530a0aa851dc4daaf52a1b27112e70b3f38
Opcode Fuzzy Hash: aa24ee5a496f3eccf8c40c5a857f936f456db878295ea4d5143e493ac5b1c9e7
Instruction Fuzzy Hash: F2414E3165DE094FE755EF18E4846EA77A1FBA8310F12066ED05AC32F2DA31D887CB81

Function 0000014F6D6F03AC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F03CD

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F03F2
moneypunct.LIBCPMT ref: 0000014F6D6F0475
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F048C
_CxxThrowException.LIBCMT ref: 0000014F6D6F049D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F04BB

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: c66e09ab170a22db7c72c6839654604274626d1e646d604170c6a8578907e1a2
Instruction ID: f2cac9f4ea05215d3cdd1e2dfddbab0cf12691b25017048fb2fcf166c373354c
Opcode Fuzzy Hash: c66e09ab170a22db7c72c6839654604274626d1e646d604170c6a8578907e1a2
Instruction Fuzzy Hash: 15414E31118E1C8FE765EB19D4947A677E1FBA8310F51067EE059C32F2DA22D987CB81

Function 0000014F6D6EF43C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EF45D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EF482
codecvt.LIBCPMT ref: 0000014F6D6EF505
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6EF51C
_CxxThrowException.LIBCMT ref: 0000014F6D6EF52D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6EF54B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcodecvtstd::bad_exception::bad_exception
String ID:
API String ID: 2666907392-0
Opcode ID: 45efec231ae2297d7a2142dcd9c2eae13585b2050d5428d033f28a6bf587b034
Instruction ID: 003b4c584fe4d8d084d11410fa87cc2225377f31e52a9380e046762532461418
Opcode Fuzzy Hash: 45efec231ae2297d7a2142dcd9c2eae13585b2050d5428d033f28a6bf587b034
Instruction Fuzzy Hash: 04415F7121CE098FE755EB18E4846E677E1FBA8310F52066ED05AC32F6DA31D887CB81

Function 0000014F6D704EE8 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D704F09

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D704F2E
moneypunct.LIBCPMT ref: 0000014F6D704FB1
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D704FC8
_CxxThrowException.LIBCMT ref: 0000014F6D704FD9
std::_Facet_Register.LIBCPMT ref: 0000014F6D704FF7

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: 8e53daf0cf3eb3dc316871336ff6c7f8367102b00b81160cfd78f9b718d2d828
Instruction ID: 7b7b17e78901ba813eafa360553c1f70b776655a8349bc53339b210e3f02207d
Opcode Fuzzy Hash: 8e53daf0cf3eb3dc316871336ff6c7f8367102b00b81160cfd78f9b718d2d828
Instruction Fuzzy Hash: 86418171508E088FE755EB18D484AA673E1FBAC304F15067DA04AD32F2DA35E8C7CB82

Function 0000014F6D6EFEEC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EFF0D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EFF32
messages.LIBCPMT ref: 0000014F6D6EFFB5
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6EFFCC
_CxxThrowException.LIBCMT ref: 0000014F6D6EFFDD
std::_Facet_Register.LIBCPMT ref: 0000014F6D6EFFFB

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 2b7e21ad93b706ad8219d7ae988ec98a48c25e03c0470851d55ba27f21d26565
Instruction ID: 3d1a19302f0c71310446b5a00d5d43d85c9f89d6f1cfff41e4ee78c6479e8b5b
Opcode Fuzzy Hash: 2b7e21ad93b706ad8219d7ae988ec98a48c25e03c0470851d55ba27f21d26565
Instruction Fuzzy Hash: 9F415E31218E094FE755EF19D4846EA73A1FBA9310F52466EE019C32F6DA21D887CB81

Function 0000014F6D6EF69C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EF6BD

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EF6E2
collate.LIBCPMT ref: 0000014F6D6EF765
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6EF77C
_CxxThrowException.LIBCMT ref: 0000014F6D6EF78D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6EF7AB

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID:
API String ID: 3240839640-0
Opcode ID: 3a4a181e59c721172dc463b7b24d81f07618d15fcfc0d0b84ccd0b258a6af7c2
Instruction ID: e837dc41812685b9a117fb11814121cb1d23ef16728e4722e076d904807c16f1
Opcode Fuzzy Hash: 3a4a181e59c721172dc463b7b24d81f07618d15fcfc0d0b84ccd0b258a6af7c2
Instruction Fuzzy Hash: 4A41617121CE194FEB55EB18E4846E673E1FBA8310F51066EE059C32F6DA31D887CB81

Function 0000014F6D6F073C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F075D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0782
messages.LIBCPMT ref: 0000014F6D6F0805
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F081C
_CxxThrowException.LIBCMT ref: 0000014F6D6F082D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F084B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 7cc497a77380ee9ed3c2c928d128c4cad0fcd30d51c5d3f05070fedc9749b0bd
Instruction ID: 6ab3500beef7591c0602574b9791295189444f2227b3d227d4e60b2f2e49f120
Opcode Fuzzy Hash: 7cc497a77380ee9ed3c2c928d128c4cad0fcd30d51c5d3f05070fedc9749b0bd
Instruction Fuzzy Hash: DE415E31119E0C8FEB55EB19D4847AA77A2FBA8310F110A6ED056C32F6DA21D887CB81

Function 0000014F6D6EFDBC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EFDDD

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EFE02
messages.LIBCPMT ref: 0000014F6D6EFE85
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6EFE9C
_CxxThrowException.LIBCMT ref: 0000014F6D6EFEAD
std::_Facet_Register.LIBCPMT ref: 0000014F6D6EFECB

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: ea6ca55c775d0ccc4dd453c7f7005d0493a2785ec4fecb6ec9dba5e7c9d5e10a
Instruction ID: 83fcbc7905f6b36de4763f02005a5d7415c9d445e5b18c2d542aa8937d22a98b
Opcode Fuzzy Hash: ea6ca55c775d0ccc4dd453c7f7005d0493a2785ec4fecb6ec9dba5e7c9d5e10a
Instruction Fuzzy Hash: 19415531618E099FE755EB28D4856E677E1FB98310F52067ED056C32F2DA31E8878B81

Function 0000014F6D704DB8 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D704DD9

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D704DFE
moneypunct.LIBCPMT ref: 0000014F6D704E81
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D704E98
_CxxThrowException.LIBCMT ref: 0000014F6D704EA9
std::_Facet_Register.LIBCPMT ref: 0000014F6D704EC7

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: ae327d2db070439c1c0d49b2585e1c384ae4971f0289f13c9f66755d90c69a8c
Instruction ID: d65e5a50046d868528529a106ff509a7ea36fbbc9545e8f6f49e940821743b16
Opcode Fuzzy Hash: ae327d2db070439c1c0d49b2585e1c384ae4971f0289f13c9f66755d90c69a8c
Instruction Fuzzy Hash: 43415071518E088FE755EB28D484AEA73E1FBA8314F11067D914AD32F6DA35D887CB82

Function 0000014F6D6E8E44 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E8E65

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E8E8A
messages.LIBCPMT ref: 0000014F6D6E8F0D
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6E8F24
_CxxThrowException.LIBCMT ref: 0000014F6D6E8F35
std::_Facet_Register.LIBCPMT ref: 0000014F6D6E8F53

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 4ced370cee893604592898b3239523f5f93543cc81e6483edbf32b837da03206
Instruction ID: e99de400d4520f7f187afc43193011a93707f4c8d827352c56e44abfa6c77ee2
Opcode Fuzzy Hash: 4ced370cee893604592898b3239523f5f93543cc81e6483edbf32b837da03206
Instruction Fuzzy Hash: 6A412E3111CE188FE759EB68D4846A677A1FBA9310F12467ED05AD33F2DA31DC878B81

Function 0000014F6D6F060C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F062D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0652
messages.LIBCPMT ref: 0000014F6D6F06D5
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F06EC
_CxxThrowException.LIBCMT ref: 0000014F6D6F06FD
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F071B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: a32bcdbd7a4cb4dfc0fa6fcbf62aecbf5d9f3b997f2cf0a477f8f907014e1f81
Instruction ID: 1c7be7235b3afad304d2c568edd61df95a0f4dfc8e5fb6cd2c488d13829c56a4
Opcode Fuzzy Hash: a32bcdbd7a4cb4dfc0fa6fcbf62aecbf5d9f3b997f2cf0a477f8f907014e1f81
Instruction Fuzzy Hash: E6414F71218E188FE755EB19D4857A673E1FBA8310F12066EE056C32F2DA31D887CB81

Function 0000014F6D6E90A4 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E90C5

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E90EA
messages.LIBCPMT ref: 0000014F6D6E916D
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6E9184
_CxxThrowException.LIBCMT ref: 0000014F6D6E9195
std::_Facet_Register.LIBCPMT ref: 0000014F6D6E91B3

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 44f74ad60790d5f728fb9db277d581671f1682aeeeb9c216a3193cbb7b7aedb3
Instruction ID: 041245896657523776bdc196b3d3575be1a536f1c4c5e026506912f051f4658b
Opcode Fuzzy Hash: 44f74ad60790d5f728fb9db277d581671f1682aeeeb9c216a3193cbb7b7aedb3
Instruction Fuzzy Hash: 2C413E3151CA088FE755EB18D4986E677E1FBA9314F12066EE059C33F6DA3198878B81

Function 0000014F6D6F014C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F016D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0192
moneypunct.LIBCPMT ref: 0000014F6D6F0215
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F022C
_CxxThrowException.LIBCMT ref: 0000014F6D6F023D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F025B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: 23175eb6af71c341a43572a7cfc5c5faaad3fe0d8949ac351d6b072308f46143
Instruction ID: 2e90531dfaff77da08affc94903aac99a124e008e47151eefd73bd151fc70427
Opcode Fuzzy Hash: 23175eb6af71c341a43572a7cfc5c5faaad3fe0d8949ac351d6b072308f46143
Instruction Fuzzy Hash: BE415D31208E098FE755EB59D4947E673E2FBA8310F11066ED016C32F6DA31D9878B81

Function 0000014F6D6EF8FC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EF91D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EF942
messages.LIBCPMT ref: 0000014F6D6EF9C5
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6EF9DC
_CxxThrowException.LIBCMT ref: 0000014F6D6EF9ED
std::_Facet_Register.LIBCPMT ref: 0000014F6D6EFA0B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: ad3d27e93c69ba864e2bfe9fd3f3486237bb31b56115dd73a035953c61f75546
Instruction ID: 5f1718344adc19244ddc7a2227e5b3334e03ab8b60596921ae808c373ec1858c
Opcode Fuzzy Hash: ad3d27e93c69ba864e2bfe9fd3f3486237bb31b56115dd73a035953c61f75546
Instruction Fuzzy Hash: F8415031618E094FE755EF19E4846E673E1FBA8310F12066EE055C32F5DA3198878B81

Function 0000014F6D7048F8 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D704919

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D70493E
collate.LIBCPMT ref: 0000014F6D7049C1
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D7049D8
_CxxThrowException.LIBCMT ref: 0000014F6D7049E9
std::_Facet_Register.LIBCPMT ref: 0000014F6D704A07

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID:
API String ID: 3240839640-0
Opcode ID: 0233418cfae809917d103e780ede1da457fc54a499b3717859009be7294f54f8
Instruction ID: eb7749e7d025fa455d157d4ced70fe8ec1fb83618836ab9a61d9161d79efad99
Opcode Fuzzy Hash: 0233418cfae809917d103e780ede1da457fc54a499b3717859009be7294f54f8
Instruction Fuzzy Hash: CF418171518E184FE755EF28D485AA673E1FBA8314F11067DE05AD32F2DA349887CB82

Function 0000014F6D6EF7CC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EF7ED

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EF812
ctype.LIBCPMT ref: 0000014F6D6EF895
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6EF8AC
_CxxThrowException.LIBCMT ref: 0000014F6D6EF8BD
std::_Facet_Register.LIBCPMT ref: 0000014F6D6EF8DB

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID:
API String ID: 3320480354-0
Opcode ID: 9acc7d8935e0b6991aa026bbf44fd62e2f07b53be7d58e42d1e7b8c701af2e2c
Instruction ID: 9d9de5e346bcd906cd0b991e66d5b868fec6d3d8544a2c63a2b418cdfa1ef3dd
Opcode Fuzzy Hash: 9acc7d8935e0b6991aa026bbf44fd62e2f07b53be7d58e42d1e7b8c701af2e2c
Instruction Fuzzy Hash: 42414E3124CE094FE755EB58E4946EB73E1FBA8310F52066ED05AC32F2DA31D8878B81

Function 0000014F6D6E8F74 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E8F95

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E8FBA
ctype.LIBCPMT ref: 0000014F6D6E903D
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6E9054
_CxxThrowException.LIBCMT ref: 0000014F6D6E9065
std::_Facet_Register.LIBCPMT ref: 0000014F6D6E9083

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID:
API String ID: 3320480354-0
Opcode ID: ac8da4e68497b6e33ad6b294c9a5cc016db34243099c128dedc5113e624588cf
Instruction ID: 5238e3563938de7b670fd1aa598070b2325adc80076f13e16f8dd9c40eb783cd
Opcode Fuzzy Hash: ac8da4e68497b6e33ad6b294c9a5cc016db34243099c128dedc5113e624588cf
Instruction Fuzzy Hash: B6414D3111CE084FE795EB189484AAA77A1FBA4314F51466ED05AC33F2DA31D887CB81

Function 0000014F6D6F086C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F088D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F08B2
messages.LIBCPMT ref: 0000014F6D6F0935
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F094C
_CxxThrowException.LIBCMT ref: 0000014F6D6F095D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F097B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: e8914c13f1a63b2bd7b0f8b8eb872b1415bdfa408ac95b106aef2af262e1ca3a
Instruction ID: 1b4ee60d1ca5264be86cadcb099f2fc22f37dc2ca4d44bee5fb7ce063825c864
Opcode Fuzzy Hash: e8914c13f1a63b2bd7b0f8b8eb872b1415bdfa408ac95b106aef2af262e1ca3a
Instruction Fuzzy Hash: A2415231518E1C8FE755EB69D4847AA77E1FBA8310F110A6ED05AC32F2DA31D987CB81

Function 0000014F6D6F001C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F003D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0062
moneypunct.LIBCPMT ref: 0000014F6D6F00E5
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F00FC
_CxxThrowException.LIBCMT ref: 0000014F6D6F010D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F012B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: be434e7532a21790c41d01ca9e6344b4bc2dcf28563e8adecb1c6891a9f02ef6
Instruction ID: 0aee4cb0abeeea360aebcb7585b34c9e5480091d74eaca6c6a2d25f9bf0d30b9
Opcode Fuzzy Hash: be434e7532a21790c41d01ca9e6344b4bc2dcf28563e8adecb1c6891a9f02ef6
Instruction Fuzzy Hash: 7E415F31208E098FE755EB19D485BEA77E1FBA8310F51067EE055C32F6DA319987CB81

Function 0000014F6D6F0ACC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0AED

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0B12
numpunct.LIBCPMT ref: 0000014F6D6F0B95
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F0BAC
_CxxThrowException.LIBCMT ref: 0000014F6D6F0BBD
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F0BDB

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID:
API String ID: 4068408745-0
Opcode ID: 822ec391d6621952e5469a8a2b9ff91c3985372570a95cd92eaf18f1c434b61d
Instruction ID: f0783d8024683de7f44fd97f989f6c698119af1b8f02b29337431615cd79bc0d
Opcode Fuzzy Hash: 822ec391d6621952e5469a8a2b9ff91c3985372570a95cd92eaf18f1c434b61d
Instruction Fuzzy Hash: C9414131218E098FE765EB19D494BEA73E1FB98314F51066ED059C32F2DA32D8878B81

Function 0000014F6D6F027C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F029D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F02C2
moneypunct.LIBCPMT ref: 0000014F6D6F0345
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F035C
_CxxThrowException.LIBCMT ref: 0000014F6D6F036D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F038B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: 576ca43a9229fa76d4c30edbc1c9635a8bd1653c60898644c64f54b1b7beac0d
Instruction ID: 22113258e292da9b3006ad97690e8698b153183c4ba61586c070fe953cb09de8
Opcode Fuzzy Hash: 576ca43a9229fa76d4c30edbc1c9635a8bd1653c60898644c64f54b1b7beac0d
Instruction Fuzzy Hash: D7416331208E098FE765EB29D4857EA77E2FB94310F51066ED049C32F2DA71D883CB81

Function 0000014F6D6EFB5C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EFB7D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EFBA2
messages.LIBCPMT ref: 0000014F6D6EFC25
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6EFC3C
_CxxThrowException.LIBCMT ref: 0000014F6D6EFC4D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6EFC6B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 9179dece544dd2d7b58664dfb820dd996a6c2b9e8f7944b505e616ecfab862ae
Instruction ID: ee0234de09278912b6fad728fd0d776bc71f2910115a94428509f49dcedce9d7
Opcode Fuzzy Hash: 9179dece544dd2d7b58664dfb820dd996a6c2b9e8f7944b505e616ecfab862ae
Instruction Fuzzy Hash: FB41503121CE094FE754EB58E4946D673E1FB98310F11066ED459C32F2DA31D8878B81

Function 0000014F6D704B58 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D704B79

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D704B9E
messages.LIBCPMT ref: 0000014F6D704C21
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D704C38
_CxxThrowException.LIBCMT ref: 0000014F6D704C49
std::_Facet_Register.LIBCPMT ref: 0000014F6D704C67

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 1d91a49bc77edb7e22aa6e9a78d7975369a76cca3a033d80bf35b0100c632c7d
Instruction ID: cb86c46def10b08f11c022c31b35b1a55f6908e9e87736652d45a16af2d51cd2
Opcode Fuzzy Hash: 1d91a49bc77edb7e22aa6e9a78d7975369a76cca3a033d80bf35b0100c632c7d
Instruction Fuzzy Hash: 29415071508E084FE795EF28D485AE677E1FBA8314F11066ED14AD32F2DA35D887CB82

Function 0000014F6D6E9304 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E9325

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E934A
numpunct.LIBCPMT ref: 0000014F6D6E93CD
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6E93E4
_CxxThrowException.LIBCMT ref: 0000014F6D6E93F5
std::_Facet_Register.LIBCPMT ref: 0000014F6D6E9413

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID:
API String ID: 4068408745-0
Opcode ID: 6f03905d0beafbc56963ed536e36f45f80a76ca8702b5fb871efbe115acaf3e9
Instruction ID: aa59cb3072d4206ae197179111a3af7ea46b3fd0daf51383000be08cd6394200
Opcode Fuzzy Hash: 6f03905d0beafbc56963ed536e36f45f80a76ca8702b5fb871efbe115acaf3e9
Instruction Fuzzy Hash: 7D412E3111CE188FE755EB19D4856A677E1FBA8314F12067EE05AC33F6DA31D8878B81

Function 0000014F6D6E91D4 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E91F5

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E921A
messages.LIBCPMT ref: 0000014F6D6E929D
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6E92B4
_CxxThrowException.LIBCMT ref: 0000014F6D6E92C5
std::_Facet_Register.LIBCPMT ref: 0000014F6D6E92E3

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: d65d886f5a4a5fbf692825c0abf740438a2889b3773da977cec666f68a3605b7
Instruction ID: d453b64385f62875f1840ba276d19f52548c74e70034a817ac6c728b138d5bbd
Opcode Fuzzy Hash: d65d886f5a4a5fbf692825c0abf740438a2889b3773da977cec666f68a3605b7
Instruction Fuzzy Hash: E4414F3151CA084FEB95EB28D4946E677A1FBA8314F11066FD05AC33F6DA31D887CB81

Function 0000014F6D6F099C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F09BD

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F09E2
numpunct.LIBCPMT ref: 0000014F6D6F0A65
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F0A7C
_CxxThrowException.LIBCMT ref: 0000014F6D6F0A8D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F0AAB

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID:
API String ID: 4068408745-0
Opcode ID: 9cf474680b64cc0a42dfb88614e6b436c95b169935a0ccc469abbe6bd9e922ca
Instruction ID: bbe8d80388926e4e51a4841be33db33c40c61356c9eeb1a2b6ed2f17f1266e9d
Opcode Fuzzy Hash: 9cf474680b64cc0a42dfb88614e6b436c95b169935a0ccc469abbe6bd9e922ca
Instruction Fuzzy Hash: 99414F31118E0C8FE755EB19D4847A677E1FBA4310F51066ED059C32F2DA3198878B81

Function 0000014F6D704A28 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D704A49

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D704A6E
messages.LIBCPMT ref: 0000014F6D704AF1
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D704B08
_CxxThrowException.LIBCMT ref: 0000014F6D704B19
std::_Facet_Register.LIBCPMT ref: 0000014F6D704B37

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 8101ceada97120b4e31297d4cb69fbff05a20529c4fc301d5dc3a6eecf40290d
Instruction ID: 853691841dfaffd806bba9eaa152e24f513e0d237ab9304b7c84b5540302eb00
Opcode Fuzzy Hash: 8101ceada97120b4e31297d4cb69fbff05a20529c4fc301d5dc3a6eecf40290d
Instruction Fuzzy Hash: 644162B1508E088FE755EB18D484AE673E1FBA8315F11067DD05AD32F2DA34D887CB82

Function 0000014F6D6EFA2C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EFA4D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6EFA72
messages.LIBCPMT ref: 0000014F6D6EFAF5
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6EFB0C
_CxxThrowException.LIBCMT ref: 0000014F6D6EFB1D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6EFB3B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 8ce21f825e0c86f2d4b8cb028bd5239e6d8b4f4478972e71b897618c04ae54ad
Instruction ID: c4276abc76acce0ef40dee817df1cfd106b6ae6570ce337d9dc261f0d73e643b
Opcode Fuzzy Hash: 8ce21f825e0c86f2d4b8cb028bd5239e6d8b4f4478972e71b897618c04ae54ad
Instruction Fuzzy Hash: C441803160CE098FE755EB19E4946EA77E1FBA8310F110A6EE055C72F2DA31D887CB81

Function 000000018000702A Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 00000001800070C2
_CxxThrowException.LIBCMT ref: 00000001800070FB
_CxxThrowException.LIBCMT ref: 0000000180007133

Strings

ios_base::badbit set, xrefs: 0000000180007094
ios_base::failbit set, xrefs: 00000001800070D2
ios_base::eofbit set, xrefs: 0000000180007101

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: 699b7d2228cff961f95bcc84e6e72b285b1e2d0b36deb1e7e2300fec3cbeab5f
Instruction ID: dfa8a448075bbfc6b28c82488b61fa1b389f2e2b11f37815cd1c202517538396
Opcode Fuzzy Hash: 699b7d2228cff961f95bcc84e6e72b285b1e2d0b36deb1e7e2300fec3cbeab5f
Instruction Fuzzy Hash: 0B315272614A8991EBA2DB18E4913D973A0F79C7C8F508522F68C53AA6DF3DC74EC740

Function 0000000180006C5A Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 0000000180006CF2
_CxxThrowException.LIBCMT ref: 0000000180006D2B
_CxxThrowException.LIBCMT ref: 0000000180006D63

Strings

ios_base::badbit set, xrefs: 0000000180006CC4
ios_base::failbit set, xrefs: 0000000180006D02
ios_base::eofbit set, xrefs: 0000000180006D31

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: c1bf02ce45ab6fee79512c4fb28b2e7da53ceb844cf42f62b2c87471bab989a1
Instruction ID: 550f9bc1cb9aa3d44aa237adf6378d9f0374be7e19af6188f2c51a58d4ea2558
Opcode Fuzzy Hash: c1bf02ce45ab6fee79512c4fb28b2e7da53ceb844cf42f62b2c87471bab989a1
Instruction Fuzzy Hash: 5B317C32614A8991EBA2CB14E4913D973A1F7887C4F508522FA8C53AAADF39C64EC740

Function 0000000180003E60 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

fgetwc.LIBCMT ref: 0000000180003F1F

Strings

string too long, xrefs: 00000001800040FE, 000000018000410B

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: fgetwc
String ID: string too long
API String ID: 2948136663-2556327735
Opcode ID: 0cdb356713a80aaaeddf39a95bb224a33fcc27c976fe1ae9947d63c038f79dd6
Instruction ID: 0c42135304bc7002bcbce17c9f89000feb71c0cf079e54a2c2379f72fcdd2e3b
Opcode Fuzzy Hash: 0cdb356713a80aaaeddf39a95bb224a33fcc27c976fe1ae9947d63c038f79dd6
Instruction Fuzzy Hash: 93913873300A89D9EB62CF25C0903EC33A5F358798F918622EB1D47A99DF34CA68C314

Function 0000000180034034 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180034066

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_malloc_crt.LIBCMT ref: 00000001800340B1
_invoke_watson.LIBCMT ref: 0000000180034199

Part of subcall function 0000000180035CD8: _call_reportfault.LIBCMT ref: 0000000180035D00

_invoke_watson.LIBCMT ref: 00000001800341AE

Strings

:, xrefs: 00000001800340CF

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID: :
API String ID: 1584724053-336475711
Opcode ID: 604a302fabdb042f4ebc9b27cedb385bdeaebfe8a2c90ea295b00d5b5a1e0000
Instruction ID: 6d0e94c2461dd84b0edd1b1838a9f5cfcbcc86ad0ff0a6976e9d1f2ec4836e13
Opcode Fuzzy Hash: 604a302fabdb042f4ebc9b27cedb385bdeaebfe8a2c90ea295b00d5b5a1e0000
Instruction Fuzzy Hash: 5C41D032320B4881EB46DF26A8053DE63A5FB88BC4F4AD025EF5D4B785DE38D616C304

Function 0000000180033EB4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000000180033F31
_invoke_watson.LIBCMT ref: 0000000180034019

Part of subcall function 0000000180035CD8: _call_reportfault.LIBCMT ref: 0000000180035D00

_invoke_watson.LIBCMT ref: 000000018003402E
_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180033EE6

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

Strings

:, xrefs: 0000000180033F4F

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID: :
API String ID: 1584724053-336475711
Opcode ID: f6eab2cf8d0451a383fcd1094c8bc586515c01fa06371aa533fca521f759249e
Instruction ID: 3ed635f29bcd3bbc21113fbea3335e451753d90b531e1a175994c922d52f3f57
Opcode Fuzzy Hash: f6eab2cf8d0451a383fcd1094c8bc586515c01fa06371aa533fca521f759249e
Instruction Fuzzy Hash: 8441E03232074881EB46EF26A4453DE63A5FB49BC4F4AD025EF5D47785DE38D61AC304

Function 00000001800311AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 0000000180031203
_getptd.LIBCMT ref: 00000001800311B7

Part of subcall function 00000001800389F4: _getptd_noexit.LIBCMT ref: 00000001800389FA
Part of subcall function 00000001800389F4: _amsg_exit.LIBCMT ref: 0000000180038A0A

_getptd.LIBCMT ref: 0000000180031269
_getptd.LIBCMT ref: 0000000180031275

Strings

csm, xrefs: 0000000180031237

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit_getptd_noexit
String ID: csm
API String ID: 2951875022-1018135373
Opcode ID: 19bc60ab7c8d46f879a577fdbd2134b4bea23403eb8b854014e227e093e25ad5
Instruction ID: cbf58d6bb5dae3ded25f47af1c64b690f48564a0522dc2334fd63855ea109656
Opcode Fuzzy Hash: 19bc60ab7c8d46f879a577fdbd2134b4bea23403eb8b854014e227e093e25ad5
Instruction Fuzzy Hash: D52101362046888AE6B2DF56E0407EFB760F78DBA5F058216EF9943795CF38D689C701

Function 0000014F6D6F0D2C Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0D4D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0D72
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F0E0C
_CxxThrowException.LIBCMT ref: 0000014F6D6F0E1D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F0E3B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: 8fdf513530068a902d25d78bae91176465b11ab45bf8a46f09239c48ad2af317
Instruction ID: 392737ef63fae149a2b08d0d826f5a1b97982ae43a4b732c3c39702260ad29ec
Opcode Fuzzy Hash: 8fdf513530068a902d25d78bae91176465b11ab45bf8a46f09239c48ad2af317
Instruction Fuzzy Hash: A4414F31119E098FE755EB19D4947A677E2FBA8310F12066EE059C32F2DA31E887CB81

Function 0000014F6D6F0BFC Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0C1D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0C42
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F0CDC
_CxxThrowException.LIBCMT ref: 0000014F6D6F0CED
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F0D0B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: e1f4d6eaef8a7574c47d1234b56451b731f0bac4a986ee248217b9bbbeb82756
Instruction ID: 3fbac136462df8c56f934480dfba28faa45dd29ced6bc539dde1b5ee1ebd9243
Opcode Fuzzy Hash: e1f4d6eaef8a7574c47d1234b56451b731f0bac4a986ee248217b9bbbeb82756
Instruction Fuzzy Hash: E6415F31518E088FE754EB19D8947A673E2FB94310F11066EE055C32F2DA31E887CB81

Function 0000014F6D6F0E5C Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0E7D

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0EA2
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F0F3C
_CxxThrowException.LIBCMT ref: 0000014F6D6F0F4D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F0F6B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: f2baaf6b52b28d77f9878d948b49f01641329e4817bae3496f349ebe052f967c
Instruction ID: 5bbb989be66f98c1e6f2fa76b575dad82cf43b034840eda3578f72fbe991c93c
Opcode Fuzzy Hash: f2baaf6b52b28d77f9878d948b49f01641329e4817bae3496f349ebe052f967c
Instruction Fuzzy Hash: 8D416031109E0C8FE754EB19D4847AA77E1FBA8310F12466ED45AC32F2DA31D887CB81

Function 0000014F6D705148 Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D705169

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D70518E
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D705228
_CxxThrowException.LIBCMT ref: 0000014F6D705239
std::_Facet_Register.LIBCPMT ref: 0000014F6D705257

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: 974ede7f30293504cfca69c6e9eedf048e91d7ff5cdced49d59fdf073cd3f58c
Instruction ID: a627393d2873cb091e9bb121361ff3de76f0d926d86d505aca159bb4cedcaf70
Opcode Fuzzy Hash: 974ede7f30293504cfca69c6e9eedf048e91d7ff5cdced49d59fdf073cd3f58c
Instruction Fuzzy Hash: 54415271508E088FE755EB58E484AAA77E1FBA8310F11067DD05AD32F2DA34D987CB82

Function 0000014F6D6F0F8C Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0FAD

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6F0FD2
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6F106C
_CxxThrowException.LIBCMT ref: 0000014F6D6F107D
std::_Facet_Register.LIBCPMT ref: 0000014F6D6F109B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: 754921af7cdef96820ff9b3d4eef77f5c75193bf26e44bc3b8e02521ab34382a
Instruction ID: a18f86bb3d42d9fc04c1f604bc5e13f29b02f9d377ec19c9297fc43039990d5d
Opcode Fuzzy Hash: 754921af7cdef96820ff9b3d4eef77f5c75193bf26e44bc3b8e02521ab34382a
Instruction Fuzzy Hash: 7A419371518E488FE755EB28D485AAA73E1FBA8350F11062ED055C32F2DE35D983CB81

Function 0000014F6D705018 Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D705039

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D70505E
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D7050F8
_CxxThrowException.LIBCMT ref: 0000014F6D705109
std::_Facet_Register.LIBCPMT ref: 0000014F6D705127

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: 92af57e8867080ea5019b2b12003b9e7e07e7fa36929844691497215ad5e35da
Instruction ID: 7d34b3db630dd3a58e0fb4a45b51469e0a34897160f6c2edf13d861e0c1f01c8
Opcode Fuzzy Hash: 92af57e8867080ea5019b2b12003b9e7e07e7fa36929844691497215ad5e35da
Instruction Fuzzy Hash: 9C416371508E088FE755EB28E494AFA77E1FBA4310F51466DD04AD32F5DA34D887CB82

Function 0000014F6D6E8154 Relevance: 7.6, APIs: 5, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E8175

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E819A
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6E8235
_CxxThrowException.LIBCMT ref: 0000014F6D6E8246
std::_Facet_Register.LIBCPMT ref: 0000014F6D6E8264

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: 92015b14bd73c83c1c959776a5be445e619632d57b53d4474fcc8a1895014d5d
Instruction ID: be02b1109ddc7eaca91704817c5139a0e1bf97f1eece1d10d9b1c6743979d6f0
Opcode Fuzzy Hash: 92015b14bd73c83c1c959776a5be445e619632d57b53d4474fcc8a1895014d5d
Instruction Fuzzy Hash: 41412B3111CE088FE755EB28D4946E677A1FBA9310F12067EE05AC33F2DA35D8878B81

Function 0000014F6D6E7914 Relevance: 7.6, APIs: 5, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E7935

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E795A
std::bad_exception::bad_exception.LIBCMT ref: 0000014F6D6E79F5
_CxxThrowException.LIBCMT ref: 0000014F6D6E7A06
std::_Facet_Register.LIBCPMT ref: 0000014F6D6E7A24

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: 91580c9e29cc5cfd3624ebbbe716160b4e59b82f650692f386e3f440ca4f80b6
Instruction ID: fc4bd3a1f881a584f78ef0742171cc02df367915306476a7f826e6fa4565e464
Opcode Fuzzy Hash: 91580c9e29cc5cfd3624ebbbe716160b4e59b82f650692f386e3f440ca4f80b6
Instruction Fuzzy Hash: C5414D3161CE184FEB55EF29D8846A677E1FBA8310F11056ED056C32F2DA31D887CB81

Function 0000000180038C3C Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180038C9E
_isleadbyte_l.LIBCMT ref: 0000000180038CCE
MultiByteToWideChar.KERNEL32 ref: 0000000180038D0D
MultiByteToWideChar.KERNEL32 ref: 0000000180038D5B
_errno.LIBCMT ref: 0000000180038D65

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: ce750271998e25300b2e646f02fc7aaebec70d68116cdf7c58e233941e4e38ee
Instruction ID: 54a50374dbd1f0619f5f0edc3d7c0374764c2683045a736cdbb11a7d2bf11c8c
Opcode Fuzzy Hash: ce750271998e25300b2e646f02fc7aaebec70d68116cdf7c58e233941e4e38ee
Instruction Fuzzy Hash: D841E53221578486E7A38F15E1403AAB7A1FF99FC0F199165FB8857BD9CF38C6458700

Function 000000018002FC18 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000000018002FC25

Part of subcall function 00000001800389F4: _getptd_noexit.LIBCMT ref: 00000001800389FA
Part of subcall function 00000001800389F4: _amsg_exit.LIBCMT ref: 0000000180038A0A

_inconsistency.LIBCMT ref: 000000018002FC33

Part of subcall function 000000018003A450: DecodePointer.KERNEL32(?,?,?,?,000000018003A3FD,?,?,?,000000018002F87E), ref: 000000018003A45B

_getptd.LIBCMT ref: 000000018002FC38
_inconsistency.LIBCMT ref: 000000018002FC54
_getptd.LIBCMT ref: 000000018002FC64

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_amsg_exit_getptd_noexit
String ID:
API String ID: 3669027769-0
Opcode ID: d84545b744132abf258f2739307021ab7867776e2950de2c885c0764620f8872
Instruction ID: 484109b601cdb60bdd28eb5de1a6cf464c0836e84c8d7e2c0ed591a5095a7b89
Opcode Fuzzy Hash: d84545b744132abf258f2739307021ab7867776e2950de2c885c0764620f8872
Instruction Fuzzy Hash: E5F0FE322086CCC1EAE7AB55D2413FD5350AB8DBC4F1DC171BB840738B9E20C6989315

Function 00000001800039C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

string too long, xrefs: 0000000180003C53, 0000000180003C60

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID:
String ID: string too long
API String ID: 0-2556327735
Opcode ID: d80f9fc73ac2c0aa56d40fc8d5a718c0a56552a0bad6d3397c00ff315f2492a8
Instruction ID: 4d068781c1a08710b22694d90911747276d76f42a382d111b7b34a5d35fe3e91
Opcode Fuzzy Hash: d80f9fc73ac2c0aa56d40fc8d5a718c0a56552a0bad6d3397c00ff315f2492a8
Instruction Fuzzy Hash: CC919D72300B8899EB56CF66C0417EC33A5F319B98F818922EB5D67B99DF34CA59C310

Function 000000018002EF40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 000000018002EF4E
malloc.LIBCMT ref: 000000018002EF5A

Part of subcall function 000000018002DA78: _FF_MSGBANNER.LIBCMT ref: 000000018002DAA8
Part of subcall function 000000018002DA78: _NMSG_WRITE.LIBCMT ref: 000000018002DAB2
Part of subcall function 000000018002DA78: HeapAlloc.KERNEL32(?,?,00000000,000000018002CDB6,?,?,00000001,000000018002CCA4,?,?,?,0000000180007B34), ref: 000000018002DACD
Part of subcall function 000000018002DA78: _callnewh.LIBCMT ref: 000000018002DAE6
Part of subcall function 000000018002DA78: _errno.LIBCMT ref: 000000018002DAF1
Part of subcall function 000000018002DA78: _errno.LIBCMT ref: 000000018002DAFC

_CxxThrowException.LIBCMT ref: 000000018002EFA3

Part of subcall function 000000018002F788: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180007B51), ref: 000000018002F7F6
Part of subcall function 000000018002F788: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180007B51), ref: 000000018002F835

Strings

bad allocation, xrefs: 000000018002EF6A

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: ea0ac8f3bb7f8806d4b7c1c7e9112d85322d3ada4e2ebcc9dbd9df240d32668a
Instruction ID: 7e3c26b24389a4ff061514f1b58813529ad7faafdd41edf364d414c0c6e08585
Opcode Fuzzy Hash: ea0ac8f3bb7f8806d4b7c1c7e9112d85322d3ada4e2ebcc9dbd9df240d32668a
Instruction Fuzzy Hash: F1F09AB1605B8E80EEA79B50A0417E95394E78D3C8F448025FA8D0B7A6EE39C34DCB00

Function 0000014F6D6E94F8 Relevance: 6.5, APIs: 4, Instructions: 479stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 0000014F6D6E95A0
localeconv.LIBCMT ref: 0000014F6D6E95B3
strcspn.LIBCMT ref: 0000014F6D6E95C9
_Mpunct.LIBCPMT ref: 0000014F6D6E969B

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: strcspn$Mpunctlocaleconv
String ID:
API String ID: 2882554788-0
Opcode ID: bcc6cb22bcc6662c5148917bc3b0070cd7f36023e4dfb007b0116752ec6da29b
Instruction ID: 2f1b8403f2fe34098a07623c1f5ccc06abab4be88013daf823bac4ee24f50b94
Opcode Fuzzy Hash: bcc6cb22bcc6662c5148917bc3b0070cd7f36023e4dfb007b0116752ec6da29b
Instruction Fuzzy Hash: 5DF1CE30A1CE5C8FEB15EF68C4416EDB7E1EF59300F51056DE48AD32A2DA31998BCB81

Function 0000014F6D6E6704 Relevance: 6.5, APIs: 4, Instructions: 461COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0000014F6D6E6A1F
_CxxThrowException.LIBCMT ref: 0000014F6D6E6A3A
std::exception::exception.LIBCMT ref: 0000014F6D6E6A9D
_CxxThrowException.LIBCMT ref: 0000014F6D6E6AB8

Part of subcall function 0000014F6D6E7414: std::_Xbad_alloc.LIBCPMT ref: 0000014F6D6E74A1

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: ExceptionThrowstd::exception::exception$Xbad_allocstd::_
String ID:
API String ID: 1519488521-0
Opcode ID: 6a8671919e32ba125cade8bebbf54ead894d3c5916fed936291344f9fc298fe1
Instruction ID: 0a13870c152d80c477235b2e2986d7ca55f9b99914baffc4d5f24b3a2e34c46a
Opcode Fuzzy Hash: 6a8671919e32ba125cade8bebbf54ead894d3c5916fed936291344f9fc298fe1
Instruction Fuzzy Hash: 5DE14F3051CA5D8FEB54EF98D4946EEB7E0FB65300F510A2ED146D32E2DA31998BC781

Function 0000000180010C38 Relevance: 6.3, APIs: 4, Instructions: 332stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 0000000180010CE1
localeconv.LIBCMT ref: 0000000180010CF3
strcspn.LIBCMT ref: 0000000180010D07
_Mpunct.LIBCPMT ref: 0000000180010DD8

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: strcspn$Mpunctlocaleconv
String ID:
API String ID: 2882554788-0
Opcode ID: 58ecd130f00b09f8bef17f7d97753f2651f40aaaca60dedd1df9ae10203089cb
Instruction ID: 98907bd55804cf440550a9984b5626c23124420e0867e0600be7f70ad20b48f8
Opcode Fuzzy Hash: 58ecd130f00b09f8bef17f7d97753f2651f40aaaca60dedd1df9ae10203089cb
Instruction Fuzzy Hash: DFE18E32B04E8889EB529F65C4413ED63B1FB4CB88F658115EE8D57B99DF78C64AC340

Function 00000001800107A4 Relevance: 6.3, APIs: 4, Instructions: 331stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 000000018001084D
localeconv.LIBCMT ref: 000000018001085F
strcspn.LIBCMT ref: 0000000180010873
_Mpunct.LIBCPMT ref: 0000000180010944

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: strcspn$Mpunctlocaleconv
String ID:
API String ID: 2882554788-0
Opcode ID: 224329cea580c2bc9a473805bd80dcfbc8fe358384d0317fe36835c614ca270f
Instruction ID: 0755191b1818215e47aef75f24144b8be0e7d395005ccb8dbfd754ea295aee4c
Opcode Fuzzy Hash: 224329cea580c2bc9a473805bd80dcfbc8fe358384d0317fe36835c614ca270f
Instruction Fuzzy Hash: 44E18E32B04E8889FB529FA5C4513ED63B1FB58B88F648115EE8D57B99DF78C24AC340

Function 0000014F6D6E4E34 Relevance: 6.3, APIs: 4, Instructions: 316COMMON

Download Yara Rule

APIs

fgetwc.LIBCMT ref: 0000014F6D6E4EF3

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: fgetwc
String ID:
API String ID: 2948136663-0
Opcode ID: 3db69b43b33087f9728a2504ea2a3bd94983f958b461452a88f201f86a2a2501
Instruction ID: d0e7760c2fd3b2e358fabf46cff9c496bb5db2c84d81d30848af7b4dc783e1fd
Opcode Fuzzy Hash: 3db69b43b33087f9728a2504ea2a3bd94983f958b461452a88f201f86a2a2501
Instruction Fuzzy Hash: 65B14F30218E0DCFDB58EF28C495AE973E0FF68304F51466AE406D36E5DA72E956CB81

Function 0000000180008524 Relevance: 6.3, APIs: 4, Instructions: 302stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 00000001800085CC
localeconv.LIBCMT ref: 00000001800085DF
strcspn.LIBCMT ref: 00000001800085F5
_Mpunct.LIBCPMT ref: 00000001800086C7

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: strcspn$Mpunctlocaleconv
String ID:
API String ID: 2882554788-0
Opcode ID: fce10359bc36b8c483969d2f07a480db227c72c73635d2d78eb5f884875fabf2
Instruction ID: 7cedfd9f43536d940008849a18cc50f9a484f0cb7e860469d92b1f85863b93e9
Opcode Fuzzy Hash: fce10359bc36b8c483969d2f07a480db227c72c73635d2d78eb5f884875fabf2
Instruction Fuzzy Hash: 9DD15B32B05A8889EB52CBB5D4503DD37B1F749BC8F949115EE8967B8ADF38C24AC740

Function 0000014F6D6EDF28 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

_wfsopen.LIBCMT ref: 0000014F6D6EDEBD
fclose.LIBCMT ref: 0000014F6D6EDECA
_wfsopen.LIBCMT ref: 0000014F6D6EDEDF
fseek.LIBCMT ref: 0000014F6D6EDEF9

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: _wfsopen$fclosefseek
String ID:
API String ID: 1261181034-0
Opcode ID: 060668c88b56fe38f5c44a18ba7740774a474d3c0946bdb231730e3168279bf2
Instruction ID: 2e41cce6e81914e71226db0da48d34648e3197c4fe0fad55e731b92a16e0684d
Opcode Fuzzy Hash: 060668c88b56fe38f5c44a18ba7740774a474d3c0946bdb231730e3168279bf2
Instruction Fuzzy Hash: C031FB30618A0A4FF7E8DA2C989A7E572D1E7D4304F16417DD54BC33E6D629DC834B41

Function 0000014F6D6E8294 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000014F6D6E82D3

Part of subcall function 0000014F6D6E8BAC: _lock.LIBCMT ref: 0000014F6D6E8BBE

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0000014F6D6E8310
free.LIBCMT ref: 0000014F6D6E8337
malloc.LIBCMT ref: 0000014F6D6E8356

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: AddfacLocimp::_Locimp_LockitLockit::__lockfreemallocstd::_std::locale::_
String ID:
API String ID: 2732429687-0
Opcode ID: 9338e4efca5c51ffab6ba31e7edec2782b071aaf483cef073fc2194b9753611b
Instruction ID: b318be97a17fd1d92e898e55c0366465a1af03663c50ba1e400f8501d5f057a7
Opcode Fuzzy Hash: 9338e4efca5c51ffab6ba31e7edec2782b071aaf483cef073fc2194b9753611b
Instruction Fuzzy Hash: BB317A70518E088FEB94EF58E884B95B7E0FBA9310F11056EE049C33F6DB75D8828B81

Function 0000000180032F58 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180032F82

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_malloc_crt.LIBCMT ref: 0000000180032FC5
_invoke_watson.LIBCMT ref: 000000018003308A

Part of subcall function 0000000180035CD8: _call_reportfault.LIBCMT ref: 0000000180035D00

_invoke_watson.LIBCMT ref: 00000001800330A0

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID:
API String ID: 1584724053-0
Opcode ID: 3daca0f6dc92f9794fddbcc1cdaa0d0f178e51dead4e14673644e8c31eb13f91
Instruction ID: 60c5c1db5c3b6a439df75705f13e8ee1368a37c7c8ec72173617ca3056aafd03
Opcode Fuzzy Hash: 3daca0f6dc92f9794fddbcc1cdaa0d0f178e51dead4e14673644e8c31eb13f91
Instruction Fuzzy Hash: F231C57271064886EB57DB26941539E67A1E789FC4F05C135EF5D0BB9ACF38D2068304

Function 000000018000CF54 Relevance: 6.1, APIs: 4, Instructions: 75COMMONLIBRARYCODE

Download Yara Rule

APIs

_wfsopen.LIBCMT ref: 000000018000CEE9
fclose.LIBCMT ref: 000000018000CEF6
_wfsopen.LIBCMT ref: 000000018000CF0B
fseek.LIBCMT ref: 000000018000CF25

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _wfsopen$fclosefseek
String ID:
API String ID: 1261181034-0
Opcode ID: 060668c88b56fe38f5c44a18ba7740774a474d3c0946bdb231730e3168279bf2
Instruction ID: ca7f0c424757e16301a012df31de7f28ede8ce03464d2c668ee3546fdfd8efa6
Opcode Fuzzy Hash: 060668c88b56fe38f5c44a18ba7740774a474d3c0946bdb231730e3168279bf2
Instruction Fuzzy Hash: 6921E5327216C885FBE6CB1AD441BE67691A78CBC4F19C134BE0943B95DE35C60A8341

Function 0000000180048310 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180048334

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_errno.LIBCMT ref: 0000000180048340

Part of subcall function 000000018002F2DC: _getptd_noexit.LIBCMT ref: 000000018002F2E0

_invalid_parameter_noinfo.LIBCMT ref: 000000018004834B
strchr.LIBCMT ref: 0000000180048361

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: eb64e8c74a50022202f8ee626fe7dbe8f97126340f84a3ce38f6fe5f0cae3986
Instruction ID: 9616a423f97e3a452b980222ce2d2f9dcf0e870d32183e3c52a82e7da15984e5
Opcode Fuzzy Hash: eb64e8c74a50022202f8ee626fe7dbe8f97126340f84a3ce38f6fe5f0cae3986
Instruction Fuzzy Hash: D0213872204AAC40F7E75E1194D03FD66C0EB88FDAF1AC824FAC6076C5CD28C749A708

Function 00000001800072C0 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800072FF

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000000018000733C
free.LIBCMT ref: 0000000180007363
malloc.LIBCMT ref: 0000000180007382

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: AddfacLocimp::_Locimp_LockitLockit::__lockfreemallocstd::_std::locale::_
String ID:
API String ID: 2732429687-0
Opcode ID: 4c7c4e4cdeb69145b53e9993b344bfcc5c5a1a68407a660adf776166b3026ff4
Instruction ID: 76cda7fa5ebd9028eb80fcaf77cbf10d53a700b3cb3c5ee5f831434e332e8d90
Opcode Fuzzy Hash: 4c7c4e4cdeb69145b53e9993b344bfcc5c5a1a68407a660adf776166b3026ff4
Instruction Fuzzy Hash: 84213B71604A8881EBA2CF11E4403DAB3A0F7597E0F548216EB9D57BA6CF7CC6998740

Function 0000014F6D714E88 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000014F6D714F05
_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000014F6D714EBA

Part of subcall function 0000014F6D710320: _getptd.LIBCMT ref: 0000014F6D710336
Part of subcall function 0000014F6D710320: __updatetlocinfo.LIBCMT ref: 0000014F6D71036B
Part of subcall function 0000014F6D710320: __updatetmbcinfo.LIBCMT ref: 0000014F6D710392

Strings

:, xrefs: 0000014F6D714F24

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_getptd_malloc_crt
String ID: :
API String ID: 875692556-336475711
Opcode ID: b6f76ccc677749e7e47c8f1fd9208b4adf8ad809ee0fda7590a67167e05195a0
Instruction ID: f626cbe2fe5a392b0791ca72bc232cb34aae1bac36ad31020ad47ad2129661cb
Opcode Fuzzy Hash: b6f76ccc677749e7e47c8f1fd9208b4adf8ad809ee0fda7590a67167e05195a0
Instruction Fuzzy Hash: 3941A431228E0C4FDB58EF2898856A573D5F758314F4A477EE44AC32E6DE20D8438682

Function 0000014F6D715008 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000014F6D71503A

Part of subcall function 0000014F6D710320: _getptd.LIBCMT ref: 0000014F6D710336
Part of subcall function 0000014F6D710320: __updatetlocinfo.LIBCMT ref: 0000014F6D71036B
Part of subcall function 0000014F6D710320: __updatetmbcinfo.LIBCMT ref: 0000014F6D710392

_malloc_crt.LIBCMT ref: 0000014F6D715085

Strings

:, xrefs: 0000014F6D7150A4

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_getptd_malloc_crt
String ID: :
API String ID: 875692556-336475711
Opcode ID: 87dcd81199e5c75fe6f4eb1ed4ca3c3cad752f6282d2ad23c1f32017a9299fd6
Instruction ID: 9854d6a57b29005152bbe1c559822377a82a5f5e25923dd968c9d147e357339b
Opcode Fuzzy Hash: 87dcd81199e5c75fe6f4eb1ed4ca3c3cad752f6282d2ad23c1f32017a9299fd6
Instruction Fuzzy Hash: 01417331628E0C4FDB59EF2898857B573E5E759310F46477EE44AC72E6DE20D84386C2

Function 00000001800495E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000001800496A8

Strings

csm, xrefs: 000000018004960B
csm, xrefs: 0000000180049664

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: ce9d772766a9f3e407c5664677aefc26ffad84ba179c49f55fff2b9c6189d35d
Instruction ID: f7e595c495de74603a87214bb7ed729c6939f290df5d238fa3d8429b20b6b438
Opcode Fuzzy Hash: ce9d772766a9f3e407c5664677aefc26ffad84ba179c49f55fff2b9c6189d35d
Instruction Fuzzy Hash: 6031A773101B48CADBA18F66C0843993BB5F358B9DF8B5225FA4D1BB64CB75C984C788

Function 0000000180035C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 0000000180035C77
_invoke_watson.LIBCMT ref: 0000000180035CAF

Strings

FO0, xrefs: 0000000180035C67

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: DecodePointer_invoke_watson
String ID: FO0
API String ID: 3720117681-3664661254
Opcode ID: 1a24c586f539ebfd2c0a5ef53696a7bebdf636d1a8c4f9902d003cba3ab75ddf
Instruction ID: f162f52b762c08721a514c5dfeb861cb254f16a5a333f69af23bf2198ebd7ceb
Opcode Fuzzy Hash: 1a24c586f539ebfd2c0a5ef53696a7bebdf636d1a8c4f9902d003cba3ab75ddf
Instruction Fuzzy Hash: AAF0D13AB14B8882E7659B62B84574AA760F79DBC4F588825BF8C07F29CE3CD1158B00

Function 00000001800496D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 000000018002FC18: _getptd.LIBCMT ref: 000000018002FC25
Part of subcall function 000000018002FC18: _inconsistency.LIBCMT ref: 000000018002FC33
Part of subcall function 000000018002FC18: _getptd.LIBCMT ref: 000000018002FC38
Part of subcall function 000000018002FC18: _inconsistency.LIBCMT ref: 000000018002FC54

_getptd.LIBCMT ref: 000000018004972B
_getptd.LIBCMT ref: 000000018004973E

Part of subcall function 000000018002FCA8: _getptd.LIBCMT ref: 000000018002FCB1

Strings

csm, xrefs: 00000001800496F8

Memory Dump Source

Source File: 00000000.00000002.2336257143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2336239564.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336297883.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336322467.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2336359868.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _getptd$_inconsistency
String ID: csm
API String ID: 1773999731-1018135373
Opcode ID: 242ad1541a1665e7e88aaf19789ec1deda19dbf05a08f0dcd3087e0f0a85a81f
Instruction ID: 6596bc08887fd2df5714e5c2ca6ea54ff60e088d84c846dd7f248314ba4ebb2f
Opcode Fuzzy Hash: 242ad1541a1665e7e88aaf19789ec1deda19dbf05a08f0dcd3087e0f0a85a81f
Instruction Fuzzy Hash: 8D01A736115A4989DBA2AF71D4C17FD2394E7497C9F099171FE4946349DE20C6C9C340

Function 0000014F6D6E33C4 Relevance: 5.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 0000014F6D6E3416
_CxxThrowException.LIBCMT ref: 0000014F6D6E3452
_CxxThrowException.LIBCMT ref: 0000014F6D6E347A
_CxxThrowException.LIBCMT ref: 0000014F6D6E34A2

Memory Dump Source

Source File: 00000000.00000002.2363782613.0000014F6D6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000014F6D6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f6d6e0000_loaddll64.jbxd

Similarity

API ID: ExceptionThrow
String ID:
API String ID: 432778473-0
Opcode ID: 34052b98ec5b6cb08a453d4da99d8fe8dbaf6c7a065dd0f46931283defdf51d4
Instruction ID: 92dca8827b221345efdd8185e89703ff4e51a5004ea22bfead49976d2ab4723e
Opcode Fuzzy Hash: 34052b98ec5b6cb08a453d4da99d8fe8dbaf6c7a065dd0f46931283defdf51d4
Instruction Fuzzy Hash: FA213031818B1CCEEF16EF54EC41ADEB3B4FB24305F14432AE406D61A1EB3596878B81

Analysis Process: rundll32.exePID: 7408, Parent PID: 7312COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	98.2%
Signature Coverage:	0%
Total number of Nodes:	224
Total number of Limit Nodes:	6

Executed Functions

Function 00007FF8A869A250 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 640
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF8A869A5C4

Strings

+=, xrefs: 00007FF8A869A2F5

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: +=
API String ID: 4275171209-1123256139
Opcode ID: 97e9a56a448ecaa7363e47874dce10fabfe0d6ccf1fb59d6a2af93f8f1d517d2
Instruction ID: 78325b91a9024fe16dee76ca4a7fe7e05e376996b738879e7098592192bd05d3
Opcode Fuzzy Hash: 97e9a56a448ecaa7363e47874dce10fabfe0d6ccf1fb59d6a2af93f8f1d517d2
Instruction Fuzzy Hash: 66C1CDE37613583AFD1B86A67E16FAD90029B42BF5C5093317D390ABCAF13C68CB8540

Function 00007FF8A869A3C0 Relevance: 1.6, APIs: 1, Instructions: 306
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF8A869A5C4

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8cb194e6ffdbc4f4ebece6793a7d4bb003f80c8fce03c4cbf3f4b683e7597c4b
Instruction ID: 389feeaa012dc3922a08e29dc5e6084110eacfa6bf5b45f30e8ddc8a16230d29
Opcode Fuzzy Hash: 8cb194e6ffdbc4f4ebece6793a7d4bb003f80c8fce03c4cbf3f4b683e7597c4b
Instruction Fuzzy Hash: A751D2E3B713582AF91B86AA7D16FAD90029B52BF5C5493317D3906BCAF13C68CB8540

Function 00007FF8A869A4C0 Relevance: 1.4, APIs: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF8A869A5C4

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0d2d5d6dfa6f50465e0a3596790292fef24e24249b2b6cf750ec3e9fa2e6afe6
Instruction ID: 6a5f8257ce671462ed7a5e973fb7f74aa322d97e317348862fb750fc507a4fc4
Opcode Fuzzy Hash: 0d2d5d6dfa6f50465e0a3596790292fef24e24249b2b6cf750ec3e9fa2e6afe6
Instruction Fuzzy Hash: 6F2102E3B603183BF91B86BA3D12FBD50029B52BF5C50A3217D3916BC6E13C69CB8640

Function 00000001800026C0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 269
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000180002CB0: GetModuleFileNameW.KERNEL32 ref: 0000000180002CFC

GetModuleFileNameW.KERNEL32 ref: 000000018000276F
SHGetSpecialFolderPathW.SHELL32 ref: 0000000180002786
lstrcatW.KERNEL32 ref: 000000018000279A
lstrcatW.KERNEL32 ref: 00000001800027AE
lstrcatW.KERNEL32 ref: 00000001800027C2
lstrcatW.KERNEL32 ref: 00000001800027D6
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0000000180002B4F

Strings

\NTUSER.DAT.Not, xrefs: 000000018000278C
GfeXcodeFunc, xrefs: 0000000180002A43

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: lstrcat$FileModuleName$FolderIos_base_dtorPathSpecialstd::ios_base::_
String ID: GfeXcodeFunc$\NTUSER.DAT.Not
API String ID: 2606783807-3673055099
Opcode ID: f4fb330f2fce6a57cdb251511d5a633e98aa520d2ba9185056906fd6c2a3254f
Instruction ID: 5b91f0b68c497ecbefdd096ad22c36a01d1dfa7b74f7b8fae1d4cb91b2026b10
Opcode Fuzzy Hash: f4fb330f2fce6a57cdb251511d5a633e98aa520d2ba9185056906fd6c2a3254f
Instruction Fuzzy Hash: 0EE15B32224B8989EBA1DF24D8943DD3761F7897C8F809126F64D47AA9DF74C64DC740

Function 000002CA6ABD0B00 Relevance: 4.1, APIs: 3, Instructions: 371
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002CA6ABD0C5E
VirtualAlloc.KERNELBASE ref: 000002CA6ABD0CCC

Memory Dump Source

Source File: 00000004.00000002.2381302924.000002CA6ABD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002CA6ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca6abd0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7479d515978b8398c8f18a7fbb8c6ce0b9f2a044b6e8d29228c90f9ede51720f
Instruction ID: 1a2da287cc120b4c6060f4ee3e33f7345d6b33814d73a2a141fc395c25abb76f
Opcode Fuzzy Hash: 7479d515978b8398c8f18a7fbb8c6ce0b9f2a044b6e8d29228c90f9ede51720f
Instruction Fuzzy Hash: 24E10C30258B498FE794EB28C098B6AB7E0FB9C359F64495DE48AC7261D774D8C1CB02

Function 00007FF8A869A5A0 Relevance: 1.3, APIs: 1, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF8A869A5C4

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 17eed5974d73b5d85aa82098f38f35d8dd9d716a6e7e215ce0e9f7d452ed3bce
Instruction ID: 4f29dad2a492d62e1c88ec3c46989233f4dcf519ae0428be478fb385e7a8fcee
Opcode Fuzzy Hash: 17eed5974d73b5d85aa82098f38f35d8dd9d716a6e7e215ce0e9f7d452ed3bce
Instruction Fuzzy Hash: 7EF0A0E3B252543AFA038AA67C01FBE55211742BF4E1493313E3822BC5E43899CB8600

Non-executed Functions

Function 00007FF8A87A2E50 Relevance: 77.4, APIs: 37, Strings: 7, Instructions: 389
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF8A87A2E90
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A2F98
LocalAlloc.KERNEL32 ref: 00007FF8A87A2FAE
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A2FCA
LoadLibraryExW.KERNEL32 ref: 00007FF8A87A302E
GetLastError.KERNEL32 ref: 00007FF8A87A3040
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A305B
LocalAlloc.KERNEL32 ref: 00007FF8A87A3073
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A308F
LoadLibraryExW.KERNEL32 ref: 00007FF8A87A30ED
GetLastError.KERNEL32 ref: 00007FF8A87A30FF
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A311A
LocalAlloc.KERNEL32 ref: 00007FF8A87A3132
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A314E
LoadLibraryExW.KERNEL32 ref: 00007FF8A87A31AD
GetLastError.KERNEL32 ref: 00007FF8A87A31BF
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A31DA
LocalAlloc.KERNEL32 ref: 00007FF8A87A31F2
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A320E
LoadLibraryExW.KERNEL32 ref: 00007FF8A87A326D
GetLastError.KERNEL32 ref: 00007FF8A87A327F
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A329A
LocalAlloc.KERNEL32 ref: 00007FF8A87A32B2
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A32CE
LoadLibraryExW.KERNEL32 ref: 00007FF8A87A332D
GetLastError.KERNEL32 ref: 00007FF8A87A333F
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A335A
LocalAlloc.KERNEL32 ref: 00007FF8A87A3372
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87A338F
LoadLibraryExW.KERNEL32 ref: 00007FF8A87A33F2
GetLastError.KERNEL32 ref: 00007FF8A87A3404
LocalFree.KERNEL32 ref: 00007FF8A87A3428
LocalFree.KERNEL32 ref: 00007FF8A87A3431
LocalFree.KERNEL32 ref: 00007FF8A87A343A
LocalFree.KERNEL32 ref: 00007FF8A87A3443
LocalFree.KERNEL32 ref: 00007FF8A87A344C
LocalFree.KERNEL32 ref: 00007FF8A87A3455

Strings

drvstore.dll, xrefs: 00007FF8A87A3172, 00007FF8A87A319E
devobj.dll, xrefs: 00007FF8A87A3232, 00007FF8A87A325E
\mfpmp.exe, xrefs: 00007FF8A87A2EC7
wldp.dll, xrefs: 00007FF8A87A32F3, 00007FF8A87A331E
cryptnet.dll, xrefs: 00007FF8A87A30B3, 00007FF8A87A30DE
cryptbase.dll, xrefs: 00007FF8A87A33B2, 00007FF8A87A33E3
msasn1.dll, xrefs: 00007FF8A87A2FF0, 00007FF8A87A301F

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: DirectoryLocalSystem$AllocErrorFreeLastLibraryLoad$FileModuleName
String ID: \mfpmp.exe$cryptbase.dll$cryptnet.dll$devobj.dll$drvstore.dll$msasn1.dll$wldp.dll
API String ID: 1091566109-3852175644
Opcode ID: 4abbe1daccf4be878ad19c12dbb057b041b05a0faf224e1ad032174ad0e4b94a
Instruction ID: 0f7ab4dc547695b6f48547b91ae8a1371c71e8105fd7a6accb4de2ad6d6a601c
Opcode Fuzzy Hash: 4abbe1daccf4be878ad19c12dbb057b041b05a0faf224e1ad032174ad0e4b94a
Instruction Fuzzy Hash: 5502B836E0A642A6E7558F11E448379B3A2FF84BD5F588139D94E43394EF3CE844C768

Function 00007FF8A87B03E0 Relevance: 40.5, APIs: 13, Strings: 10, Instructions: 298libraryloaderCOMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNEL32 ref: 00007FF8A87B043D
OutputDebugStringW.KERNEL32 ref: 00007FF8A87B0446
OutputDebugStringW.KERNEL32 ref: 00007FF8A87B0453
OutputDebugStringW.KERNEL32 ref: 00007FF8A87B054B
LoadLibraryExW.KERNEL32 ref: 00007FF8A87B05CA
LocalFree.KERNEL32 ref: 00007FF8A87B05D6
GetProcAddress.KERNEL32 ref: 00007FF8A87B05FF
GetProcAddress.KERNEL32 ref: 00007FF8A87B062F
GetProcAddress.KERNEL32 ref: 00007FF8A87B065F
GetProcAddress.KERNEL32 ref: 00007FF8A87B06A2

Part of subcall function 00007FF8A87AB2C0: GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87AB2E8
Part of subcall function 00007FF8A87AB2C0: LocalAlloc.KERNEL32 ref: 00007FF8A87AB30B
Part of subcall function 00007FF8A87AB2C0: GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87AB31E

OutputDebugStringW.KERNEL32 ref: 00007FF8A87B0886
SetLastError.KERNEL32 ref: 00007FF8A87B088E
SetLastError.KERNEL32 ref: 00007FF8A87B08D4

Strings

RegCloseKey, xrefs: 00007FF8A87B0655
Advapi32.dll, xrefs: 00007FF8A87B05AB
Ole32.dll, xrefs: 00007FF8A87B0680
RegOpenKeyExW, xrefs: 00007FF8A87B05F5
StringFromGUID2, xrefs: 00007FF8A87B0698
*** WARNING - PE SIGNATURE VERIFICATION FAILED !!!*** Filename: , xrefs: 00007FF8A87B0429
RegEnumValueW, xrefs: 00007FF8A87B0625
*** Signature override detected..., xrefs: 00007FF8A87B087F
*** Error: , xrefs: 00007FF8A87B044C
SOFTWARE\NVIDIA Corporation\Global, xrefs: 00007FF8A87B075B

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: DebugOutputString$AddressProc$DirectoryErrorLastLocalSystem$AllocFreeLibraryLoad
String ID: *** Error: $*** Signature override detected...$*** WARNING - PE SIGNATURE VERIFICATION FAILED !!!*** Filename: $Advapi32.dll$Ole32.dll$RegCloseKey$RegEnumValueW$RegOpenKeyExW$SOFTWARE\NVIDIA Corporation\Global$StringFromGUID2
API String ID: 2490301347-1438071108
Opcode ID: 1d6b9df3eebe2aa38a0ebf8ac068eb6c25e5af42a1da8503f22a176f1522249a
Instruction ID: 15f677d8d56d42400eb5023e6b17b24f368284ed022b8e3fdcc6f0a023d1181f
Opcode Fuzzy Hash: 1d6b9df3eebe2aa38a0ebf8ac068eb6c25e5af42a1da8503f22a176f1522249a
Instruction Fuzzy Hash: D8D1C325E0AB42AAEB109F15E8582B973A1FF987D4F484134DA4F43764EF3CE445C728

Function 00007FF8A8691180 Relevance: 31.9, APIs: 5, Strings: 13, Instructions: 442COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8689D50: SHCreateDirectoryExW.SHELL32 ref: 00007FF8A87ADE55

FreeLibrary.KERNEL32 ref: 00007FF8A87AF7B9

Strings

\nvngx_config.txt, xrefs: 00007FF8A87AF85C
warning: skipping downloaded snippet due to lower version %d.%d.%d < %d.%d.%d, xrefs: 00007FF8A87AF949
app_, xrefs: 00007FF8A87AFB47
app %llX feature %S snippet: %S, xrefs: 00007FF8A87AFAC8
, xrefs: 00007FF8A87AFB1A
Fallback snippet '%S' missing or corrupted - last error %S, xrefs: 00007FF8A87AFD9C
%d.%d.%d, xrefs: 00007FF8A87AF8F1
NGXSecureLoadFeature, xrefs: 00007FF8A87AF950, 00007FF8A87AFACF, 00007FF8A87AFDA3
%u.%u.%u, xrefs: 00007FF8A87AFC9B
app_%07llX, xrefs: 00007FF8A87AF88F
\nvngx_, xrefs: 00007FF8A87AF70E
.dll, xrefs: 00007FF8A87AF74A
C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_common.cpp, xrefs: 00007FF8A87AF95C, 00007FF8A87AFADB, 00007FF8A87AFDAF

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: CreateDirectoryFreeLibrary
String ID: $%d.%d.%d$%u.%u.%u$.dll$C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_common.cpp$Fallback snippet '%S' missing or corrupted - last error %S$NGXSecureLoadFeature$\nvngx_$\nvngx_config.txt$app %llX feature %S snippet: %S$app_$app_%07llX$warning: skipping downloaded snippet due to lower version %d.%d.%d < %d.%d.%d
API String ID: 3196203574-130269148
Opcode ID: e9f055d2c8ab49e8c2135653ee8cf23de3578d4b003e5cf818e5647b115275bf
Instruction ID: 29ed769d6a5f206d45610d3dd71c542f68c6573f03662e12b47cb8b0f1fdfc8a
Opcode Fuzzy Hash: e9f055d2c8ab49e8c2135653ee8cf23de3578d4b003e5cf818e5647b115275bf
Instruction Fuzzy Hash: 6F22AF32A0AB46A6EB10DF21E8442EEB7A4FB447C8F445132DA4D47BA9DF3CE505C758

Function 00007FF8A86888B0 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 216memorylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A87A1790: VerSetConditionMask.KERNEL32 ref: 00007FF8A87A17C9
Part of subcall function 00007FF8A87A1790: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A17F4

GetFileAttributesW.KERNEL32 ref: 00007FF8A87A4DAD
LocalAlloc.KERNEL32 ref: 00007FF8A87A4DDC
SetLastError.KERNEL32 ref: 00007FF8A87A4DFB
SetLastError.KERNEL32 ref: 00007FF8A87A4E26
SetLastError.KERNEL32 ref: 00007FF8A87A4E3D
GetProcAddress.KERNEL32 ref: 00007FF8A87A4EA0
GetProcAddress.KERNEL32 ref: 00007FF8A87A4ECC
GetProcAddress.KERNEL32 ref: 00007FF8A87A4EFC
LocalAlloc.KERNEL32 ref: 00007FF8A87A4F8E

Part of subcall function 00007FF8A879F440: GetProcAddress.KERNEL32 ref: 00007FF8A879F4CA
Part of subcall function 00007FF8A879F440: GetProcAddress.KERNEL32 ref: 00007FF8A879F4FA
Part of subcall function 00007FF8A879F440: GetProcAddress.KERNEL32 ref: 00007FF8A879F535
Part of subcall function 00007FF8A879F440: LocalAlloc.KERNEL32 ref: 00007FF8A879F57A

LocalAlloc.KERNEL32 ref: 00007FF8A87A5017
LocalFree.KERNEL32 ref: 00007FF8A87A507E
LocalFree.KERNEL32 ref: 00007FF8A87A5087
SetLastError.KERNEL32 ref: 00007FF8A87A50B1

Strings

, xrefs: 00007FF8A87A4E0F
SetupDiDestroyDeviceInfoList, xrefs: 00007FF8A87A4EF2
Setupapi.dll, xrefs: 00007FF8A87A4E75
SetupGetInfDriverStoreLocationW, xrefs: 00007FF8A87A4EC2
SetupDiGetDevicePropertyW, xrefs: 00007FF8A87A4E96

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AddressLocalProc$AllocErrorLast$Free$AttributesConditionFileInfoMaskVerifyVersion
String ID: $SetupDiDestroyDeviceInfoList$SetupDiGetDevicePropertyW$SetupGetInfDriverStoreLocationW$Setupapi.dll
API String ID: 479516965-2442375720
Opcode ID: 0e7f3fc1ebfef63b9e8befe8db0f7b3ef450d689d6004afb69a9e041b426c530
Instruction ID: 238ee7a0ee0385d1119bacd5ceca0f7529a3ea9c4dc7fc00f13b220d1033b7ce
Opcode Fuzzy Hash: 0e7f3fc1ebfef63b9e8befe8db0f7b3ef450d689d6004afb69a9e041b426c530
Instruction Fuzzy Hash: 17A17131B0EB42A6FB548F65A84827AA3A1FF887D5F484035D94E477A4EF3CE445C728

Function 00007FF8A87A1410 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 170memorylibraryloaderCOMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1470
VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1480
VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1490
VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A14CA
GetFullPathNameW.KERNEL32 ref: 00007FF8A87A1510
LocalAlloc.KERNEL32 ref: 00007FF8A87A152A
GetFullPathNameW.KERNEL32 ref: 00007FF8A87A1547
GetProcAddress.KERNEL32 ref: 00007FF8A87A15A2
LocalAlloc.KERNEL32 ref: 00007FF8A87A1606
LocalFree.KERNEL32 ref: 00007FF8A87A1679

Part of subcall function 00007FF8A87A1A50: VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1A9C
Part of subcall function 00007FF8A87A1A50: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A1AC7

LocalFree.KERNEL32 ref: 00007FF8A87A169F
LocalFree.KERNEL32 ref: 00007FF8A87A16A8

Strings

*, xrefs: 00007FF8A87A145A
$, xrefs: 00007FF8A87A143B
&, xrefs: 00007FF8A87A1446
Shell32.dll, xrefs: 00007FF8A87A1580
SHGetFolderPathW, xrefs: 00007FF8A87A1598

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Local$ConditionMask$Free$AllocFullInfoNamePathVerifyVersion$AddressProc
String ID: $$&$*$SHGetFolderPathW$Shell32.dll
API String ID: 4287201591-2843092907
Opcode ID: 0d21c32348157cc0ab237aa4f896f8d6952255a1767e61a319935305476e1cf3
Instruction ID: 7c7ee0eb703d59a14c1696a57df56e68e6b750648d42db70111d516d3a702c73
Opcode Fuzzy Hash: 0d21c32348157cc0ab237aa4f896f8d6952255a1767e61a319935305476e1cf3
Instruction Fuzzy Hash: BD71CD34E0B642A6FB54CB21A8482B9A3A1FF85BE4F488134C95E47794EF3CE401C738

Function 00007FF8A87AC200 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 198libraryloadermemoryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF8A87AC286
LocalFree.KERNEL32 ref: 00007FF8A87AC292
GetProcAddress.KERNEL32 ref: 00007FF8A87AC2BB
GetProcAddress.KERNEL32 ref: 00007FF8A87AC2EB
GetProcAddress.KERNEL32 ref: 00007FF8A87AC317
GetProcAddress.KERNEL32 ref: 00007FF8A87AC343

Part of subcall function 00007FF8A87AB2C0: GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87AB2E8
Part of subcall function 00007FF8A87AB2C0: LocalAlloc.KERNEL32 ref: 00007FF8A87AB30B
Part of subcall function 00007FF8A87AB2C0: GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87AB31E

LocalAlloc.KERNEL32 ref: 00007FF8A87AC428
LocalFree.KERNEL32 ref: 00007FF8A87AC4B7

Strings

SetupDiDestroyDeviceInfoList, xrefs: 00007FF8A87AC339
VEN_10DE, xrefs: 00007FF8A87AC49B
SetupDiGetClassDevsW, xrefs: 00007FF8A87AC2B1
SetupDiGetDeviceInterfaceDetailW, xrefs: 00007FF8A87AC30D
Setupapi.dll, xrefs: 00007FF8A87AC26A
SetupDiEnumDeviceInterfaces, xrefs: 00007FF8A87AC2E1

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AddressLocalProc$AllocDirectoryFreeSystem$LibraryLoad
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInterfaces$SetupDiGetClassDevsW$SetupDiGetDeviceInterfaceDetailW$Setupapi.dll$VEN_10DE
API String ID: 3259344501-2772812945
Opcode ID: 7c644d129dc48527469084b3c10780ee942e85d54860aab42b046474c5722e56
Instruction ID: dcc03ab804d36be480518ccb392ca76113625f3204a436016f21cff961aabc91
Opcode Fuzzy Hash: 7c644d129dc48527469084b3c10780ee942e85d54860aab42b046474c5722e56
Instruction Fuzzy Hash: 49915A26B0BB02A9FB50CB61A8183B867A4FB88BC8F484135DE4D52754EF3CE515C368

Function 00007FF8A8695890 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 220COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF8A876FB08
GetLastError.KERNEL32 ref: 00007FF8A876FB1A

Strings

%s: Not able to create pending event, error - %x, xrefs: 00007FF8A876FBDB
%s: Not able to create done event, error - %x, xrefs: 00007FF8A876FB20
%s: Not able to create communication event, error - %x, xrefs: 00007FF8A876FB78
%s: Not able to create initialize event, error - %x, xrefs: 00007FF8A876FBA8
CNvVideoTranscode::InitializeForTranscode, xrefs: 00007FF8A876FB27

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: %s: Not able to create communication event, error - %x$%s: Not able to create done event, error - %x$%s: Not able to create initialize event, error - %x$%s: Not able to create pending event, error - %x$CNvVideoTranscode::InitializeForTranscode
API String ID: 545576003-2512211399
Opcode ID: 0d6106a9cdd94714d348079f01c4fa2d53b6e87335efbfb1ddaa6cc34244b657
Instruction ID: 3137e6bedc2a118e60bc2f26357c9707bc96f25ddfd168800b1fd7af4067362b
Opcode Fuzzy Hash: 0d6106a9cdd94714d348079f01c4fa2d53b6e87335efbfb1ddaa6cc34244b657
Instruction Fuzzy Hash: 4BB14A32B0AB42AAEB64DF64E4942ED33B5FF48B88F445531EA4E53658EF38E505C314

Function 00007FF8A8683260 Relevance: 10.7, APIs: 7, Instructions: 172COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00007FF8A88B130B
GetUserDefaultLCID.KERNEL32 ref: 00007FF8A88B1324
ProcessCodePage.LIBCMT ref: 00007FF8A88B134E
IsValidCodePage.KERNEL32 ref: 00007FF8A88B1360
IsValidLocale.KERNEL32 ref: 00007FF8A88B1376
GetLocaleInfoW.KERNEL32 ref: 00007FF8A88B13D2
GetLocaleInfoW.KERNEL32 ref: 00007FF8A88B13EE

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Locale$CodeInfoPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2191266518-0
Opcode ID: 7161c4c073c619cc4f129a55f6de4c8bf5d416bdf22814918288a3d7024a389d
Instruction ID: d937cba04ca4ff5b04cd7edb81c922b5832c1e2cac78425fb8cc09dcbbe63764
Opcode Fuzzy Hash: 7161c4c073c619cc4f129a55f6de4c8bf5d416bdf22814918288a3d7024a389d
Instruction Fuzzy Hash: E2718B26F1A606ADFB50DB60D8582FD32A0FF88B84F444135CA9D5BA84EF3CE455C368

Function 00007FF8A868C4B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF8A889EE4E
try_get_function.LIBVCRUNTIME ref: 00007FF8A889EEB1

Strings

GetEnabledXStateFeatures, xrefs: 00007FF8A889EE47
GetLocaleInfoEx, xrefs: 00007FF8A889EEA5

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: try_get_function
String ID: GetEnabledXStateFeatures$GetLocaleInfoEx
API String ID: 2742660187-3297707652
Opcode ID: a130f83b860ec145877ee2c0ac99f2bd9b8d4243ce3a9c210e22fa574152f31c
Instruction ID: d2d044dd3eed4e8eb755de97bffd1cf40d5bbc92ed45403f210e40c73e01c7df
Opcode Fuzzy Hash: a130f83b860ec145877ee2c0ac99f2bd9b8d4243ce3a9c210e22fa574152f31c
Instruction Fuzzy Hash: 25119421F0FA42E5E720AB55A8484A9A760EF54BC0F984536EA0C03B95DF7CE5058768

Function 00007FF8A868CA80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF8A878A9FE

Strings

%s - CoCreateInstance on CLSID_WICImagingFactory failed,, xrefs: 00007FF8A878AA1C
CNvWICImageDecoder::initialize, xrefs: 00007FF8A878AA10

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: CreateInstance
String ID: %s - CoCreateInstance on CLSID_WICImagingFactory failed,$CNvWICImageDecoder::initialize
API String ID: 542301482-2443861360
Opcode ID: 93a664d948b0c99a7ed7cf4bc5cc02cfd8e37e51f5e31fbc025b1db1ec8abdb6
Instruction ID: 5b2700b06058258535356a4d78d43721cd241f1db9f8377fa70a85cfd9fdfad0
Opcode Fuzzy Hash: 93a664d948b0c99a7ed7cf4bc5cc02cfd8e37e51f5e31fbc025b1db1ec8abdb6
Instruction Fuzzy Hash: CE118F32B0AA85A2EB10CB29E804269B3A0FB48BC8F594432DB4D43768DF3DD985C755

Function 00007FF8A86856A0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF8A88B911B

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 636ca2e8d16714f8e9f5f800e23f672016befd2f66aaf1b834946735b8b5e2b1
Instruction ID: 77d38a75f4bf9f0d6d5af3ffc7bead7bfbd94293351a24dac35743a634424507
Opcode Fuzzy Hash: 636ca2e8d16714f8e9f5f800e23f672016befd2f66aaf1b834946735b8b5e2b1
Instruction Fuzzy Hash: E8116A26B19A8496E720CB15E94C3AEB6A0FBC8BE8F240225DB6C477E5DF3CD441C754

Function 00007FF8A868D230 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF8A86FF972

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 692cdf69a8af2ca06fa06deacd1959d792d6a01867b2755f0af50de4269ff097
Instruction ID: 2529855d0c011eb1d225fec972dbcc80e46826fe2e9e4a9a32d258b066e12fed
Opcode Fuzzy Hash: 692cdf69a8af2ca06fa06deacd1959d792d6a01867b2755f0af50de4269ff097
Instruction Fuzzy Hash: EFC01222E09485A7E6106714D48906A7230FF84745F904030F64E41791DE1CD9148B54

Function 00007FF8A868B800 Relevance: 49.1, APIs: 13, Strings: 15, Instructions: 138
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00007FF8A87A5E41
GetProcAddress.KERNEL32 ref: 00007FF8A87A5E72
GetProcAddress.KERNEL32 ref: 00007FF8A87A5EA3
GetProcAddress.KERNEL32 ref: 00007FF8A87A5ED4
GetProcAddress.KERNEL32 ref: 00007FF8A87A5F05
GetProcAddress.KERNEL32 ref: 00007FF8A87A5F36
GetProcAddress.KERNEL32 ref: 00007FF8A87A5F67
GetProcAddress.KERNEL32 ref: 00007FF8A87A5F98
GetProcAddress.KERNEL32 ref: 00007FF8A87A5FC9
GetProcAddress.KERNEL32 ref: 00007FF8A87A5FF7

Part of subcall function 00007FF8A87A1A50: VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1A9C
Part of subcall function 00007FF8A87A1A50: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A1AC7

GetProcAddress.KERNEL32 ref: 00007FF8A87A6021
GetProcAddress.KERNEL32 ref: 00007FF8A87A604B
GetProcAddress.KERNEL32 ref: 00007FF8A87A6075

Strings

CertGetIssuerCertificateFromStore, xrefs: 00007FF8A87A5EFB
wintrust.dll, xrefs: 00007FF8A87A5E0A
WTHelperGetProvSignerFromChain, xrefs: 00007FF8A87A606E
CertGetNameStringA, xrefs: 00007FF8A87A5E37
CertFreeCertificateContext, xrefs: 00007FF8A87A5E99
CertCloseStore, xrefs: 00007FF8A87A5FBF
CryptMsgGetParam, xrefs: 00007FF8A87A5F2C
CryptDecodeObjectEx, xrefs: 00007FF8A87A5E68
CertFindCertificateInStore, xrefs: 00007FF8A87A5ECA
crypt32.dll, xrefs: 00007FF8A87A5DE2
WTHelperGetProvCertFromChain, xrefs: 00007FF8A87A6044
CryptQueryObject, xrefs: 00007FF8A87A5F5D
WTHelperProvDataFromStateData, xrefs: 00007FF8A87A601A
WinVerifyTrust, xrefs: 00007FF8A87A5FF0
CryptMsgClose, xrefs: 00007FF8A87A5F8E

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AddressProc$ConditionInfoMaskVerifyVersion
String ID: CertCloseStore$CertFindCertificateInStore$CertFreeCertificateContext$CertGetIssuerCertificateFromStore$CertGetNameStringA$CryptDecodeObjectEx$CryptMsgClose$CryptMsgGetParam$CryptQueryObject$WTHelperGetProvCertFromChain$WTHelperGetProvSignerFromChain$WTHelperProvDataFromStateData$WinVerifyTrust$crypt32.dll$wintrust.dll
API String ID: 1813986628-3512795598
Opcode ID: 25b3f02b4c43d9b760aa53d465be3eafec4f552b3dd47f5ff796ec9f328cbd36
Instruction ID: 97e71099d9638d508ce9361cb64c57258f2ffad3ec47fb74c7fe3e42f35e9b07
Opcode Fuzzy Hash: 25b3f02b4c43d9b760aa53d465be3eafec4f552b3dd47f5ff796ec9f328cbd36
Instruction Fuzzy Hash: 99818060E4BB03A9FA55CB55A89C73462A1EF44BCAF485035D85D063A4EF7CF886D328

Function 00007FF8A868D290 Relevance: 36.9, APIs: 6, Strings: 15, Instructions: 182libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF8A87AFFFC
GetProcAddress.KERNEL32 ref: 00007FF8A87B0035
GetProcAddress.KERNEL32 ref: 00007FF8A87B006F
GetProcAddress.KERNEL32 ref: 00007FF8A87B0082
GetProcAddress.KERNEL32 ref: 00007FF8A87B0095
GetProcAddress.KERNEL32 ref: 00007FF8A87B00A8

Strings

error: snippet is using newer GPU arch %X > %X, xrefs: 00007FF8A87B0129
error: snippet is using newer driver %d.%d > %d.%d, xrefs: 00007FF8A87B0199
API 0x%X Snippet 0x%X, xrefs: 00007FF8A87B00DB
NVSDK_NGX_GetApplicationId, xrefs: 00007FF8A87B002E
GPU architecture 0x%X Snippet 0x%X, xrefs: 00007FF8A87B014C
NVSDK_NGX_GetSnippetVersion, xrefs: 00007FF8A87B0078
NVSDK_NGX_GetAPIVersion, xrefs: 00007FF8A87B009E
Driver %d.%d Snippet expects at least %d.%d, xrefs: 00007FF8A87B01D9
NVSDK_NGX_GetGPUArchitecture, xrefs: 00007FF8A87B0050
error: failed to map functions in snippet %llX %llX %llX %llX %llX, xrefs: 00007FF8A87B029B
Snippet v%d.%d.%d Embedded app Id %07llX (%llu), xrefs: 00007FF8A87B0283
NGXValidateSnippet, xrefs: 00007FF8A87B0018, 00007FF8A87B00E2, 00007FF8A87B0113, 00007FF8A87B01A9, 00007FF8A87B01E4, 00007FF8A87B0277, 00007FF8A87B02A7
Validating snippet %s, xrefs: 00007FF8A87B000C
NVSDK_NGX_GetDriverVersion, xrefs: 00007FF8A87B008B
C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_common.cpp, xrefs: 00007FF8A87B001F, 00007FF8A87B00F6, 00007FF8A87B011A, 00007FF8A87B01BD, 00007FF8A87B01F8, 00007FF8A87B0262, 00007FF8A87B02B3

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AddressProc$FileModuleName
String ID: API 0x%X Snippet 0x%X$C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_common.cpp$Driver %d.%d Snippet expects at least %d.%d$GPU architecture 0x%X Snippet 0x%X$NGXValidateSnippet$NVSDK_NGX_GetAPIVersion$NVSDK_NGX_GetApplicationId$NVSDK_NGX_GetDriverVersion$NVSDK_NGX_GetGPUArchitecture$NVSDK_NGX_GetSnippetVersion$Snippet v%d.%d.%d Embedded app Id %07llX (%llu)$Validating snippet %s$error: failed to map functions in snippet %llX %llX %llX %llX %llX$error: snippet is using newer GPU arch %X > %X$error: snippet is using newer driver %d.%d > %d.%d
API String ID: 3859505661-3432153555
Opcode ID: ebab20289175742657cb254453a1aac9461496721fed0af0875b94e90ca3d93f
Instruction ID: a90d7f9375a9a6567beb661dfb9ebf9a8f5dd801fcacd6ed02d1a527792c38bc
Opcode Fuzzy Hash: ebab20289175742657cb254453a1aac9461496721fed0af0875b94e90ca3d93f
Instruction Fuzzy Hash: 79917536E0AA86A6E714CF10F8582BA73A0FB847C4F448136E94E43B54DF7CE555CB18

Function 00007FF8A8685EC0 Relevance: 31.8, APIs: 7, Strings: 11, Instructions: 305libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8A87A888E
GetProcAddress.KERNEL32 ref: 00007FF8A87A88A5
GetProcAddress.KERNEL32 ref: 00007FF8A87A88BC
GetProcAddress.KERNEL32 ref: 00007FF8A87A88D3
GetProcAddress.KERNEL32 ref: 00007FF8A87A88EA
GetProcAddress.KERNEL32 ref: 00007FF8A87A8901
GetProcAddress.KERNEL32 ref: 00007FF8A87A8918

Strings

C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_cuda_lib.cpp, xrefs: 00007FF8A87A89C4
NVSDK_NGX_CUDA_Init, xrefs: 00007FF8A87A8884
NVSDK_NGX_CUDA_GetScratchBufferSize, xrefs: 00007FF8A87A88C2
NVSDK_NGX_CUDA_ReleaseFeature, xrefs: 00007FF8A87A8907
NVSDK_NGX_CUDA_CreateFeature, xrefs: 00007FF8A87A88D9
/nvsdk_ngx.log, xrefs: 00007FF8A87A87C8
NVSDK_NGX_CUDA_EvaluateFeature, xrefs: 00007FF8A87A88F0
CUDA Error At Line : , xrefs: 00007FF8A87A89AB
: , xrefs: 00007FF8A87A89EF
NVSDK_NGX_CUDA_GetParameters, xrefs: 00007FF8A87A88AB
NVSDK_NGX_CUDA_Shutdown, xrefs: 00007FF8A87A8894

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: : $/nvsdk_ngx.log$C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_cuda_lib.cpp$CUDA Error At Line : $NVSDK_NGX_CUDA_CreateFeature$NVSDK_NGX_CUDA_EvaluateFeature$NVSDK_NGX_CUDA_GetParameters$NVSDK_NGX_CUDA_GetScratchBufferSize$NVSDK_NGX_CUDA_Init$NVSDK_NGX_CUDA_ReleaseFeature$NVSDK_NGX_CUDA_Shutdown
API String ID: 190572456-1838268342
Opcode ID: 80f8c14052652433341928b27793310e1be3c036478b4425c63c4efd2ad57d16
Instruction ID: 5d67ef318dd9fcf432f2dc8effbb6f2bd63494f5a99391748381931735961c5e
Opcode Fuzzy Hash: 80f8c14052652433341928b27793310e1be3c036478b4425c63c4efd2ad57d16
Instruction Fuzzy Hash: 6D715D24E0BA42A2FA509B15F818379A3A0FF987C1F0C5135DA4D0776AEF7CE451C768

Function 00007FF8A879F440 Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 226librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8A879F4CA
GetProcAddress.KERNEL32 ref: 00007FF8A879F4FA
GetProcAddress.KERNEL32 ref: 00007FF8A879F535
LocalAlloc.KERNEL32 ref: 00007FF8A879F57A
LocalFree.KERNEL32 ref: 00007FF8A879F5AA
LocalAlloc.KERNEL32 ref: 00007FF8A879F5DC
LocalAlloc.KERNEL32 ref: 00007FF8A879F6C6
LocalFree.KERNEL32 ref: 00007FF8A879F79E
LocalFree.KERNEL32 ref: 00007FF8A879F7B7
LocalFree.KERNEL32 ref: 00007FF8A879F7C0
LocalFree.KERNEL32 ref: 00007FF8A879F7C9

Part of subcall function 00007FF8A87A1A50: VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1A9C
Part of subcall function 00007FF8A87A1A50: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A1AC7

Strings

D3DKMTEnumAdapters2, xrefs: 00007FF8A879F4C0
\SystemRoot\system32\, xrefs: 00007FF8A879F758
D3DKMTQueryAdapterInfo, xrefs: 00007FF8A879F4F0
gdi32.dll, xrefs: 00007FF8A879F49B
NVDA, xrefs: 00007FF8A879F687
D3DKMTEnumAdapters3, xrefs: 00007FF8A879F52B

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Local$Free$AddressAllocProc$ConditionInfoMaskVerifyVersion
String ID: D3DKMTEnumAdapters2$D3DKMTEnumAdapters3$D3DKMTQueryAdapterInfo$NVDA$\SystemRoot\system32\$gdi32.dll
API String ID: 698622721-2155789793
Opcode ID: d4a589c3a0a5bf55228324b5aad85beed0ea77cbd582812984007bf09c3c7f7e
Instruction ID: 731a4a16ff3058792f12335d1d3b6224b93436faa706e9eb5b943f81ecec1be1
Opcode Fuzzy Hash: d4a589c3a0a5bf55228324b5aad85beed0ea77cbd582812984007bf09c3c7f7e
Instruction Fuzzy Hash: 6BA11721B4AF02A9EB90DF65E8482B932A5FF49BC9F484135CA4E47754EF3CE415C368

Function 00007FF8A8689510 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87A3BC1
LocalFree.KERNEL32 ref: 00007FF8A87A3CF5
LocalFree.KERNEL32 ref: 00007FF8A87A3CFE
GetLastError.KERNEL32 ref: 00007FF8A87A3D0E
SetLastError.KERNEL32 ref: 00007FF8A87A3DC0

Part of subcall function 00007FF8A87A1EF0: LocalAlloc.KERNEL32 ref: 00007FF8A87A1F83
Part of subcall function 00007FF8A87A1EF0: LocalFree.KERNEL32 ref: 00007FF8A87A1FD2

GetLastError.KERNEL32 ref: 00007FF8A87A3DB3

Part of subcall function 00007FF8A87A1790: VerSetConditionMask.KERNEL32 ref: 00007FF8A87A17C9
Part of subcall function 00007FF8A87A1790: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A17F4

GetFileAttributesW.KERNEL32 ref: 00007FF8A87A3D6B
GetLastError.KERNEL32 ref: 00007FF8A87A3D7A
SetLastError.KERNEL32 ref: 00007FF8A87A3D87
LocalFree.KERNEL32 ref: 00007FF8A87A3D90
LocalFree.KERNEL32 ref: 00007FF8A87A3D9B
LocalFree.KERNEL32 ref: 00007FF8A87A3DA4

Part of subcall function 00007FF8A86888B0: GetFileAttributesW.KERNEL32 ref: 00007FF8A87A4DAD
Part of subcall function 00007FF8A86888B0: LocalAlloc.KERNEL32 ref: 00007FF8A87A4DDC
Part of subcall function 00007FF8A86888B0: SetLastError.KERNEL32 ref: 00007FF8A87A4DFB

SetLastError.KERNEL32 ref: 00007FF8A87A3DE3

Strings

\SystemRoot\system32\, xrefs: 00007FF8A87A3C69
system32\, xrefs: 00007FF8A87A3C58

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLastLocal$Free$AllocAttributesFile$ConditionInfoMaskVerifyVersion
String ID: \SystemRoot\system32\$system32\
API String ID: 3315302763-552109975
Opcode ID: 60289b2349a9eb0fe14bb5c2bf18d3853dafc44cbd9ad55d42797f911690d958
Instruction ID: 9f021557cb1d4a647e7b95bde668702b26c77e36504c408c57d25ca033604b28
Opcode Fuzzy Hash: 60289b2349a9eb0fe14bb5c2bf18d3853dafc44cbd9ad55d42797f911690d958
Instruction Fuzzy Hash: 82516F21F4FA42A5FA545F26A41817AE3A1EF45BE1F484235DE5E067D1EF2CE501C238

Function 00007FF8A86822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87B4601
LocalFree.KERNEL32 ref: 00007FF8A87B472C
LocalFree.KERNEL32 ref: 00007FF8A87B4735
GetLastError.KERNEL32 ref: 00007FF8A87B4745
SetLastError.KERNEL32 ref: 00007FF8A87B47FC

Part of subcall function 00007FF8A87B10A0: LocalAlloc.KERNEL32 ref: 00007FF8A87B1133
Part of subcall function 00007FF8A87B10A0: LocalFree.KERNEL32 ref: 00007FF8A87B1182

GetLastError.KERNEL32 ref: 00007FF8A87B47EF

Part of subcall function 00007FF8A87ADC50: LocalFree.KERNEL32 ref: 00007FF8A87ADD19

GetFileAttributesW.KERNEL32 ref: 00007FF8A87B47A7
GetLastError.KERNEL32 ref: 00007FF8A87B47B6
SetLastError.KERNEL32 ref: 00007FF8A87B47C3
LocalFree.KERNEL32 ref: 00007FF8A87B47CC
LocalFree.KERNEL32 ref: 00007FF8A87B47D7
LocalFree.KERNEL32 ref: 00007FF8A87B47E0
SetLastError.KERNEL32 ref: 00007FF8A87B481F

Strings

\SystemRoot\system32\, xrefs: 00007FF8A87B46A9
system32\, xrefs: 00007FF8A87B4698

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Local$ErrorFreeLast$AllocAttributesFile
String ID: \SystemRoot\system32\$system32\
API String ID: 544983162-552109975
Opcode ID: 730c387bfeee172c065cf2142a85f4546424462d022ed5fe7a70941d72ad0581
Instruction ID: 8adbf215bede94e5816c6c4b54ce2c010a993edf4b6502c4ea80dd10cebff44c
Opcode Fuzzy Hash: 730c387bfeee172c065cf2142a85f4546424462d022ed5fe7a70941d72ad0581
Instruction Fuzzy Hash: EF517D20E4F61269FA54AB61A41C17963A2FF46BE5F4C4234DA5F077D1EF2CE801C238

Function 00007FF8A8685430 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 136libraryloaderCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87B4CD3
SetLastError.KERNEL32 ref: 00007FF8A87B4CE3
LoadLibraryExW.KERNEL32 ref: 00007FF8A87B4D2B
LocalFree.KERNEL32 ref: 00007FF8A87B4D37
GetProcAddress.KERNEL32 ref: 00007FF8A87B4D5C
GetProcAddress.KERNEL32 ref: 00007FF8A87B4D88

Strings

, xrefs: 00007FF8A87B4CAD
SetupDiDestroyDeviceInfoList, xrefs: 00007FF8A87B4D7E
SetupDiGetDeviceRegistryPropertyW, xrefs: 00007FF8A87B4D52
Setupapi.dll, xrefs: 00007FF8A87B4D0C
SYSTEM\CurrentControlSet\Control\Class\, xrefs: 00007FF8A87B4E4B

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AddressErrorLastProc$FreeLibraryLoadLocal
String ID: $SYSTEM\CurrentControlSet\Control\Class\$SetupDiDestroyDeviceInfoList$SetupDiGetDeviceRegistryPropertyW$Setupapi.dll
API String ID: 3750011226-2686055259
Opcode ID: 1dd6ce100cb580621a57aaa50faa47175d63362c2ce38f709ce9a83d8e805fc4
Instruction ID: 34f76eb22f56c6b85547c37f11e9cd9736ac8e7b0bee2f9afad00c851772b58d
Opcode Fuzzy Hash: 1dd6ce100cb580621a57aaa50faa47175d63362c2ce38f709ce9a83d8e805fc4
Instruction Fuzzy Hash: DF514135A0EB92AAEA509F11B85837963E5FF88BC1F484035DA4E47754EF3CE845C728

Function 00007FF8A8682D00 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 113COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF8A87B83C1

Strings

SOFTWARE\NVIDIA Corporation\Global\NGXCore, xrefs: 00007FF8A87B84BB
Loaded NGXCore from path (%S), xrefs: 00007FF8A87B8418, 00007FF8A87B852E
NGXLoadSigned, xrefs: 00007FF8A87B8450, 00007FF8A87B846F, 00007FF8A87B84D6, 00007FF8A87B8568
C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_lib.cpp, xrefs: 00007FF8A87B842B, 00007FF8A87B8457, 00007FF8A87B8476, 00007FF8A87B84E2, 00007FF8A87B8541, 00007FF8A87B856F
System\CurrentControlSet\Services\nvlddmkm\NGXCore, xrefs: 00007FF8A87B849F
error: failed to locate NGX core path via registry key - error %l, xrefs: 00007FF8A87B84CB
warning: unable to find filename for the application, xrefs: 00007FF8A87B8444
NGXPath, xrefs: 00007FF8A87B8498
error: failed to load %S, xrefs: 00007FF8A87B855C
NGXLoadSignedFromPath, xrefs: 00007FF8A87B8424, 00007FF8A87B853A
FullPath, xrefs: 00007FF8A87B84B4
NGXCore not found next to the application, xrefs: 00007FF8A87B8463
\nvngx.dll, xrefs: 00007FF8A87B83E0, 00007FF8A87B84F6

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: FileModuleName
String ID: C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_lib.cpp$FullPath$Loaded NGXCore from path (%S)$NGXCore not found next to the application$NGXLoadSigned$NGXLoadSignedFromPath$NGXPath$SOFTWARE\NVIDIA Corporation\Global\NGXCore$System\CurrentControlSet\Services\nvlddmkm\NGXCore$\nvngx.dll$error: failed to load %S$error: failed to locate NGX core path via registry key - error %l$warning: unable to find filename for the application
API String ID: 514040917-3979418977
Opcode ID: f4d2a229c56032707af2cf9942862fa793be9a46e9b9c06362997328e222db2a
Instruction ID: db11bd647e86ca56004fefaebae41f7366baf71dcc3d7ac4800d141ef3b71ab5
Opcode Fuzzy Hash: f4d2a229c56032707af2cf9942862fa793be9a46e9b9c06362997328e222db2a
Instruction Fuzzy Hash: EF514F31E1AA47B5FA51DB10E8582FA6361FF843C1F885132E54E436A5EF3CE509C768

Function 00007FF8A86892D0 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 245COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 00007FF8A878E43E
CoUninitialize.OLE32 ref: 00007FF8A878E7A2

Strings

%s: Transcode initialized for video media type with %x object, xrefs: 00007FF8A878E64E
%s: Cannot allocate transcode object, xrefs: 00007FF8A878E634
%s: Total Frames generated - %d for %x video transcode object, xrefs: 00007FF8A878E758
%s: MFStartup : MF initialization failed with %x error, xrefs: 00007FF8A878E474
%s: Invalid input file or NULL encoder params, xrefs: 00007FF8A878E7B4
InitializeApp, xrefs: 00007FF8A878E47E
%s: Total Frames generated - %x for %x Image transcode object, xrefs: 00007FF8A878E5B4
%s: CoInitializeEx failed with %x error, xrefs: 00007FF8A878E459
Transcode, xrefs: 00007FF8A878E4E0, 00007FF8A878E5AD, 00007FF8A878E623, 00007FF8A878E751, 00007FF8A878E7AD
%s: Transcode initialized for Image media type with %x object, xrefs: 00007FF8A878E4F8
0, xrefs: 00007FF8A878E67A

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: InitializeUninitialize
String ID: %s: Invalid input file or NULL encoder params$%s: Total Frames generated - %x for %x Image transcode object$%s: Cannot allocate transcode object$%s: CoInitializeEx failed with %x error$%s: MFStartup : MF initialization failed with %x error$%s: Total Frames generated - %d for %x video transcode object$%s: Transcode initialized for Image media type with %x object$%s: Transcode initialized for video media type with %x object$0$InitializeApp$Transcode
API String ID: 3442037557-3066126349
Opcode ID: 81151dc22e6085f7dcf4099bdfb8c54fe29bf8f3d460ed9fe7c7e9b300c8df07
Instruction ID: ccfa49bf47ce642305f75022604877cdeaaabcd8bf2a6eb860a88e1193c3b8d9
Opcode Fuzzy Hash: 81151dc22e6085f7dcf4099bdfb8c54fe29bf8f3d460ed9fe7c7e9b300c8df07
Instruction Fuzzy Hash: B8B16D72A0AB4296E750DF55E44466AB7E5FB88BC0F504136EB8D83BA4EF3CE441CB14

Function 00007FF8A879EF70 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 215libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8A879EFD0
GetProcAddress.KERNEL32 ref: 00007FF8A879F000
GetProcAddress.KERNEL32 ref: 00007FF8A879F030
GetProcAddress.KERNEL32 ref: 00007FF8A879F060
GetProcAddress.KERNEL32 ref: 00007FF8A879F090
LocalAlloc.KERNEL32 ref: 00007FF8A879F182

Part of subcall function 00007FF8A87A1A50: VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1A9C
Part of subcall function 00007FF8A87A1A50: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A1AC7

LocalFree.KERNEL32 ref: 00007FF8A879F272

Strings

SetupDiDestroyDeviceInfoList, xrefs: 00007FF8A879F086
SetupDiGetDeviceRegistryPropertyW, xrefs: 00007FF8A879F026
SetupDiGetClassDevsW, xrefs: 00007FF8A879EFC6
SetupDiGetDeviceInterfaceDetailW, xrefs: 00007FF8A879F056
SetupDiEnumDeviceInfo, xrefs: 00007FF8A879EFF6
Setupapi.dll, xrefs: 00007FF8A879EFA1

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AddressProc$Local$AllocConditionFreeInfoMaskVerifyVersion
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInfo$SetupDiGetClassDevsW$SetupDiGetDeviceInterfaceDetailW$SetupDiGetDeviceRegistryPropertyW$Setupapi.dll
API String ID: 576420853-2811369298
Opcode ID: e36274d5b006de419470d65754a9c31c6c642be75edc98a9d974be8a120309cb
Instruction ID: ac63c68af7b994a580aaa5931e212f4b13b8b1b45a3e9c695b76ed9991d64d7a
Opcode Fuzzy Hash: e36274d5b006de419470d65754a9c31c6c642be75edc98a9d974be8a120309cb
Instruction Fuzzy Hash: 6EA13731A4BB42A6EBA08B15F84837973E4FB45BD5F488135D96D437A0EF3CE4858328

Function 00007FF8A87ADA00 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF8A87ADA5A
VerSetConditionMask.KERNEL32 ref: 00007FF8A87ADA6A
VerSetConditionMask.KERNEL32 ref: 00007FF8A87ADA7A
VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87ADAB4
GetFullPathNameW.KERNEL32 ref: 00007FF8A87ADAF7
LocalAlloc.KERNEL32 ref: 00007FF8A87ADB11
GetFullPathNameW.KERNEL32 ref: 00007FF8A87ADB2A

Part of subcall function 00007FF8A87AB0D0: LoadLibraryExW.KERNEL32 ref: 00007FF8A87AB144
Part of subcall function 00007FF8A87AB0D0: LocalFree.KERNEL32 ref: 00007FF8A87AB150
Part of subcall function 00007FF8A87AB0D0: GetProcAddress.KERNEL32 ref: 00007FF8A87AB174

LocalFree.KERNEL32 ref: 00007FF8A87ADB85
LocalFree.KERNEL32 ref: 00007FF8A87ADB9F
LocalFree.KERNEL32 ref: 00007FF8A87ADBA8

Strings

*, xrefs: 00007FF8A87ADA44
&, xrefs: 00007FF8A87ADA30
$, xrefs: 00007FF8A87ADA25

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Local$Free$ConditionMask$FullNamePath$AddressAllocInfoLibraryLoadProcVerifyVersion
String ID: $$&$*
API String ID: 828358482-3416282258
Opcode ID: 5729eadd254e398a79da1de9597fab71f461e464946d20159106587438328c11
Instruction ID: ee664165a6589e9431afd44cfa0227b2c804c8526cdd554bc624fe62e86405e4
Opcode Fuzzy Hash: 5729eadd254e398a79da1de9597fab71f461e464946d20159106587438328c11
Instruction Fuzzy Hash: AB419F31E0B742A6E750CB11A818675ABE2FF88BD5F084138DA4D477A4EF3CE445C768

Function 00007FF8A8693920 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 109filelibraryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87A5929
GetFileAttributesW.KERNEL32 ref: 00007FF8A87A5979
CreateFileW.KERNEL32 ref: 00007FF8A87A59B5
SetLastError.KERNEL32 ref: 00007FF8A87A59C7
SetLastError.KERNEL32 ref: 00007FF8A87A5A0F
LoadLibraryExW.KERNEL32 ref: 00007FF8A87A5A25
GetLastError.KERNEL32 ref: 00007FF8A87A5A33
CloseHandle.KERNEL32 ref: 00007FF8A87A5A3E
SetLastError.KERNEL32 ref: 00007FF8A87A5A46
SetLastError.KERNEL32 ref: 00007FF8A87A5A61
SetLastError.KERNEL32 ref: 00007FF8A87A5A7D

Strings

:, xrefs: 00007FF8A87A5957

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast$File$AttributesCloseCreateHandleLibraryLoad
String ID: :
API String ID: 3653152856-336475711
Opcode ID: bbbf8b0cfe091933c39af1670c220df65eed86bdcb4e0475fc3e254f7dabdbc7
Instruction ID: 2f6f4e06d3ad386b338b9d4915b9458ccd68f2e6967fed58fdc7eb7d81500b16
Opcode Fuzzy Hash: bbbf8b0cfe091933c39af1670c220df65eed86bdcb4e0475fc3e254f7dabdbc7
Instruction Fuzzy Hash: E5414961F4A74266FB504FA6A44813CA6D1EF44BE1F488131DE4E127E4EF3CE842CA28

Function 00007FF8A8685080 Relevance: 19.6, APIs: 13, Instructions: 107COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF8A87A6195
FreeLibrary.KERNEL32 ref: 00007FF8A87A61D1
FreeLibrary.KERNEL32 ref: 00007FF8A87A6230
FreeLibrary.KERNEL32 ref: 00007FF8A87A6250
FreeLibrary.KERNEL32 ref: 00007FF8A87A62A8
FreeLibrary.KERNEL32 ref: 00007FF8A87A62C8
FreeLibrary.KERNEL32 ref: 00007FF8A87A62EF
FreeLibrary.KERNEL32 ref: 00007FF8A87A6308
FreeLibrary.KERNEL32 ref: 00007FF8A87A6321
FreeLibrary.KERNEL32 ref: 00007FF8A87A633A
FreeLibrary.KERNEL32 ref: 00007FF8A87A6353
FreeLibrary.KERNEL32 ref: 00007FF8A87A636C
FreeLibrary.KERNEL32 ref: 00007FF8A87A6385

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 9f186a2e040995e6f0b0e64b1a87cd653ec6994900668234fa6fa4513ef19a1e
Instruction ID: 46f309707ac106b529d5d23b5c4b1a3c1b946e09c8ecf1b46be3df65b9fe90b3
Opcode Fuzzy Hash: 9f186a2e040995e6f0b0e64b1a87cd653ec6994900668234fa6fa4513ef19a1e
Instruction Fuzzy Hash: EC611234D5BB02A5FA548F51BC9D63432A4FF48BDAF5C4139D48E872609F3CA0629339

Function 00007FF8A868D5B0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF8A8822D36
GetModuleHandleW.KERNEL32 ref: 00007FF8A8822D4F
GetProcAddress.KERNEL32 ref: 00007FF8A8822D5F
GetModuleHandleW.KERNEL32 ref: 00007FF8A8822D84
GetProcAddress.KERNEL32 ref: 00007FF8A8822D94
GetLastError.KERNEL32 ref: 00007FF8A8822DC5
GetLastError.KERNEL32 ref: 00007FF8A8822DF5
GetLastError.KERNEL32 ref: 00007FF8A8822E25

Strings

combase.dll, xrefs: 00007FF8A8822D29, 00007FF8A8822D48, 00007FF8A8822D76
RoUninitialize, xrefs: 00007FF8A8822D8D
RoInitialize, xrefs: 00007FF8A8822D58

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast$AddressHandleModuleProc$LibraryLoad
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 4089895538-3997890769
Opcode ID: 25bd4a92d865eb986d4886ce9e2fc91b6f185cd407b783bdb8d090bd23f88a26
Instruction ID: 3bf9fe74f59b4a01945ab4940d0111ac75c50f1234b20c501345235316177241
Opcode Fuzzy Hash: 25bd4a92d865eb986d4886ce9e2fc91b6f185cd407b783bdb8d090bd23f88a26
Instruction Fuzzy Hash: 5E313024F0AA07A6FB41DB65E85C3B562A1FF847C2F888136D54E422A5FF2CE504C368

Function 00007FF8A87A1790 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 133libraryloaderCOMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF8A87A17C9
VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A17F4
GetProcAddress.KERNEL32 ref: 00007FF8A87A185B
GetProcAddress.KERNEL32 ref: 00007FF8A87A188A
GetLastError.KERNEL32 ref: 00007FF8A87A189C
LocalFree.KERNEL32 ref: 00007FF8A87A1984

Strings

RegCloseKey, xrefs: 00007FF8A87A1880
Advapi32.dll, xrefs: 00007FF8A87A182D
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF8A87A18BD
CurrentBuildNumber, xrefs: 00007FF8A87A18EC
RegOpenKeyExW, xrefs: 00007FF8A87A1851

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AddressProc$ConditionErrorFreeInfoLastLocalMaskVerifyVersion
String ID: Advapi32.dll$CurrentBuildNumber$RegCloseKey$RegOpenKeyExW$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 1705557312-2525593150
Opcode ID: d838daccb81d71d35b80107858d774af3e5616e532a7525f8534e3fbf145c2ea
Instruction ID: 582483bf9234f91630c15dd89b4375b725ffab5bf56ae996207246781de71377
Opcode Fuzzy Hash: d838daccb81d71d35b80107858d774af3e5616e532a7525f8534e3fbf145c2ea
Instruction Fuzzy Hash: 31518331E0A742A5FA50CB15E8482B5B3A5FF54BD5F444135E98E87794EF3CE405C728

Function 00007FF8A8687F70 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 115libraryloadermemoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87A4B28
GetProcAddress.KERNEL32 ref: 00007FF8A87A4B6B
GetProcAddress.KERNEL32 ref: 00007FF8A87A4B9B
LocalAlloc.KERNEL32 ref: 00007FF8A87A4C19
LocalFree.KERNEL32 ref: 00007FF8A87A4C6E
SetLastError.KERNEL32 ref: 00007FF8A87A4C90

Part of subcall function 00007FF8A87A1A50: VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1A9C
Part of subcall function 00007FF8A87A1A50: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A1AC7

Strings

SetupDiDestroyDeviceInfoList, xrefs: 00007FF8A87A4B91
, xrefs: 00007FF8A87A4B1C
SetupDiGetDeviceRegistryPropertyW, xrefs: 00007FF8A87A4B61
Setupapi.dll, xrefs: 00007FF8A87A4B3C
SYSTEM\CurrentControlSet\Control\Class\, xrefs: 00007FF8A87A4C5C

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AddressErrorLastLocalProc$AllocConditionFreeInfoMaskVerifyVersion
String ID: $SYSTEM\CurrentControlSet\Control\Class\$SetupDiDestroyDeviceInfoList$SetupDiGetDeviceRegistryPropertyW$Setupapi.dll
API String ID: 2783935822-2686055259
Opcode ID: 2c65741bb2e4e7683c67e8ef166769608d7f6bf1b8df71c7b07c1739b7130ba0
Instruction ID: bc662def100f5929e422974ca8ecc25874933e13529c3dd40575b35cc828a1bc
Opcode Fuzzy Hash: 2c65741bb2e4e7683c67e8ef166769608d7f6bf1b8df71c7b07c1739b7130ba0
Instruction Fuzzy Hash: F0515C31B0BB52A6EB508F15A848279B3E4FB48BC5F484139EA4E47755EF3DE801C728

Function 00007FF8A8685240 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 108libraryloadermemoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87A48B5
GetProcAddress.KERNEL32 ref: 00007FF8A87A48F8
GetProcAddress.KERNEL32 ref: 00007FF8A87A4928
LocalAlloc.KERNEL32 ref: 00007FF8A87A49A6
LocalFree.KERNEL32 ref: 00007FF8A87A49FB
SetLastError.KERNEL32 ref: 00007FF8A87A4A25

Part of subcall function 00007FF8A87A1A50: VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1A9C
Part of subcall function 00007FF8A87A1A50: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A1AC7

Strings

SetupDiDestroyDeviceInfoList, xrefs: 00007FF8A87A491E
SetupDiGetDeviceRegistryPropertyW, xrefs: 00007FF8A87A48EE
Setupapi.dll, xrefs: 00007FF8A87A48C9
, xrefs: 00007FF8A87A4897
SYSTEM\CurrentControlSet\Control\Class\, xrefs: 00007FF8A87A49E9

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AddressErrorLastLocalProc$AllocConditionFreeInfoMaskVerifyVersion
String ID: $SYSTEM\CurrentControlSet\Control\Class\$SetupDiDestroyDeviceInfoList$SetupDiGetDeviceRegistryPropertyW$Setupapi.dll
API String ID: 2783935822-2686055259
Opcode ID: 6c6a4e8a0bcc7c5af865d58409ceb37ef023d90e6961c4f2e9d2de8a1adc6423
Instruction ID: e9fd0bf1f9d1c9944b5d64fb9ae893a8725443a20dde62fed0ec53a79e203cf8
Opcode Fuzzy Hash: 6c6a4e8a0bcc7c5af865d58409ceb37ef023d90e6961c4f2e9d2de8a1adc6423
Instruction Fuzzy Hash: 64512E32A0AB42A6EA509F15B848279A3E0FB897C5F484135EA8D57754EF3CE405D728

Function 00007FF8A8688830 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87B62AF
SetLastError.KERNEL32 ref: 00007FF8A87B62BF
LocalFree.KERNEL32 ref: 00007FF8A87B6303
LocalFree.KERNEL32 ref: 00007FF8A87B630C

Strings

ShellExecuteExA, xrefs: 00007FF8A87B637E
Shell32.dll, xrefs: 00007FF8A87B6334

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorFreeLastLocal
String ID: Shell32.dll$ShellExecuteExA
API String ID: 3928016487-2609298245
Opcode ID: 6847e5a35347b6cc4f56585a02c2dcd8631616a208d8b4f60e6902eac1570615
Instruction ID: 5258726a1916a44b0f11029691950bd904d5e2b4991e5c06735a640573f4e2de
Opcode Fuzzy Hash: 6847e5a35347b6cc4f56585a02c2dcd8631616a208d8b4f60e6902eac1570615
Instruction Fuzzy Hash: DC316E20F4BA02A9FE55AB52A95C6796392EF49FD1F0C4438CA4F47755EF2CE4418328

Function 00007FF8A8685A80 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 80registrymemorythreadCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF8A87B8C90
RegQueryValueExW.ADVAPI32 ref: 00007FF8A87B8CCA
RegCloseKey.ADVAPI32 ref: 00007FF8A87B8CE6
GetConsoleWindow.KERNEL32 ref: 00007FF8A87B8D16
GetWindowThreadProcessId.USER32 ref: 00007FF8A87B8D28
GetCurrentProcessId.KERNEL32 ref: 00007FF8A87B8D2E
AllocConsole.KERNEL32 ref: 00007FF8A87B8D3A
SetConsoleTitleA.KERNEL32 ref: 00007FF8A87B8D4D

Strings

NGX, xrefs: 00007FF8A87B8D40
SOFTWARE\NVIDIA Corporation\Global\NGXCore, xrefs: 00007FF8A87B8C82
LogLevel, xrefs: 00007FF8A87B8CA9

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Console$ProcessWindow$AllocCloseCurrentOpenQueryThreadTitleValue
String ID: LogLevel$NGX$SOFTWARE\NVIDIA Corporation\Global\NGXCore
API String ID: 813702208-1451484610
Opcode ID: 50fab19680d1afe733d3e66660d2e70778c793c35c9ee94b78459fe8881ff264
Instruction ID: ebea77d0ff311fbc8b71241cdf32663fd5b48ec718fba18ff7f5d6a72ad2a6e0
Opcode Fuzzy Hash: 50fab19680d1afe733d3e66660d2e70778c793c35c9ee94b78459fe8881ff264
Instruction Fuzzy Hash: A5415D31E0AA42AAEB448B15F48C239B7A1FF847D5F484136D94E43B68DF7CE455C728

Function 00000001800368B0 Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,000000018002F067), ref: 00000001800368C1
free.LIBCMT ref: 00000001800368DE

Part of subcall function 000000018002D5F4: HeapFree.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D60A
Part of subcall function 000000018002D5F4: _errno.LIBCMT ref: 000000018002D614
Part of subcall function 000000018002D5F4: GetLastError.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D61C

free.LIBCMT ref: 00000001800368F3
free.LIBCMT ref: 0000000180036914
free.LIBCMT ref: 0000000180036929
free.LIBCMT ref: 000000018003693D
free.LIBCMT ref: 0000000180036949
free.LIBCMT ref: 0000000180036974
EncodePointer.KERNEL32(?,?,?,000000018002F067), ref: 000000018003697C
free.LIBCMT ref: 0000000180036995
free.LIBCMT ref: 00000001800369AE
free.LIBCMT ref: 00000001800369DF

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID:
API String ID: 4099253644-0
Opcode ID: c236f47fa00f1eb095f464021b61fc5b1928e1c18c896dc44bc4746b0c097f4e
Instruction ID: e2653a9f16c68cd9db8ac6c19f3406fb9b710f8bb8de90df47967776b1696018
Opcode Fuzzy Hash: c236f47fa00f1eb095f464021b61fc5b1928e1c18c896dc44bc4746b0c097f4e
Instruction Fuzzy Hash: 6B314E31601A4C89FED7DB11E9613E563A0BB4D7D4F19C226BA190AAE5DFBCC68D8301

Function 00007FF8A87B0EB0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 108librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF8A87B0F13
LocalFree.KERNEL32 ref: 00007FF8A87B0F1F
GetProcAddress.KERNEL32 ref: 00007FF8A87B0F4B
LocalAlloc.KERNEL32 ref: 00007FF8A87B0FC3
GetLastError.KERNEL32 ref: 00007FF8A87B0FD4

Part of subcall function 00007FF8A87AB2C0: GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87AB2E8
Part of subcall function 00007FF8A87AB2C0: LocalAlloc.KERNEL32 ref: 00007FF8A87AB30B
Part of subcall function 00007FF8A87AB2C0: GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87AB31E

LocalFree.KERNEL32 ref: 00007FF8A87B1012

Strings

Advapi32.dll, xrefs: 00007FF8A87B0EF4
RegQueryValueExW, xrefs: 00007FF8A87B0F41
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF8A87B0EC4

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Local$AllocDirectoryFreeSystem$AddressErrorLastLibraryLoadProc
String ID: Advapi32.dll$RegQueryValueExW$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3758263020-1610639660
Opcode ID: cbde8d636b6884e0b5bdf4ee94e9aa60a5168ff0c590a648ea3f7d8721b2ee0d
Instruction ID: 44538165e980bfee5cb50d9cd9bd65d09f1e81ee695505789604d10e4e68beaf
Opcode Fuzzy Hash: cbde8d636b6884e0b5bdf4ee94e9aa60a5168ff0c590a648ea3f7d8721b2ee0d
Instruction Fuzzy Hash: 51415425F1BB46A9EA509F12B94863AA3A5FF44BD5F484034ED8E43754EF3CE405C728

Function 00007FF8A8695A60 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87A65CF
SetLastError.KERNEL32 ref: 00007FF8A87A65DF
LocalFree.KERNEL32 ref: 00007FF8A87A6623
LocalFree.KERNEL32 ref: 00007FF8A87A662C

Strings

ShellExecuteExA, xrefs: 00007FF8A87A667E
Shell32.dll, xrefs: 00007FF8A87A6653

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorFreeLastLocal
String ID: Shell32.dll$ShellExecuteExA
API String ID: 3928016487-2609298245
Opcode ID: 2e57f5782fe3bf08634fd71a5693bd78e2723d414804ef75c094206830ef4e48
Instruction ID: f7d9cd8a163f05101d4bc3c11ad67a875b1bc6d0f82b9291c2387b397c1fdb9d
Opcode Fuzzy Hash: 2e57f5782fe3bf08634fd71a5693bd78e2723d414804ef75c094206830ef4e48
Instruction Fuzzy Hash: 11216D31F4FA02A6FE54DB62A858639A2A1EF49BD5F488434D94F47755EF2CE401C338

Function 00007FF8A87B1990 Relevance: 15.1, APIs: 12, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87B19B1
LocalAlloc.KERNEL32 ref: 00007FF8A87B19EB
LocalFree.KERNEL32 ref: 00007FF8A87B1A31
SetLastError.KERNEL32 ref: 00007FF8A87B1A3C
LocalFree.KERNEL32 ref: 00007FF8A87B1A58
SetLastError.KERNEL32 ref: 00007FF8A87B1A63
LocalFree.KERNEL32 ref: 00007FF8A87B1A7F
SetLastError.KERNEL32 ref: 00007FF8A87B1AB8
GetLastError.KERNEL32 ref: 00007FF8A87B1ABE
GetLastError.KERNEL32 ref: 00007FF8A87B1AD4
LocalFree.KERNEL32 ref: 00007FF8A87B1AE6
SetLastError.KERNEL32 ref: 00007FF8A87B1AF2

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast$Local$Free$Alloc
String ID:
API String ID: 916652521-0
Opcode ID: 7233dbdddb0dc7e43d53d00e7812c2ac2f0c79c21a3cd17f9c0fc5ae811c0866
Instruction ID: 0d6b7043ffabbb34e7f3052f9be3f5a4cc6d50c1560e80be00e6658dec26c8ba
Opcode Fuzzy Hash: 7233dbdddb0dc7e43d53d00e7812c2ac2f0c79c21a3cd17f9c0fc5ae811c0866
Instruction Fuzzy Hash: 8241A121F4E6036AFA545F56A54C27A62A2EF49BE1F088034CD4F47791EF7CF8019238

Function 00007FF8A86936C0 Relevance: 15.1, APIs: 10, Instructions: 105filelibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A879E1F0: LocalAlloc.KERNEL32 ref: 00007FF8A879E228

SetLastError.KERNEL32 ref: 00007FF8A87A576B
GetFileAttributesW.KERNEL32 ref: 00007FF8A87A57BB
CreateFileW.KERNEL32 ref: 00007FF8A87A57F2
SetLastError.KERNEL32 ref: 00007FF8A87A5832
LoadLibraryExW.KERNEL32 ref: 00007FF8A87A5849
GetLastError.KERNEL32 ref: 00007FF8A87A5857
CloseHandle.KERNEL32 ref: 00007FF8A87A5862
SetLastError.KERNEL32 ref: 00007FF8A87A586A
SetLastError.KERNEL32 ref: 00007FF8A87A5885
LocalFree.KERNEL32 ref: 00007FF8A87A5893

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast$FileLocal$AllocAttributesCloseCreateFreeHandleLibraryLoad
String ID:
API String ID: 655590559-0
Opcode ID: 7468935337419462e1a44ad935823fa4f650fd4723db35e1c35ea56460038761
Instruction ID: 069696253bc69f46bbc57c580bb6fec4e2a9c4c9e214456e95d4637a8038dda6
Opcode Fuzzy Hash: 7468935337419462e1a44ad935823fa4f650fd4723db35e1c35ea56460038761
Instruction Fuzzy Hash: EA4117A1E4F742EAFB685B91A548239A2D1EF44BE1F484234DD6E037D4DF3CE442C668

Function 00007FF8A8684E80 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 244COMMON

Download Yara Rule

Strings

CNvVideoTranscodeEx::AllocateUncompressedBuffersandEncoder, xrefs: 00007FF8A8776E48, 00007FF8A8776EEF, 00007FF8A8777117
%s: Invalid pTrContext pointer passed, xrefs: 00007FF8A8776E4F
%s: Invalid size, possible wrong format , xrefs: 00007FF8A8776EFB
%s: Not able to create system memory buffer. Error - %x, xrefs: 00007FF8A877710D
%s: CreateEncoder failed with error - %x, xrefs: 00007FF8A8777104
`anonymous-namespace'::GetDestBufferSizePerFormat, xrefs: 00007FF8A8776E8C, 00007FF8A8776FE2
%s: Invalid - %d buffer format passed, xrefs: 00007FF8A8776E98, 00007FF8A8776FEE

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID:
String ID: %s: CreateEncoder failed with error - %x$%s: Invalid - %d buffer format passed$%s: Invalid pTrContext pointer passed$%s: Invalid size, possible wrong format $%s: Not able to create system memory buffer. Error - %x$CNvVideoTranscodeEx::AllocateUncompressedBuffersandEncoder$`anonymous-namespace'::GetDestBufferSizePerFormat
API String ID: 0-2103758211
Opcode ID: c1d11ccd792c239f3aef7748e9f0e087da3cd850e3c7ca25cdce25fa5a2da61b
Instruction ID: 1ca386e34965a5452ee1e731b2e0e35246725494cadee3b8c96c7cfb6468b4d5
Opcode Fuzzy Hash: c1d11ccd792c239f3aef7748e9f0e087da3cd850e3c7ca25cdce25fa5a2da61b
Instruction Fuzzy Hash: 85B19E72A4BA42A2EB10DF24E8553B97360FB84BC8F445131DE5D4B29AEF3DE505C728

Function 00007FF8A8695A10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF8A889F451
try_get_function.LIBVCRUNTIME ref: 00007FF8A889F4D2

Strings

MessageBoxA, xrefs: 00007FF8A889F4C6
LocateXStateFeature, xrefs: 00007FF8A889F445
MessageBoxW, xrefs: 00007FF8A889F556
RoInitialize, xrefs: 00007FF8A889F5D3

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: try_get_function
String ID: LocateXStateFeature$MessageBoxA$MessageBoxW$RoInitialize
API String ID: 2742660187-29969376
Opcode ID: 0c7dc754282232751ae50603538382f2149499098d56100760ace1ac31c63134
Instruction ID: 4f840a030d65761005b891fdf93ac170ccaae7a70e8455dbb98e9164436556a4
Opcode Fuzzy Hash: 0c7dc754282232751ae50603538382f2149499098d56100760ace1ac31c63134
Instruction Fuzzy Hash: 6341AE61B0AA92A1EB149B42F8040E5B360EF49BC0F5C4432EF5C03B9ADF7CE545CB68

Function 00007FF8A8681990 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89libraryloaderCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87A37CA
LocalFree.KERNEL32 ref: 00007FF8A87A380A
LocalFree.KERNEL32 ref: 00007FF8A87A3813

Part of subcall function 00007FF8A879E1F0: LocalAlloc.KERNEL32 ref: 00007FF8A879E228

LocalFree.KERNEL32 ref: 00007FF8A87A3820
LocalFree.KERNEL32 ref: 00007FF8A87A3829
GetProcAddress.KERNEL32 ref: 00007FF8A87A386B

Part of subcall function 00007FF8A87A1A50: VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1A9C
Part of subcall function 00007FF8A87A1A50: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A1AC7

Strings

Advapi32.dll, xrefs: 00007FF8A87A383D
CreateProcessAsUserA, xrefs: 00007FF8A87A3861

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Local$Free$AddressAllocConditionErrorInfoLastMaskProcVerifyVersion
String ID: Advapi32.dll$CreateProcessAsUserA
API String ID: 3397555361-3368371401
Opcode ID: 7493b9120896b692fd6b8bb541b1dc1633219b3aa57d3fe30c3548db32e78fe2
Instruction ID: e63391981886a9501e5a4740f9e30a24f504f1916074d66ac95183fd1ce3bae3
Opcode Fuzzy Hash: 7493b9120896b692fd6b8bb541b1dc1633219b3aa57d3fe30c3548db32e78fe2
Instruction Fuzzy Hash: 6E314F35B0AB86AAEA649F16A88467AB3A1FF48BD0F084035DD8D43754EF3CE441C724

Function 00007FF8A87B0D00 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF8A87B0D55
LocalFree.KERNEL32 ref: 00007FF8A87B0D61
GetProcAddress.KERNEL32 ref: 00007FF8A87B0D89
GetProcAddress.KERNEL32 ref: 00007FF8A87B0DB9
GetLastError.KERNEL32 ref: 00007FF8A87B0DCB

Part of subcall function 00007FF8A87AB2C0: GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87AB2E8
Part of subcall function 00007FF8A87AB2C0: LocalAlloc.KERNEL32 ref: 00007FF8A87AB30B
Part of subcall function 00007FF8A87AB2C0: GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87AB31E

Strings

RegCloseKey, xrefs: 00007FF8A87B0DAF
Advapi32.dll, xrefs: 00007FF8A87B0D39
RegOpenKeyExW, xrefs: 00007FF8A87B0D7F

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: AddressDirectoryLocalProcSystem$AllocErrorFreeLastLibraryLoad
String ID: Advapi32.dll$RegCloseKey$RegOpenKeyExW
API String ID: 2875399084-618571997
Opcode ID: 28f397e54f1e24d26005662e88986d0bf696a147c640b84549ea0515995ecd5d
Instruction ID: d0caef039a7b6810dc0e4d23054f9322c4f12f60c3c5aa76f23fcc9379cc346c
Opcode Fuzzy Hash: 28f397e54f1e24d26005662e88986d0bf696a147c640b84549ea0515995ecd5d
Instruction Fuzzy Hash: 47314D21E1AB42A9EA509B16BD5C77567A1FF84BD1F4C8031DD4E03B68EF7CE4428328

Function 00007FF8A87A2840 Relevance: 13.8, APIs: 11, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87A2861
LocalAlloc.KERNEL32 ref: 00007FF8A87A289B
LocalFree.KERNEL32 ref: 00007FF8A87A28E1
SetLastError.KERNEL32 ref: 00007FF8A87A28EC
LocalFree.KERNEL32 ref: 00007FF8A87A2908
SetLastError.KERNEL32 ref: 00007FF8A87A2913
LocalFree.KERNEL32 ref: 00007FF8A87A292C
SetLastError.KERNEL32 ref: 00007FF8A87A2965
GetLastError.KERNEL32 ref: 00007FF8A87A296D
LocalFree.KERNEL32 ref: 00007FF8A87A2978
SetLastError.KERNEL32 ref: 00007FF8A87A2984

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast$Local$Free$Alloc
String ID:
API String ID: 916652521-0
Opcode ID: f94a255190e780f5afcc3f384cf0fa8bf01a32dacb228848ed0e42394d41a5f4
Instruction ID: 37ded76df3b7ded553f6090ee024515f7a432b22f8976e6dc913a82ce5e90da7
Opcode Fuzzy Hash: f94a255190e780f5afcc3f384cf0fa8bf01a32dacb228848ed0e42394d41a5f4
Instruction Fuzzy Hash: D041A021F5E703A6FA545F566408239A2A1EF59FE1F088134DE4E237D5EF3CE841C228

Function 00007FF8A86935F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 179COMMON

Download Yara Rule

Strings

CNvMFAACEncoder::InitializeMFTandMediaTypes, xrefs: 00007FF8A8755CC1, 00007FF8A8755DB5
%s No audio initialization data passed, returning error, xrefs: 00007FF8A8755CC8
%s- invalid sample rate (hz) '%d, xrefs: 00007FF8A8755D7E
%s - invalid bits-per-sample (bits) '%d', xrefs: 00007FF8A8755DAE
%s invalid bitrate (kbps) '%d', xrefs: 00007FF8A8755D26
%s- invalid channel count '%d, xrefs: 00007FF8A8755D52

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID:
String ID: %s - invalid bits-per-sample (bits) '%d'$%s No audio initialization data passed, returning error$%s invalid bitrate (kbps) '%d'$%s- invalid channel count '%d$%s- invalid sample rate (hz) '%d$CNvMFAACEncoder::InitializeMFTandMediaTypes
API String ID: 0-3830295964
Opcode ID: b58d4a504f29bfbd919c47ccc5bda832fbb375b0432de0edfb3321c01ac5011a
Instruction ID: d89f1fec6a124f66df8d8f392fd2f92bf0743f60e234615280cbfbea1cd5b100
Opcode Fuzzy Hash: b58d4a504f29bfbd919c47ccc5bda832fbb375b0432de0edfb3321c01ac5011a
Instruction Fuzzy Hash: 7581AF32B1AB46A2FB54CF25E4442A97760FB85BC4F845532EA4E43BA4DF3DE444C724

Function 000000018000E7F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E819

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E83E
ctype.LIBCPMT ref: 000000018000E8C1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000E8D8
_CxxThrowException.LIBCMT ref: 000000018000E8E9
std::_Facet_Register.LIBCPMT ref: 000000018000E907

Strings

bad cast, xrefs: 000000018000E8CC

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3320480354-3145022300
Opcode ID: 997303cdb5246af4f3804dbc33bfa6d28888dcc0a64c4145d567fdc2599bd8a0
Instruction ID: 7396700a3e2aa9f6dcc0ca259bbfacf4549d370ee844549db4e676bec1950651
Opcode Fuzzy Hash: 997303cdb5246af4f3804dbc33bfa6d28888dcc0a64c4145d567fdc2599bd8a0
Instruction Fuzzy Hash: 35315E31604A8881FA97DB15E4503D97761F798BE0F58C322FA6D176E9DF38C68AC700

Function 000000018000F048 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F069

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F08E
moneypunct.LIBCPMT ref: 000000018000F111
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F128
_CxxThrowException.LIBCMT ref: 000000018000F139
std::_Facet_Register.LIBCPMT ref: 000000018000F157

Strings

bad cast, xrefs: 000000018000F11C

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: 2f04781c0b5e18591815ebcc6c292dda38492b9e83a825390bd61a302c4df626
Instruction ID: 2e1ae5781fe8c05b86cdc7ffb40e0608430781eac327408133958ab252574f1b
Opcode Fuzzy Hash: 2f04781c0b5e18591815ebcc6c292dda38492b9e83a825390bd61a302c4df626
Instruction Fuzzy Hash: 07314332604A4881EAA6DB15E4503E97760F798BE4F648322F66D03BE6DE38C68DD700

Function 000000018000F898 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F8B9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F8DE
messages.LIBCPMT ref: 000000018000F961
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F978
_CxxThrowException.LIBCMT ref: 000000018000F989
std::_Facet_Register.LIBCPMT ref: 000000018000F9A7

Strings

bad cast, xrefs: 000000018000F96C

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: ba301de617691a25de1568d6629764ce47dc5661472e619ef08b9ca5d15eff40
Instruction ID: bf50277651feb23a4f13a6c5a880b1d27c86798fa76ed2e6007adde15329282e
Opcode Fuzzy Hash: ba301de617691a25de1568d6629764ce47dc5661472e619ef08b9ca5d15eff40
Instruction Fuzzy Hash: C1314F72604A4891FAA2DB15E4407E97760F79CBE0F148322FA6D13BE5DF38C68AD700

Function 00000001800080D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800080F1

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008116
messages.LIBCPMT ref: 0000000180008199
std::bad_exception::bad_exception.LIBCMT ref: 00000001800081B0
_CxxThrowException.LIBCMT ref: 00000001800081C1
std::_Facet_Register.LIBCPMT ref: 00000001800081DF

Strings

bad cast, xrefs: 00000001800081A4

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: de1c21e832a76d84b7319f342fcfc80a87732f041ca1253d4a316bfc9e9b560d
Instruction ID: 747a8e2e6dad2d90b1f0716f744283a3e44b8922fd48889ad8a5bc8a8dfd0f0f
Opcode Fuzzy Hash: de1c21e832a76d84b7319f342fcfc80a87732f041ca1253d4a316bfc9e9b560d
Instruction Fuzzy Hash: 5D314F31604B4891FA93DB15E8503D973A5FB98BE4F588322FA9D076E5DE38C68E9700

Function 0000000180023924 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023945

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018002396A
collate.LIBCPMT ref: 00000001800239ED
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023A04
_CxxThrowException.LIBCMT ref: 0000000180023A15
std::_Facet_Register.LIBCPMT ref: 0000000180023A33

Strings

bad cast, xrefs: 00000001800239F8

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3240839640-3145022300
Opcode ID: 34fdc018d8a8ec6bee2b747dce8489b826a34589efca71191b1f9c2b58655a0b
Instruction ID: 6f35ace6046a98efa2fc2a7e222986f193aa6cacab9ff511322773bfe6909e8d
Opcode Fuzzy Hash: 34fdc018d8a8ec6bee2b747dce8489b826a34589efca71191b1f9c2b58655a0b
Instruction Fuzzy Hash: 34318F72605A4C81FAD7DB15E4413D96360F39CBE0F548226FA9D036E5DE78CA8DC700

Function 000000018000E928 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E949

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E96E
messages.LIBCPMT ref: 000000018000E9F1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000EA08
_CxxThrowException.LIBCMT ref: 000000018000EA19
std::_Facet_Register.LIBCPMT ref: 000000018000EA37

Strings

bad cast, xrefs: 000000018000E9FC

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 6dc5dc1771d10e344de0ccb396d5e2778d4d018ff2c769379d7feb57f0715546
Instruction ID: d7988e17b3725b2409f932854fd4a3b422a4396c3d031bda681015576420d7f9
Opcode Fuzzy Hash: 6dc5dc1771d10e344de0ccb396d5e2778d4d018ff2c769379d7feb57f0715546
Instruction Fuzzy Hash: DE314F32604A8881FAD6DB15E4403D97761F79DBE0F548222F65D636E5DE38C78DC700

Function 0000000180006940 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180006961

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180006986
std::bad_exception::bad_exception.LIBCMT ref: 0000000180006A21
_CxxThrowException.LIBCMT ref: 0000000180006A32
std::_Facet_Register.LIBCPMT ref: 0000000180006A50

Strings

bad cast, xrefs: 0000000180006A15
ios_base::badbit set, xrefs: 0000000180006940

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast$ios_base::badbit set
API String ID: 1776536810-182444483
Opcode ID: 8350d050f5a0f01878a3f2d3d7fa6fc40c68057f815e104cabb17d988fe9a483
Instruction ID: 02ad155c9015395c238964cca4a8f2f47d031e4f92e59427d6e1992964da67f8
Opcode Fuzzy Hash: 8350d050f5a0f01878a3f2d3d7fa6fc40c68057f815e104cabb17d988fe9a483
Instruction Fuzzy Hash: 3D314C32600A4881EA97DB15E5403D97361E798BE0F589222FA6E577F9DE38C68AC700

Function 00007FF8A8686430 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 78threadCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF8A879B5C1
QueryPerformanceFrequency.KERNEL32 ref: 00007FF8A879B5CC
GetCurrentThreadId.KERNEL32 ref: 00007FF8A879B630

Strings

{%x - Thread} [time-taken:%lf mecs], xrefs: 00007FF8A879B636
%s - %s, xrefs: 00007FF8A879B6F8
tictoc::elapsed, xrefs: 00007FF8A879B6F1
QueryPerformanceFrequency failed!, xrefs: 00007FF8A879B5D6

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: PerformanceQuery$CounterCurrentFrequencyThread
String ID: %s - %s$QueryPerformanceFrequency failed!$tictoc::elapsed${%x - Thread} [time-taken:%lf mecs]
API String ID: 2794441565-1894815428
Opcode ID: ba7330a78a44e98a6fe4daf9ad7e95193e872844c99b5209028e9c264dfbe5dd
Instruction ID: e58b297c099dca781b2c2a6299581f7d0e92865f8cb8691f8f1df812e2498a75
Opcode Fuzzy Hash: ba7330a78a44e98a6fe4daf9ad7e95193e872844c99b5209028e9c264dfbe5dd
Instruction Fuzzy Hash: C7418032A09B85A2E762DB24E4043FBB364FB947C4F404232E68D43A98DF3CD645CB14

Function 00007FF8A868A410 Relevance: 12.2, APIs: 3, Strings: 5, Instructions: 192COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8A87806E4
GetLastError.KERNEL32 ref: 00007FF8A878076A

Strings

GetGUID MF_MT_SUBTYPE hr=0x%08X le=%d, xrefs: 00007FF8A8780773
SetGUID MF_MT_SUBTYPE (%d) hr=0x%08X le=%d, xrefs: 00007FF8A87808A7
ConfigureSourceReaderVideo, xrefs: 00007FF8A87808C4
GetNativeMediaType hr=0x%08X le=%d, xrefs: 00007FF8A87806ED
%s: GetMajorType failed for video stream, error - %x, xrefs: 00007FF8A87808CB

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID: %s: GetMajorType failed for video stream, error - %x$ConfigureSourceReaderVideo$GetGUID MF_MT_SUBTYPE hr=0x%08X le=%d$GetNativeMediaType hr=0x%08X le=%d$SetGUID MF_MT_SUBTYPE (%d) hr=0x%08X le=%d
API String ID: 1452528299-3155781339
Opcode ID: efa0075014274d6ca57fcb6332186627843c869df92de8aa5742aa0c05e12b95
Instruction ID: e14fb10e879b1ebb7d6cd178bbfd40f8b52c6a993ff4b94ca9765e424b7fdc71
Opcode Fuzzy Hash: efa0075014274d6ca57fcb6332186627843c869df92de8aa5742aa0c05e12b95
Instruction Fuzzy Hash: E6914D26F0AA16A9FB108B6AD8883BC37A0FB59BC4F044132DE5D57764DF3CE4458368

Function 00007FF8A8683200 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8A8780379
GetLastError.KERNEL32 ref: 00007FF8A8780576

Strings

SetCurrentMediaType MF_SOURCE_READER_FIRST_AUDIO_STREAM hr=0x%08X le=%d, xrefs: 00007FF8A8780448
GetGUID MF_MT_SUBTYPE hr=0x%08X le=%d, xrefs: 00007FF8A87803CA
SetGUID MF_MT_SUBTYPE (%d) hr=0x%08X le=%d, xrefs: 00007FF8A878057F
GetNativeMediaType Stream %d hr=0x%08X le=%d, xrefs: 00007FF8A8780382

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID: GetGUID MF_MT_SUBTYPE hr=0x%08X le=%d$GetNativeMediaType Stream %d hr=0x%08X le=%d$SetCurrentMediaType MF_SOURCE_READER_FIRST_AUDIO_STREAM hr=0x%08X le=%d$SetGUID MF_MT_SUBTYPE (%d) hr=0x%08X le=%d
API String ID: 1452528299-3119712302
Opcode ID: e29568572fa14d84d16d7519d0c820b574227a19fb104b39875f44c73128b5f3
Instruction ID: 32652b0ccdb51bee6d697178ad47dd1b6aa4f1c1c92a94a9dab03b17cbeb7405
Opcode Fuzzy Hash: e29568572fa14d84d16d7519d0c820b574227a19fb104b39875f44c73128b5f3
Instruction Fuzzy Hash: 38717B36B5AB46A6EB108F1AE44867963A0FB89FC4F115036EE4E83764DF3CE441C724

Function 00007FF8A8693810 Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF8A877DD60
CloseHandle.KERNEL32 ref: 00007FF8A877DD79
CloseHandle.KERNEL32 ref: 00007FF8A877DD92
CloseHandle.KERNEL32 ref: 00007FF8A877DDAB
CloseHandle.KERNEL32 ref: 00007FF8A877DDC4
CloseHandle.KERNEL32 ref: 00007FF8A877DDDD
CloseHandle.KERNEL32 ref: 00007FF8A877DDF6
FreeLibrary.KERNEL32 ref: 00007FF8A877DE0F

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: CloseHandle$FreeLibrary
String ID:
API String ID: 736098846-0
Opcode ID: efc3fe0037e42635d1aa8fecd1ef55e2eadabcfa4abc9b3b191b5c73e548401a
Instruction ID: 4623dc26202d0dcc55b35ba908ea59b3ef683f54f22a920afeb973ffaf6c31d0
Opcode Fuzzy Hash: efc3fe0037e42635d1aa8fecd1ef55e2eadabcfa4abc9b3b191b5c73e548401a
Instruction Fuzzy Hash: D741F736A5BB81A5EB54CF62E5582B83764EF84FD5F084136DE8E07B5ACF389051C324

Function 00007FF8A868EDE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 00007FF8A876DA6F
MulDiv.KERNEL32 ref: 00007FF8A876DA81
MulDiv.KERNEL32 ref: 00007FF8A876DA9A
SetRect.USER32 ref: 00007FF8A876DAD1

Strings

Dest rect: {%d, %d, %d, %d}, xrefs: 00007FF8A876DAE7
PAR: %d x %d, xrefs: 00007FF8A876DA32

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Rect
String ID: Dest rect: {%d, %d, %d, %d}$PAR: %d x %d
API String ID: 400858303-602302452
Opcode ID: 559950210395ed975e79b44adc41054cec849b7582ad1d56a255cdf0ad68c0ce
Instruction ID: 3722bd6450f0f2b30f590baa0cf2b5492f754206f959271057d32fd6a27169a3
Opcode Fuzzy Hash: 559950210395ed975e79b44adc41054cec849b7582ad1d56a255cdf0ad68c0ce
Instruction Fuzzy Hash: BB41AC36719B81A7E7108F26E408569BBA5FB88FC0F045135DE8E53B28DF39E854CB94

Function 00007FF8A87AB0D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98librarymemoryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A87AB2C0: GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87AB2E8
Part of subcall function 00007FF8A87AB2C0: LocalAlloc.KERNEL32 ref: 00007FF8A87AB30B
Part of subcall function 00007FF8A87AB2C0: GetSystemDirectoryW.KERNEL32 ref: 00007FF8A87AB31E

LoadLibraryExW.KERNEL32 ref: 00007FF8A87AB144
LocalFree.KERNEL32 ref: 00007FF8A87AB150
GetProcAddress.KERNEL32 ref: 00007FF8A87AB174
LocalAlloc.KERNEL32 ref: 00007FF8A87AB1ED

Strings

Shell32.dll, xrefs: 00007FF8A87AB11E
SHGetFolderPathW, xrefs: 00007FF8A87AB16A

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Local$AllocDirectorySystem$AddressFreeLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll
API String ID: 1341906590-1831903832
Opcode ID: 9bc15085328f5bfa94c6fc05054273b19d9ba2339b94c399c8978e9a2a124876
Instruction ID: d8d83022149fd1e081a7e795b4f78ac341989601401e424b2d18a50514a43afe
Opcode Fuzzy Hash: 9bc15085328f5bfa94c6fc05054273b19d9ba2339b94c399c8978e9a2a124876
Instruction Fuzzy Hash: B641B221B1BA52A1FB619B11A81827962A1FF44BD4F888135DD4E07788EF3CE406C328

Function 00007FF8A87A1D50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8A87A1DC4
LocalAlloc.KERNEL32 ref: 00007FF8A87A1E2F
GetLastError.KERNEL32 ref: 00007FF8A87A1E3D

Part of subcall function 00007FF8A87A1A50: VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1A9C
Part of subcall function 00007FF8A87A1A50: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A1AC7

LocalFree.KERNEL32 ref: 00007FF8A87A1E76

Strings

Advapi32.dll, xrefs: 00007FF8A87A1D92
RegQueryValueExW, xrefs: 00007FF8A87A1DBA

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Local$AddressAllocConditionErrorFreeInfoLastMaskProcVerifyVersion
String ID: Advapi32.dll$RegQueryValueExW
API String ID: 3707099831-295176829
Opcode ID: 698e8803dc34555242da3cc59fb36ac2bbed8fae0d3c80f23629390359c3b53d
Instruction ID: 0f5856ce1b128a10a1d9d5435837a2a856fee7a4cfb843f88acbe0d6700b7389
Opcode Fuzzy Hash: 698e8803dc34555242da3cc59fb36ac2bbed8fae0d3c80f23629390359c3b53d
Instruction Fuzzy Hash: C1315E31A0EB42A6FB548B11A85427AB2E5FB85BC5F584435DE8E43B64DF3CE401C728

Function 0000000180024044 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180024065

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018002408A
std::bad_exception::bad_exception.LIBCMT ref: 0000000180024124
_CxxThrowException.LIBCMT ref: 0000000180024135
std::_Facet_Register.LIBCPMT ref: 0000000180024153

Strings

bad cast, xrefs: 0000000180024118

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: a9291c87b619f3b996d60f5c6d623e361a3f3665819b2df7064c52e3dbe42ad7
Instruction ID: 91e638e8e58f5590816a3cc392cfc10599bec749f4e2be6b6ca140d2a25e3853
Opcode Fuzzy Hash: a9291c87b619f3b996d60f5c6d623e361a3f3665819b2df7064c52e3dbe42ad7
Instruction Fuzzy Hash: 8C314172604A4981EA97DB15E4903D97760F79CBE0F548322BA6D0B7E9DE38C6CDC700

Function 0000000180024174 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180024195

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800241BA
std::bad_exception::bad_exception.LIBCMT ref: 0000000180024254
_CxxThrowException.LIBCMT ref: 0000000180024265
std::_Facet_Register.LIBCPMT ref: 0000000180024283

Strings

bad cast, xrefs: 0000000180024248

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 12eb798131b44ed89ccc95a849e9259a6caec3e02f1d91c0b99d509edef29d89
Instruction ID: 90848ef588fa6780bc4661c9358ff58c986763a4f68afd91812fa81bb0acabc5
Opcode Fuzzy Hash: 12eb798131b44ed89ccc95a849e9259a6caec3e02f1d91c0b99d509edef29d89
Instruction Fuzzy Hash: 23315232604A4881EA97DB26E4403D967A1F798BE0F549322FA5D576E5DF38CA8DC700

Function 00007FF8A8691560 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87B656C

Part of subcall function 00007FF8A87B1990: SetLastError.KERNEL32 ref: 00007FF8A87B19B1
Part of subcall function 00007FF8A87B1990: LocalAlloc.KERNEL32 ref: 00007FF8A87B19EB
Part of subcall function 00007FF8A87B1990: LocalFree.KERNEL32 ref: 00007FF8A87B1A31
Part of subcall function 00007FF8A87B1990: SetLastError.KERNEL32 ref: 00007FF8A87B1A3C

LoadLibraryExW.KERNEL32 ref: 00007FF8A87B65CC
LocalFree.KERNEL32 ref: 00007FF8A87B65D8
GetProcAddress.KERNEL32 ref: 00007FF8A87B6600

Strings

ShellExecuteW, xrefs: 00007FF8A87B65F6
Shell32.dll, xrefs: 00007FF8A87B65B0

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLastLocal$Free$AddressAllocLibraryLoadProc
String ID: Shell32.dll$ShellExecuteW
API String ID: 3119643837-1473611414
Opcode ID: f4849fe2f0c7abd62b89033c976954a72196e0344b8972263a8a602321c030f5
Instruction ID: bbcad34fb539c62f0374be775d9da007df88b373c7be512bd4f81061680c2f1a
Opcode Fuzzy Hash: f4849fe2f0c7abd62b89033c976954a72196e0344b8972263a8a602321c030f5
Instruction Fuzzy Hash: 33219335B0AB4299EA40EB16BC08676A391FF49BD4F0C4035DE4E43B58EF3CE0428728

Function 00007FF8A8709E60 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 41COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF8A8709E76

Strings

kernel32.dll, xrefs: 00007FF8A8709E6F
InitializeConditionVariable, xrefs: 00007FF8A8709E88
WakeAllConditionVariable, xrefs: 00007FF8A8709EC3
SleepConditionVariableCS, xrefs: 00007FF8A8709E97
WakeConditionVariable, xrefs: 00007FF8A8709EAD

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: HandleModule
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 4139908857-2387153273
Opcode ID: 13d3deadd11c91aaa1b09a78a1db330eb72840e8f80f03264e7b8b5f1608b1d5
Instruction ID: 728f28e13b4117a55ec2df2de8549a75703ceef7d2d56dc58db619f8cd50119a
Opcode Fuzzy Hash: 13d3deadd11c91aaa1b09a78a1db330eb72840e8f80f03264e7b8b5f1608b1d5
Instruction Fuzzy Hash: 8811F164E0BB02B0FA549B11A8587B027A5EF843C1F481535C90D863D5EFBCF989C279

Function 00007FF8A8690460 Relevance: 9.3, APIs: 6, Instructions: 334COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 00007FF8A8775440
SetRectEmpty.USER32 ref: 00007FF8A877546A
SetRectEmpty.USER32 ref: 00007FF8A877548E
SetRectEmpty.USER32 ref: 00007FF8A87754B4
SetRectEmpty.USER32 ref: 00007FF8A87754D8
SetRectEmpty.USER32 ref: 00007FF8A87754FE

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: d980002bf735433719a339c1b30e8d820760182589dd7f874130936071ff0318
Instruction ID: 9efbaa299f4a02c638cb6ce1728cf69f39631c7728885318847a231a8d5e83f5
Opcode Fuzzy Hash: d980002bf735433719a339c1b30e8d820760182589dd7f874130936071ff0318
Instruction Fuzzy Hash: 6A022A72606F91A6EB50CF15E848AAA33ECFB49B88F568635CE9D03761DF38D054C324

Function 00007FF8A88BD77C Relevance: 9.1, APIs: 6, Instructions: 103threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF8A88BD7A9
GetCurrentThreadId.KERNEL32 ref: 00007FF8A88BD7C4
GetCurrentThreadId.KERNEL32 ref: 00007FF8A88BD7DA
GetCurrentThreadId.KERNEL32 ref: 00007FF8A88BD831
GetCurrentThreadId.KERNEL32 ref: 00007FF8A88BD863
GetCurrentThreadId.KERNEL32 ref: 00007FF8A88BD8BC

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a6c294782ecb49a4f98d512ccf521d9b166f33ffd94ec85b9b506cbbeadca105
Instruction ID: c4d5e7ad7072943a2cde0daa6d9cba5b181c1dddc5eb10e95a57d6bffd80b98a
Opcode Fuzzy Hash: a6c294782ecb49a4f98d512ccf521d9b166f33ffd94ec85b9b506cbbeadca105
Instruction Fuzzy Hash: DC414231E09A0ABAEB709F15D44C27D77A0EB84BC6F048471DB4E466A4DF3DE485C724

Function 00007FF8A8693240 Relevance: 9.1, APIs: 6, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleExA.KERNEL32 ref: 00007FF8A870183B
CreateSemaphoreA.KERNEL32 ref: 00007FF8A8701856
CreateSemaphoreA.KERNEL32 ref: 00007FF8A8701875

Part of subcall function 00007FF8A8688ED0: ReleaseSemaphore.KERNEL32 ref: 00007FF8A86FFF76

FreeLibrary.KERNEL32 ref: 00007FF8A87018D5
CloseHandle.KERNEL32 ref: 00007FF8A87018E3
CloseHandle.KERNEL32 ref: 00007FF8A87018F1

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: HandleSemaphore$CloseCreate$FreeLibraryModuleRelease
String ID:
API String ID: 2305605725-0
Opcode ID: 2d879112fbd9533a903f1173ef03b82438ed6fbc637b852d21d6883aba767204
Instruction ID: 2507cd55a7661dbdf06517974c5184dcc4deb23e2af3727d26f79569c0d235d0
Opcode Fuzzy Hash: 2d879112fbd9533a903f1173ef03b82438ed6fbc637b852d21d6883aba767204
Instruction Fuzzy Hash: 69418F32A0AB0296E7949F61E84426A33B4FF44FA8F185238DE9D43784EF3CD554C368

Function 000000018000702A Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 00000001800070C2
_CxxThrowException.LIBCMT ref: 00000001800070FB
_CxxThrowException.LIBCMT ref: 0000000180007133

Strings

ios_base::eofbit set, xrefs: 0000000180007101
ios_base::failbit set, xrefs: 00000001800070D2
ios_base::badbit set, xrefs: 0000000180007094

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: 699b7d2228cff961f95bcc84e6e72b285b1e2d0b36deb1e7e2300fec3cbeab5f
Instruction ID: dfa8a448075bbfc6b28c82488b61fa1b389f2e2b11f37815cd1c202517538396
Opcode Fuzzy Hash: 699b7d2228cff961f95bcc84e6e72b285b1e2d0b36deb1e7e2300fec3cbeab5f
Instruction Fuzzy Hash: 0B315272614A8991EBA2DB18E4913D973A0F79C7C8F508522F68C53AA6DF3DC74EC740

Function 00007FF8A8685800 Relevance: 9.1, APIs: 6, Instructions: 70COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF8A87B5F35
FreeLibrary.KERNEL32 ref: 00007FF8A87B5F71
FreeLibrary.KERNEL32 ref: 00007FF8A87B5FD0
FreeLibrary.KERNEL32 ref: 00007FF8A87B5FF0
FreeLibrary.KERNEL32 ref: 00007FF8A87B6048
FreeLibrary.KERNEL32 ref: 00007FF8A87B6068

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: dd8ee555a69306320eebe891d200e187e02fda6655238bb9e5ba11fcf8265f6f
Instruction ID: d7a6d20a7cb569cb1430cf756f8f3604f6cc7ceae9396085782c3f35681dc154
Opcode Fuzzy Hash: dd8ee555a69306320eebe891d200e187e02fda6655238bb9e5ba11fcf8265f6f
Instruction Fuzzy Hash: 44411434D4BB03A5F6549F55BD9D6303BA8FF497C2F9C4138C59D92228DFBC60A29228

Function 00007FF8A8683D70 Relevance: 9.1, APIs: 6, Instructions: 66processCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87A367A
LocalFree.KERNEL32 ref: 00007FF8A87A36BA
LocalFree.KERNEL32 ref: 00007FF8A87A36C3

Part of subcall function 00007FF8A879E1F0: LocalAlloc.KERNEL32 ref: 00007FF8A879E228

LocalFree.KERNEL32 ref: 00007FF8A87A36CD
LocalFree.KERNEL32 ref: 00007FF8A87A36D6
CreateProcessA.KERNEL32 ref: 00007FF8A87A3732

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Local$Free$AllocCreateErrorLastProcess
String ID:
API String ID: 1969510515-0
Opcode ID: 12740f08b17e158aafcf8b993e97012b1c5048d0ee68dbad3ebb90abe51118b6
Instruction ID: e87800ac47041bb92e658b356a37441022bb0f4879f6c6353d6604183197ce78
Opcode Fuzzy Hash: 12740f08b17e158aafcf8b993e97012b1c5048d0ee68dbad3ebb90abe51118b6
Instruction Fuzzy Hash: 73215336A0EB819AD6609F16B84426AF7A5FB89FD0F044134EE8D47B15EF3CD0418B14

Function 00007FF8A86848E0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 162COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF8A87B2190
WideCharToMultiByte.KERNEL32 ref: 00007FF8A87B2298

Strings

WStrToUTF8Str : WideCharToMultiByte failed, xrefs: 00007FF8A87B219E, 00007FF8A87B22A2
WStrToUTF8Str, xrefs: 00007FF8A87B21A5, 00007FF8A87B22A9
C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_common.cpp, xrefs: 00007FF8A87B21B1, 00007FF8A87B22B5

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_common.cpp$WStrToUTF8Str$WStrToUTF8Str : WideCharToMultiByte failed
API String ID: 626452242-1232079533
Opcode ID: 00bc28277f8e413848cc3c53caacea19eefad3600e0077b83c526978867c428e
Instruction ID: 8c63f8bba4bb77ca63ed275864fc3fca277b3e86bb8fa602b7c03dbdd58452f0
Opcode Fuzzy Hash: 00bc28277f8e413848cc3c53caacea19eefad3600e0077b83c526978867c428e
Instruction Fuzzy Hash: 1A61D422A1AB42A9FB009F61E8443BC33A2FB047E8F545235DA6E47AD4CF3CD951C358

Function 0000000180034034 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180034066

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_malloc_crt.LIBCMT ref: 00000001800340B1
_invoke_watson.LIBCMT ref: 0000000180034199

Part of subcall function 0000000180035CD8: _call_reportfault.LIBCMT ref: 0000000180035D00

_invoke_watson.LIBCMT ref: 00000001800341AE

Strings

:, xrefs: 00000001800340CF

Memory Dump Source

Source File: 00000004.00000002.2375840150.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.2375810321.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375889272.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375928822.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2375991631.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID: :
API String ID: 1584724053-336475711
Opcode ID: 604a302fabdb042f4ebc9b27cedb385bdeaebfe8a2c90ea295b00d5b5a1e0000
Instruction ID: 6d0e94c2461dd84b0edd1b1838a9f5cfcbcc86ad0ff0a6976e9d1f2ec4836e13
Opcode Fuzzy Hash: 604a302fabdb042f4ebc9b27cedb385bdeaebfe8a2c90ea295b00d5b5a1e0000
Instruction Fuzzy Hash: 5C41D032320B4881EB46DF26A8053DE63A5FB88BC4F4AD025EF5D4B785DE38D616C304

Function 00007FF8A8682A60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8A882FC9B
GetCurrentThreadId.KERNEL32 ref: 00007FF8A882FCA9
GetCurrentProcessId.KERNEL32 ref: 00007FF8A882FCB5
QueryPerformanceCounter.KERNEL32 ref: 00007FF8A882FCC5

Strings

csm, xrefs: 00007FF8A882FC47

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID: csm
API String ID: 2933794660-1018135373
Opcode ID: 9c37060bb5aff8f47d83b418f54173fdaeadf3418620d2c1b083643b80c47b69
Instruction ID: 30d5925e3ed7682122d7b420f57fdb302faeac590d96063651984255b93a5a5b
Opcode Fuzzy Hash: 9c37060bb5aff8f47d83b418f54173fdaeadf3418620d2c1b083643b80c47b69
Instruction Fuzzy Hash: 43118232F05B029AEB24DF35D8890A833A4FB48759F410A31EA2D83784EF38D551C754

Function 00007FF8A8695E50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87A6711
SetLastError.KERNEL32 ref: 00007FF8A87A6721
GetProcAddress.KERNEL32 ref: 00007FF8A87A6784

Strings

Shell32.dll, xrefs: 00007FF8A87A6756
ShellExecuteExW, xrefs: 00007FF8A87A677A

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast$AddressProc
String ID: Shell32.dll$ShellExecuteExW
API String ID: 1975335638-1867648532
Opcode ID: fb2c20d02fc5ce01f6fbea5abba0739a854b0586ab376f0aa36309c75b8c1e82
Instruction ID: 375d38cca01a3ca4690a4cc3818b710301d11dfe0dbfb3a02d3194c0be0ee31b
Opcode Fuzzy Hash: fb2c20d02fc5ce01f6fbea5abba0739a854b0586ab376f0aa36309c75b8c1e82
Instruction Fuzzy Hash: 57113DA5F6BA02A1FE598B26E84863552D1EF58BC8F1C9034D94D4B395EF2CE840C328

Function 00007FF8A8681230 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 35COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32 ref: 00007FF8A87AE347

Strings

error: NGXGetPath failed to obtain path to models, xrefs: 00007FF8A87AE355
NGXGetPath, xrefs: 00007FF8A87AE361
\NVIDIA\NGX\models\, xrefs: 00007FF8A87AE32E
C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_common.cpp, xrefs: 00007FF8A87AE368

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: FreeTask
String ID: C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_common.cpp$NGXGetPath$\NVIDIA\NGX\models\$error: NGXGetPath failed to obtain path to models
API String ID: 734271698-558388089
Opcode ID: cf7afd06313f23bc2d3ce6267aed7f858da56ded38a386cad9cd68212315a593
Instruction ID: b3b955cc9d227ce66591f0e7bdfde0209ae1b3c5a5ce1838cb23b64a254ec108
Opcode Fuzzy Hash: cf7afd06313f23bc2d3ce6267aed7f858da56ded38a386cad9cd68212315a593
Instruction Fuzzy Hash: 9E0162A1A1AA86B1F700DB51A8543F66720EF893C0FC42431E94E467A5DF7CF585C768

Function 00007FF8A868A8F0 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF8A87F3E22
MultiByteToWideChar.KERNEL32 ref: 00007FF8A87F3EC5
MultiByteToWideChar.KERNEL32 ref: 00007FF8A87F3F67
MultiByteToWideChar.KERNEL32 ref: 00007FF8A87F3F91
MultiByteToWideChar.KERNEL32 ref: 00007FF8A87F402F

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 8158fdbed35703439d31d863770e95fddfec0e87a7ccd3433e7dff91f6b0f40e
Instruction ID: d05a66ec3875a830b38d429cb0adf4ddf62aef71b48a164c4c2602aed64f0ee0
Opcode Fuzzy Hash: 8158fdbed35703439d31d863770e95fddfec0e87a7ccd3433e7dff91f6b0f40e
Instruction Fuzzy Hash: D391C722F4E29AAAFB758B2284443B96691FF407D4F488231D96D067D5DFBCEC44C328

Function 00007FF8A86950C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 00007FF8A8753EC7
SetRectEmpty.USER32 ref: 00007FF8A8753EEF

Strings

%s - Cannot allocate CNvMediaStream object, xrefs: 00007FF8A8753FC4
CNvMediaStream::createInstance, xrefs: 00007FF8A8753FBD

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: EmptyRect
String ID: %s - Cannot allocate CNvMediaStream object$CNvMediaStream::createInstance
API String ID: 2270935405-2132362898
Opcode ID: 1909a5ec3928abb6569e16f3c136be8b54ff892250961ddcd135eeaa0d9569e6
Instruction ID: 73dd6dba1d0f685ba3440e2d8975ac1e21ce10d5157ba513193a943d43ade59e
Opcode Fuzzy Hash: 1909a5ec3928abb6569e16f3c136be8b54ff892250961ddcd135eeaa0d9569e6
Instruction Fuzzy Hash: 21518032A09F8191EB40CF25E4401A9B3A4FF98BC8F488135DE9D477A9EF38E555C724

Function 00007FF8A8681B00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87A3982

Part of subcall function 00007FF8A87A2840: SetLastError.KERNEL32 ref: 00007FF8A87A2861
Part of subcall function 00007FF8A87A2840: LocalAlloc.KERNEL32 ref: 00007FF8A87A289B
Part of subcall function 00007FF8A87A2840: LocalFree.KERNEL32 ref: 00007FF8A87A28E1
Part of subcall function 00007FF8A87A2840: SetLastError.KERNEL32 ref: 00007FF8A87A28EC

GetProcAddress.KERNEL32 ref: 00007FF8A87A39E3

Part of subcall function 00007FF8A87A1A50: VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1A9C
Part of subcall function 00007FF8A87A1A50: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A1AC7

Strings

Advapi32.dll, xrefs: 00007FF8A87A39B1
CreateProcessAsUserW, xrefs: 00007FF8A87A39D9

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast$Local$AddressAllocConditionFreeInfoMaskProcVerifyVersion
String ID: Advapi32.dll$CreateProcessAsUserW
API String ID: 1335820174-1007808920
Opcode ID: 9313167633e3093886861a610880a2977e5a3e8435188262efbfc91fb09343e7
Instruction ID: 1bc716bb1ddf7d94da6a725c9abbf5346bd1532ed38f51dd4ef257f4c46a635a
Opcode Fuzzy Hash: 9313167633e3093886861a610880a2977e5a3e8435188262efbfc91fb09343e7
Instruction Fuzzy Hash: B031FC35B0EB8599EA608F16F84426AB3A4FB88BC4F184135EE8D83B58DF3CD510CB14

Function 00007FF8A8684C90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF8A889F671
try_get_function.LIBVCRUNTIME ref: 00007FF8A889F6CF

Strings

SystemFunction036, xrefs: 00007FF8A889F65E
SetThreadStackGuarantee, xrefs: 00007FF8A889F6C8

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: try_get_function
String ID: SetThreadStackGuarantee$SystemFunction036
API String ID: 2742660187-2910880125
Opcode ID: 42a21d8fbdf4c7fd55994a9aa03e55a39c0e69e3b1ff3945505324e5b554d08c
Instruction ID: 34f619b1e0d4f179b94525408b9e28f4fe6a72ff099f479e3308e0a6d22c7f4e
Opcode Fuzzy Hash: 42a21d8fbdf4c7fd55994a9aa03e55a39c0e69e3b1ff3945505324e5b554d08c
Instruction Fuzzy Hash: FA01A211F0BA02B2FA595BA1E9491F42251EF083C1F4C1436DA1E073A2CF3CE994C728

Function 00007FF8A8687E80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF8A889F9D0
try_get_function.LIBVCRUNTIME ref: 00007FF8A889FA0A

Strings

GetActiveWindow, xrefs: 00007FF8A889F9C9
GetLastActivePopup, xrefs: 00007FF8A889FA03

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: try_get_function
String ID: GetActiveWindow$GetLastActivePopup
API String ID: 2742660187-3742175580
Opcode ID: 30162a81ab991935d28d0d1c821ab97a2df501696bf24f83211b68c12433b53e
Instruction ID: 17bc221a759a4ac7d76688c543baad91002257d0b12348f62c96c4728d5ff17a
Opcode Fuzzy Hash: 30162a81ab991935d28d0d1c821ab97a2df501696bf24f83211b68c12433b53e
Instruction Fuzzy Hash: B1F03751F4BA07B1FB289B51AC092B06290EF097E2F8C0472DD0D06291EF2CB995CA78

Function 00007FF8A8689D50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

SHCreateDirectoryExW.SHELL32 ref: 00007FF8A87ADE55

Strings

failed to create directory %S - error %d, xrefs: 00007FF8A87ADE6C
NGXCreateDirectoryRecursively, xrefs: 00007FF8A87ADE73
C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_common.cpp, xrefs: 00007FF8A87ADE84

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: CreateDirectory
String ID: C:\dvs\p4\build\sw\devrel\libdev\NGX\core\r1.2\source\api\nvsdk_ngx_common.cpp$NGXCreateDirectoryRecursively$failed to create directory %S - error %d
API String ID: 4241100979-1361627980
Opcode ID: 7c024f1bb6d74ec21c2d2f033cf2bf4cf5f2d7814f91e9676ac46fc94289f014
Instruction ID: 528564864b55d25917898e184dd78e0a765afbca5a8b93fa78be9c40f41c93dc
Opcode Fuzzy Hash: 7c024f1bb6d74ec21c2d2f033cf2bf4cf5f2d7814f91e9676ac46fc94289f014
Instruction Fuzzy Hash: 18F0BB22B1D542A3E7108B28F44817AE7A1FB447C4F544532EA5C87B65DF3CD854C718

Function 00007FF8A868D650 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF8A879A3CE
DebugBreak.KERNEL32 ref: 00007FF8A879A3EC

Strings

%s (hr=0x%X), xrefs: 00007FF8A879A39D
Error, xrefs: 00007FF8A879A3C0

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: BreakDebugMessage
String ID: %s (hr=0x%X)$Error
API String ID: 3531667747-1227332571
Opcode ID: 4cbfaf4f7e7d06033da862a7b53ddd587f6f84c2425c5882bd8af398c5c79dd9
Instruction ID: 1878e753dbf7a8c07ed45ad4a83c9b0e2fb30770e0d2687392b72dd3049b719d
Opcode Fuzzy Hash: 4cbfaf4f7e7d06033da862a7b53ddd587f6f84c2425c5882bd8af398c5c79dd9
Instruction Fuzzy Hash: A6018665E1AA81A6FBA09720F45D3BE7350FFC4788F801032D94D56645EF3CD105C758

Function 00007FF8A87A1A50 Relevance: 6.1, APIs: 4, Instructions: 72libraryCOMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF8A87A1A9C
VerifyVersionInfoW.KERNEL32 ref: 00007FF8A87A1AC7
LoadLibraryExW.KERNEL32 ref: 00007FF8A87A1B20
LocalFree.KERNEL32 ref: 00007FF8A87A1B2C

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ConditionFreeInfoLibraryLoadLocalMaskVerifyVersion
String ID:
API String ID: 3996897175-0
Opcode ID: 7b90ea187a19757d781d7a8508d29235edc04a82aa32fe15ca570446b8cc600a
Instruction ID: fe9e46af3f141491a62daf8c4ac3b764a255101580314ab7fce78247e88b1659
Opcode Fuzzy Hash: 7b90ea187a19757d781d7a8508d29235edc04a82aa32fe15ca570446b8cc600a
Instruction Fuzzy Hash: DF21D632B1AA8195FB64DB22A8082B67396FBC8BC5F098035DE5E47754EF3CD402C764

Function 00007FF8A8691B20 Relevance: 6.1, APIs: 4, Instructions: 61threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF8A8884F15
GetLastError.KERNEL32 ref: 00007FF8A8884F23
CloseHandle.KERNEL32 ref: 00007FF8A8884F40
FreeLibrary.KERNEL32 ref: 00007FF8A8884F4F

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread
String ID:
API String ID: 3065451008-0
Opcode ID: 0d8131eb396a8f802abd1963439fb8b77639c9a0312576953a7fd75421bdef18
Instruction ID: 2ea81959bb584e07591cd33eeadbca9a2a20f118986cfac6edcb8e14c31ff57a
Opcode Fuzzy Hash: 0d8131eb396a8f802abd1963439fb8b77639c9a0312576953a7fd75421bdef18
Instruction Fuzzy Hash: 7E217C36B0B742A6FE14CF72A40807AA2A0FF84FD4F084475EA4D03799EF3CE4008668

Function 00007FF8A8681190 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87B5461
GetModuleHandleW.KERNEL32 ref: 00007FF8A87B54BC
LocalFree.KERNEL32 ref: 00007FF8A87B54C8
SetLastError.KERNEL32 ref: 00007FF8A87B54E6

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast$FreeHandleLocalModule
String ID:
API String ID: 2775970868-0
Opcode ID: 9e3bd118697827140c8c35a418e2f991fb94ac97f9fdae92732178acaa3a4831
Instruction ID: e7fc59f699575bfd519e65291cb9c11df9fe636598151cebab1b8438f2ff960e
Opcode Fuzzy Hash: 9e3bd118697827140c8c35a418e2f991fb94ac97f9fdae92732178acaa3a4831
Instruction Fuzzy Hash: 5211E021B5A2665AEE585B55A1081795293FF44BF2F4C5630DE6F077C0DF3CE8814228

Function 00007FF8A8694EF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF8A882C443
GetLastError.KERNEL32 ref: 00007FF8A882C45A

Strings

pContext, xrefs: 00007FF8A882C3F3

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: pContext
API String ID: 545576003-2046700901
Opcode ID: 42b5dbdf8eda4b2c455cc789c80ec8349dee69830d3ecf34cc683787c419d0fc
Instruction ID: f94d3365e83b29e047c7cc0b6181cae68a83c07dc191a308d87261470824da2a
Opcode Fuzzy Hash: 42b5dbdf8eda4b2c455cc789c80ec8349dee69830d3ecf34cc683787c419d0fc
Instruction Fuzzy Hash: 8E218161B0AB0BA2FF549B25D4591B922A1FF98BC1F489431DE5E073A1EF2CE515C328

Function 00007FF8A86954E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF8A889F2E1
LCMapStringW.KERNEL32 ref: 00007FF8A889F369

Strings

LCMapStringEx, xrefs: 00007FF8A889F2D5

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 2c2403fb9563f7bc7397c608fcf11f09139fd6e6f523df1d40ae67460aaeaa86
Instruction ID: 60bce0550723aac14452651c4f7c3483e6fcd568b0c2d49a8b203c21a12a4721
Opcode Fuzzy Hash: 2c2403fb9563f7bc7397c608fcf11f09139fd6e6f523df1d40ae67460aaeaa86
Instruction Fuzzy Hash: D3213836A09B8196D760CB56F4442AAB7A4FBC9BC0F584136EECD83B59DF3CD5408B04

Function 00007FF8A8685AE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF8A878492E

Strings

CNvAnimatedGifStreamEncoderWIC::initialize, xrefs: 00007FF8A8784940
%s - CoCreateInstance on CLSID_WICImagingFactory failed, xrefs: 00007FF8A878494C

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: CreateInstance
String ID: %s - CoCreateInstance on CLSID_WICImagingFactory failed$CNvAnimatedGifStreamEncoderWIC::initialize
API String ID: 542301482-3781439623
Opcode ID: d3b19091ed0324d88df89671fc1af45145660e2e85ad139f3cdde19376e2d69d
Instruction ID: d26126f89e13c0fdc5a9022ccaa762808c411bcc4564b779f81696477d23f2bd
Opcode Fuzzy Hash: d3b19091ed0324d88df89671fc1af45145660e2e85ad139f3cdde19376e2d69d
Instruction Fuzzy Hash: D1118E32A0AA56A2EB108F25E4043A963A0FF48BC8F544031EB5C57758DF7CD851C714

Function 00007FF8A8695830 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF8A87A928C
WaitForSingleObject.KERNEL32 ref: 00007FF8A87A92A0

Strings

ngx_update_api, xrefs: 00007FF8A87A9278

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: CreateMutexObjectSingleWait
String ID: ngx_update_api
API String ID: 3113225513-3046468762
Opcode ID: b200ed883b0c8e5db8df49f2f841541eb5b53eb944261d028a2ff164a3302a24
Instruction ID: f7a20965452fdff4e0dfa3299f2f8fbb6579bc03742cba777bdcea3718059752
Opcode Fuzzy Hash: b200ed883b0c8e5db8df49f2f841541eb5b53eb944261d028a2ff164a3302a24
Instruction Fuzzy Hash: B6E09272E47B4196EF15DF36A858178B291EB48B50F18C135D91D46380EF3CE095C228

Function 00007FF8A868BCD0 Relevance: 5.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8A87A2CC6
SetLastError.KERNEL32 ref: 00007FF8A87A2DB9

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7e5c6a5d257a954f4ece03d72a07074d059db0adc786de0da86780d6e63026fc
Instruction ID: 73f9144c253b15a90992abc0d836f6e47efee9fcb0b8b8f7b1c4730a6e62ad4b
Opcode Fuzzy Hash: 7e5c6a5d257a954f4ece03d72a07074d059db0adc786de0da86780d6e63026fc
Instruction Fuzzy Hash: 5441C321B1FB42A6FB109F65A84867966A0FF99BC5F084431ED0E43761DF7CE841C728

Function 00007FF8A868C800 Relevance: 5.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A87B5DA8
GetLastError.KERNEL32 ref: 00007FF8A87B5E22
LocalFree.KERNEL32 ref: 00007FF8A87B5E3D
SetLastError.KERNEL32 ref: 00007FF8A87B5E5B

Memory Dump Source

Source File: 00000004.00000002.2382349602.00007FF8A8681000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8680000, based on PE: true

Associated: 00000004.00000002.2382317150.00007FF8A8680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A86C0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A871C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88C5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2382349602.00007FF8A88D0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A88D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A893A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383259065.00007FF8A8974000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383491915.00007FF8A8976000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383519082.00007FF8A8977000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383549792.00007FF8A8978000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383579597.00007FF8A8979000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A8995000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383620432.00007FF8A89B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2383681552.00007FF8A89BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8a8680000_rundll32.jbxd

Similarity

API ID: ErrorLast$FreeLocal
String ID:
API String ID: 1627422176-0
Opcode ID: fe9ce48e8071581b44f4e0b6b5a870179f355a3f0ac14cbea2713b9be3281c90
Instruction ID: 412152f491328184d6887604c700214424786c6c7f09907a6cb0b44982b7a208
Opcode Fuzzy Hash: fe9ce48e8071581b44f4e0b6b5a870179f355a3f0ac14cbea2713b9be3281c90
Instruction Fuzzy Hash: 0E21E321F1E68266EB548B16B54C0795292EF88BD0F485231EF2F477D5EF3CE8818318

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gpufault.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_59ea469c9cde70e5cc5fc8dc983f2f16bebbf3_85207d7d_78f1e90e-9d4b-4061-a0d3-256187e7c363\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_59ea469c9cde70e5cc5fc8dc983f2f16bebbf3_85207d7d_99f64cc5-220c-40a6-a443-ae1f0170b272\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_gpu_2130faadf4e1a2532f2bde70d18604255ed2b85_790b1338_d96f171d-db8c-4086-ae5d-8c2cefa17d47\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_gpu_2cb5eecfada0578fd925b8fb75f122dc2c902f5e_790b1338_4a6e8b3f-d00d-4ffe-b52c-7069997444b1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAF6.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB36.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBA3.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBC4.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBE3.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC6E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCCC.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF92C.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA65.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB41.tmp.xml

C:\Users\user\AppData\Local\Temp\WERCB37.tmp.WERDataCollectionStatus.txt

C:\Users\user\AppData\Local\Temp\WERCBA5.tmp.WERDataCollectionStatus.txt

C:\Users\user\NTUSER.DAT.Not

C:\Windows\appcompat\Programs\Amcache.hve

Windows Analysis Report
gpufault.dll.dll