Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report c541a313a0492231a3_wmiprvse.exe

Overview

General Information

Sample Name:c541a313a0492231a3_wmiprvse.exe
Analysis ID:328714
MD5:60ff40cfd7fb8fe41ee4fe9ae5fe1c51
SHA1:3ea7cc066317ac45f963c2227c4c7c50aa16eb7c
SHA256:2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3

Most interesting Screenshot:

Detection

Score:5
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found large amount of non-executed APIs
PE file contains sections with non-standard names
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE69F110 NtdllDefWindowProc_W,PostMessageW,0_2_00007FF6EE69F110
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE698490 NtQuerySystemInformation,GetCurrentProcessId,char_traits,0_2_00007FF6EE698490
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE69AC500_2_00007FF6EE69AC50
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE69C3340_2_00007FF6EE69C334
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6AFF500_2_00007FF6EE6AFF50
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6BDFD00_2_00007FF6EE6BDFD0
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6B1E600_2_00007FF6EE6B1E60
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6D5F000_2_00007FF6EE6D5F00
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6AFC400_2_00007FF6EE6AFC40
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6CE9E80_2_00007FF6EE6CE9E8
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6AEA6C0_2_00007FF6EE6AEA6C
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6C9B000_2_00007FF6EE6C9B00
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6D0AC40_2_00007FF6EE6D0AC4
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE69775C0_2_00007FF6EE69775C
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6AF8680_2_00007FF6EE6AF868
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE69B8FC0_2_00007FF6EE69B8FC
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6938C40_2_00007FF6EE6938C4
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6BD5800_2_00007FF6EE6BD580
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6B34EC0_2_00007FF6EE6B34EC
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6C728C0_2_00007FF6EE6C728C
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6B12640_2_00007FF6EE6B1264
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6922D00_2_00007FF6EE6922D0
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: c541a313a0492231a3_wmiprvse.exeBinary or memory string: OriginalFilename vs c541a313a0492231a3_wmiprvse.exe
Source: c541a313a0492231a3_wmiprvse.exe, 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameWmiprvse.exej% vs c541a313a0492231a3_wmiprvse.exe
Source: c541a313a0492231a3_wmiprvse.exe, 00000000.00000002.491931781.00000248BD470000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs c541a313a0492231a3_wmiprvse.exe
Source: c541a313a0492231a3_wmiprvse.exeBinary or memory string: OriginalFilenameWmiprvse.exej% vs c541a313a0492231a3_wmiprvse.exe
Source: classification engineClassification label: clean5.winEXE@1/0@0/0
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: WmiPrvSE.pdbUGP source: c541a313a0492231a3_wmiprvse.exe
Source: Binary string: WmiPrvSE.pdb source: c541a313a0492231a3_wmiprvse.exe
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: c541a313a0492231a3_wmiprvse.exeStatic PE information: section name: .didat
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE698490 NtQuerySystemInformation,GetCurrentProcessId,char_traits,0_2_00007FF6EE698490
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeAPI coverage: 5.8 %
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE69F260 DelayLoadFailureHook,LdrResolveDelayLoadedAPI,0_2_00007FF6EE69F260
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE698490 NtQuerySystemInformation,GetCurrentProcessId,char_traits,0_2_00007FF6EE698490
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE699E60 EtwEventUnregister,GetProcessHeap,HeapDestroy,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,0_2_00007FF6EE699E60
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6A2CC0 SetUnhandledExceptionFilter,0_2_00007FF6EE6A2CC0
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6A293C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF6EE6A293C
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE69C334 InitializeSecurityDescriptor,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,FreeSid,RtlLengthSid,LocalAlloc,RtlCreateAcl,RtlAddAccessAllowedAce,LocalFree,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,SetSecurityDescriptorDacl,LocalFree,FreeSid,FreeSid,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetLastError,GetLastError,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,RtlNtStatusToDosError,LocalFree,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,RtlNtStatusToDosError,LocalFree,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,LocalFree,FreeSid,FreeSid,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,0_2_00007FF6EE69C334
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE69C334 InitializeSecurityDescriptor,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,FreeSid,RtlLengthSid,LocalAlloc,RtlCreateAcl,RtlAddAccessAllowedAce,LocalFree,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,SetSecurityDescriptorDacl,LocalFree,FreeSid,FreeSid,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetLastError,GetLastError,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,RtlNtStatusToDosError,LocalFree,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,RtlNtStatusToDosError,LocalFree,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetLastError,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,LocalFree,FreeSid,FreeSid,GetMemLogObject,?Write@CMemoryLog@@QEAAXJ@Z,0_2_00007FF6EE69C334
Source: C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exeCode function: 0_2_00007FF6EE6A2E94 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,0_2_00007FF6EE6A2E94

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential DumpingSystem Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemorySecurity Software Discovery2Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Information Discovery2Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
c541a313a0492231a3_wmiprvse.exe0%VirustotalBrowse
c541a313a0492231a3_wmiprvse.exe0%MetadefenderBrowse
c541a313a0492231a3_wmiprvse.exe0%ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:31.0.0 Red Diamond
Analysis ID:328714
Start date:09.12.2020
Start time:16:20:11
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 14m 14s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:c541a313a0492231a3_wmiprvse.exe
Cookbook file name:default.jbs
Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:29
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:CLEAN
Classification:clean5.winEXE@1/0@0/0
EGA Information:
  • Successful, ratio: 100%
HDC Information:
  • Successful, ratio: 75.6% (good quality ratio 34.7%)
  • Quality average: 29.8%
  • Quality standard deviation: 38.6%
HCA Information:Failed
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Found application associated with file extension: .exe
Warnings:
Show All
  • Max analysis timeout: 720s exceeded, the analysis took too long
  • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General

File type:PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):6.2141826593596825
TrID:
  • Win64 Executable GUI (202006/5) 92.65%
  • Win64 Executable (generic) (12005/4) 5.51%
  • Generic Win/DOS Executable (2004/3) 0.92%
  • DOS Executable Generic (2002/1) 0.92%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:c541a313a0492231a3_wmiprvse.exe
File size:496640
MD5:60ff40cfd7fb8fe41ee4fe9ae5fe1c51
SHA1:3ea7cc066317ac45f963c2227c4c7c50aa16eb7c
SHA256:2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3
SHA512:991e38e2b480ffc58ec5ade9dcc8747a57b29fbc9b12397a8010e73143c4dfb420e5248a0c3acf0832812c0e804080ed5a83952b9c05419d93763372ece775c3
SSDEEP:12288:ahBzXzR4mnIu0CWQjONc3XmvzjnyBEIl/t8:qumnGDjnyBll/
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.8.X.k.X.k.X.k. .k.X.k.3.j.X.k.3.j.X.k.X.k.Y.k.3.j.X.k.3.j.X.k.3.j.X.k.3wk.X.k.3.j.X.kRich.X.k........................PE..d..

File Icon

Icon Hash:a4e0a6beb8aea0a0

Static PE Info

General

Entrypoint:0x140012580
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x140000000
Subsystem:windows gui
Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:0x5DA7AB91 [Wed Oct 16 23:45:21 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:10
OS Version Minor:0
File Version Major:10
File Version Minor:0
Subsystem Version Major:10
Subsystem Version Minor:0
Import Hash:b71cb3ac5c352bec857c940cbc95f0f3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F0828F0D950h
dec eax
add esp, 28h
jmp 00007F0828F0D04Bh
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], edi
inc ecx
push esi
dec eax
sub esp, 000000B0h
and dword ptr [esp+20h], 00000000h
dec eax
lea ecx, dword ptr [esp+40h]
call dword ptr [00039F7Dh]
nop
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ebx, dword ptr [eax+08h]
xor edi, edi
xor eax, eax
dec eax
cmpxchg dword ptr [00054AD2h], ebx
je 00007F0828F0D04Ch
dec eax
cmp eax, ebx
jne 00007F0828F0D05Ch
mov edi, 00000001h
mov eax, dword ptr [00054AC8h]
cmp eax, 01h
jne 00007F0828F0D059h
lea ecx, dword ptr [eax+1Eh]
call 00007F0828F0D7E3h
jmp 00007F0828F0D0BCh
mov ecx, 000003E8h
call dword ptr [0003A006h]
jmp 00007F0828F0D009h
mov eax, dword ptr [00054AA6h]
test eax, eax
jne 00007F0828F0D09Bh
mov dword ptr [00054A98h], 00000001h
dec esp
lea esi, dword ptr [0003A359h]
dec eax
lea ebx, dword ptr [0003A33Ah]
dec eax
mov dword ptr [esp+30h], ebx
mov dword ptr [esp+24h], eax
dec ecx
cmp ebx, esi
jnc 00007F0828F0D067h
test eax, eax
jne 00007F0828F0D067h
dec eax
cmp dword ptr [ebx], 00000000h
je 00007F0828F0D052h
dec eax
mov eax, dword ptr [ebx]
dec eax
mov ecx, dword ptr [0003A2B0h]

Rich Headers

Programming Language:
  • [IMP] VS2008 SP1 build 30729

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x634200x21c.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x6d0000xfa48.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x680000x36cc.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x7d0000xd00.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x51e800x54.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x4af700x118.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x4c3580x598.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x62bbc0x1a0.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x4711c0x47200False0.406775181239data6.24353319739IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata0x490000x1bc4c0x1be00False0.296559697309data4.38560302658IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data0x650000x25880x1c00False0.1787109375data4.17250851172IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata0x680000x36cc0x3800False0.505929129464data5.64407195399IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat0x6c0000x1d80x200False0.3125data2.60351504795IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc0x6d0000xfa480xfc00False0.70372953869data6.8321114608IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc0x7d0000xd000xe00False0.344308035714data5.31711045203IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

NameRVASizeTypeLanguageCountry
RT_ICON0x6d9c00x668dataEnglishUnited States
RT_ICON0x6e0280x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2298443911, next used block 8849520EnglishUnited States
RT_ICON0x6e3100x1e8dataEnglishUnited States
RT_ICON0x6e4f80x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x6e6200xea8dataEnglishUnited States
RT_ICON0x6f4c80x8a8dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0EnglishUnited States
RT_ICON0x6fd700x6c8dataEnglishUnited States
RT_ICON0x704380x568GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x709a00x7ba8PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States
RT_ICON0x785480x25a8dataEnglishUnited States
RT_ICON0x7aaf00x10a8dataEnglishUnited States
RT_ICON0x7bb980x988dataEnglishUnited States
RT_ICON0x7c5200x468GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_GROUP_ICON0x7c9880xbcdataEnglishUnited States
RT_VERSION0x6d6280x398dataEnglishUnited States
RT_MANIFEST0x6d3900x296XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States

Imports

DLLImport
msvcrt.dll_cexit, _exit, _ismbblead, __set_app_type, memcmp, __setusermatherr, _initterm, _acmdln, __getmainargs, _onexit, __dllonexit, _amsg_exit, _fmode, _XcptFilter, ??8type_info@@QEBAHAEBV0@@Z, ?what@exception@@UEBAPEBDXZ, ??1exception@@UEAA@XZ, ??0exception@@QEAA@AEBV0@@Z, ??0exception@@QEAA@AEBQEBDH@Z, __CxxFrameHandler3, _unlock, _lock, ??1type_info@@UEAA@XZ, ?terminate@@YAXXZ, ??0exception@@QEAA@AEBQEBD@Z, memmove, memcpy, _commode, _CxxThrowException, __C_specific_handler, _purecall, _itow, wcstok, _vsnwprintf, exit, memset
ntdll.dllRtlNtStatusToDosError, RtlAddAccessAllowedAce, RtlLengthSid, EtwGetTraceLoggerHandle, EtwGetTraceEnableLevel, EtwGetTraceEnableFlags, NtQuerySystemInformation, RtlCreateAcl, EtwRegisterTraceGuidsW, EtwUnregisterTraceGuids, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, EtwTraceMessage
api-ms-win-core-synch-l1-1-0.dllSetEvent, EnterCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, CreateEventW, WaitForSingleObject, LeaveCriticalSection, WaitForMultipleObjectsEx
api-ms-win-core-heap-l2-1-0.dllLocalAlloc, LocalFree
api-ms-win-security-base-l1-1-0.dllMakeSelfRelativeSD, GetSecurityDescriptorLength, AddAce, MakeAbsoluteSD, CopySid, GetLengthSid, InitializeSecurityDescriptor, AccessCheck, MapGenericMask, AllocateAndInitializeSid, FreeSid, GetTokenInformation, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, InitializeAcl, SetSecurityDescriptorDacl, GetAclInformation, RevertToSelf, ImpersonateLoggedOnUser
api-ms-win-core-errorhandling-l1-1-0.dllGetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0.dllFreeLibrary, GetModuleHandleExW, GetProcAddress, GetModuleFileNameW, GetModuleHandleW
api-ms-win-core-handle-l1-1-0.dllDuplicateHandle, CloseHandle
api-ms-win-core-processthreads-l1-1-0.dllGetCurrentThreadId, GetCurrentThread, TlsFree, CreateThread, OpenThreadToken, SetThreadToken, GetCurrentProcess, SwitchToThread, TlsAlloc, GetStartupInfoW, TerminateProcess, GetCurrentProcessId, OpenProcessToken
api-ms-win-core-processenvironment-l1-1-0.dllGetCommandLineW
api-ms-win-core-string-l1-1-0.dllCompareStringW, GetStringTypeExW
api-ms-win-core-heap-l1-1-0.dllGetProcessHeap, HeapAlloc, HeapFree, HeapCreate, HeapDestroy, HeapSetInformation
api-ms-win-core-registry-l1-1-0.dllRegCloseKey, RegSetValueExW, RegQueryValueExW, RegDeleteKeyExW, RegCreateKeyExW, RegOpenKeyExW
api-ms-win-eventing-provider-l1-1-0.dllEventRegister, EventWrite, EventUnregister
api-ms-win-core-synch-l1-2-0.dllSleep
api-ms-win-core-memory-l1-1-0.dllMapViewOfFile, CreateFileMappingW, OpenFileMappingW, UnmapViewOfFile
api-ms-win-core-sysinfo-l1-1-0.dllGetSystemTimeAsFileTime, GetTickCount
api-ms-win-core-localization-l1-2-0.dllLCMapStringW
api-ms-win-core-threadpool-legacy-l1-1-0.dllChangeTimerQueueTimer
api-ms-win-core-profile-l1-1-0.dllQueryPerformanceCounter
api-ms-win-core-apiquery-l1-1-0.dllApiSetQueryApiSetPresence
FastProx.dll?Release@CWbemCallSecurity@@UEAAKXZ, ?QueryInterface@CWbemCallSecurity@@UEAAJAEBU_GUID@@PEAPEAX@Z, ?SetThreadSecurity@CWbemCallSecurity@@UEAAJPEAU_IWmiThreadSecHandle@@@Z, ?GetThreadSecurity@CWbemCallSecurity@@UEAAJW4tag_WMI_THREAD_SECURITY_ORIGIN@@PEAPEAU_IWmiThreadSecHandle@@@Z, ?AddRef@CWbemCallSecurity@@UEAAKXZ, ?New@CWbemCallSecurity@@SAPEAV1@XZ
NCObjAPI.DLLWmiCreateObjectWithFormat, WmiDestroyObject, WmiEventSourceDisconnect, WmiSetAndCommitObject, WmiEventSourceConnect
wbemcomn.dllBreakOnDbgAndRenterLoop, GetMemLogObject, ?Write@CMemoryLog@@QEAAXJ@Z, _ThrowMemoryException_, ?GetPreferredLanguages@CMUILocale@@SAJKPEAPEAGPEAK@Z, ?_Free@CMUILocale@@SAHPEAX@Z, ?SetPreferredLanguages@CMUILocale@@SAJKPEBGPEAK@Z, ?PublishProviderStarted@CPublishWMIOperationEvent@@SAJPEAGJ0K0@Z, ?Init@CPublishWMIOperationEvent@@SAJXZ
api-ms-win-core-delayload-l1-1-1.dllResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0.dllDelayLoadFailureHook

Version Infos

DescriptionData
LegalCopyright Microsoft Corporation. All rights reserved.
InternalNameWmiprvse.exe
FileVersion10.0.19041.546 (WinBuild.160101.0800)
CompanyNameMicrosoft Corporation
ProductNameMicrosoft Windows Operating System
ProductVersion10.0.19041.546
FileDescriptionWMI Provider Host
OriginalFilenameWmiprvse.exe
Translation0x0409 0x04b0

Possible Origin

Language of compilation systemCountry where language is spokenMap
EnglishUnited States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: c541a313a0492231a3_wmiprvse.exe PID: 6960 Parent PID: 5704

General

Start time:16:21:02
Start date:09/12/2020
Path:C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exe
Wow64 process (32bit):false
Commandline:'C:\Users\user\Desktop\c541a313a0492231a3_wmiprvse.exe'
Imagebase:0x7ff6ee690000
File size:496640 bytes
MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low

Chronological Activities

Disassembly

Code Analysis

Reset < >

    Analysis Process: c541a313a0492231a3_wmiprvse.exe PID: 6960 Parent PID: 5704 c541a313a0492231a3_wmiprvse.exeCOMMON

    Execution Graph

    Execution Coverage:3.3%
    Dynamic/Decrypted Code Coverage:0%
    Signature Coverage:24.1%
    Total number of Nodes:630
    Total number of Limit Nodes:15

    Graph

    execution_graph 21002 7ff6ee69f110 21003 7ff6ee69f136 PostMessageW 21002->21003 21004 7ff6ee69f11d NtdllDefWindowProc_W 21002->21004 21005 7ff6ee69f12c 21003->21005 21004->21005 21015 7ff6ee6a2fa6 21016 7ff6ee6a2fb2 21015->21016 21019 7ff6ee69f260 LdrResolveDelayLoadedAPI 21016->21019 21018 7ff6ee6a2ff1 21019->21018 21030 7ff6ee69b120 21031 7ff6ee69b17f 21030->21031 21032 7ff6ee69b134 21030->21032 21033 7ff6ee69b145 SetEvent 21032->21033 21034 7ff6ee69b15d 21032->21034 21037 7ff6ee69a940 21033->21037 21066 7ff6ee69ce60 21034->21066 21059 7ff6ee69a980 21037->21059 21039 7ff6ee69aaa9 21152 7ff6ee69a230 HeapFree GetLastError 21039->21152 21041 7ff6ee69aab2 21041->21034 21042 7ff6ee69a9d3 LeaveCriticalSection 21042->21059 21043 7ff6ee69a690 HeapAlloc HeapAlloc HeapAlloc GetLastError 21060 7ff6ee69aba3 21043->21060 21044 7ff6ee6aba61 Sleep 21153 7ff6ee69d350 EnterCriticalSection 21044->21153 21045 7ff6ee69d350 EnterCriticalSection 21045->21059 21047 7ff6ee69aa77 LeaveCriticalSection 21047->21059 21048 7ff6ee69aa28 LeaveCriticalSection 21048->21059 21049 7ff6ee6abad1 Sleep 21154 7ff6ee69d350 EnterCriticalSection 21049->21154 21052 7ff6ee6abc52 Sleep 21156 7ff6ee69d350 EnterCriticalSection 21052->21156 21054 7ff6ee6aed84 HeapFree GetLastError 21054->21059 21056 7ff6ee69fa20 LeaveCriticalSection 21056->21059 21057 7ff6ee69ab41 LeaveCriticalSection 21057->21059 21058 7ff6ee69a39c Sleep EnterCriticalSection 21058->21059 21059->21039 21059->21042 21059->21044 21059->21045 21059->21047 21059->21048 21059->21049 21059->21052 21059->21054 21059->21056 21059->21057 21059->21058 21059->21060 21061 7ff6ee6abbed Sleep 21059->21061 21062 7ff6ee69abd4 SetEvent 21059->21062 21063 7ff6ee69abc4 LeaveCriticalSection 21059->21063 21076 7ff6ee69a8a8 21059->21076 21115 7ff6ee69ac50 21059->21115 21143 7ff6ee69a5e0 21059->21143 21149 7ff6ee69cf00 21059->21149 21060->21043 21060->21044 21060->21049 21060->21052 21060->21059 21060->21061 21155 7ff6ee69d350 EnterCriticalSection 21061->21155 21062->21059 21063->21062 21067 7ff6ee69ce76 21066->21067 21074 7ff6ee69ceb6 21066->21074 21068 7ff6ee69a39c 2 API calls 21067->21068 21069 7ff6ee69ce85 21068->21069 21240 7ff6ee69cc74 21069->21240 21071 7ff6ee69ce91 21072 7ff6ee69fa20 LeaveCriticalSection 21071->21072 21073 7ff6ee69ce9d 21072->21073 21073->21074 21245 7ff6ee69d040 21073->21245 21074->21031 21077 7ff6ee69a8e7 21076->21077 21078 7ff6ee69a8d7 21076->21078 21081 7ff6ee69a901 21077->21081 21086 7ff6ee6ab910 21077->21086 21157 7ff6ee69d350 EnterCriticalSection 21078->21157 21080 7ff6ee69a8df 21080->21077 21087 7ff6ee6ab8ee Sleep 21080->21087 21158 7ff6ee69d350 EnterCriticalSection 21080->21158 21082 7ff6ee69a907 LeaveCriticalSection 21081->21082 21083 7ff6ee69a916 21081->21083 21082->21083 21083->21059 21085 7ff6ee6aba44 21089 7ff6ee69fa20 LeaveCriticalSection 21085->21089 21086->21085 21159 7ff6ee69fa20 21086->21159 21087->21080 21091 7ff6ee6aba49 21089->21091 21092 7ff6ee6ab98f 21094 7ff6ee69a39c 2 API calls 21092->21094 21093 7ff6ee6ab934 21097 7ff6ee6ab98d 21093->21097 21162 7ff6ee69a39c 21093->21162 21095 7ff6ee6ab9a3 21094->21095 21170 7ff6ee6aed84 HeapFree GetLastError 21095->21170 21100 7ff6ee69a39c 2 API calls 21097->21100 21098 7ff6ee6ab9ac 21101 7ff6ee69fa20 LeaveCriticalSection 21098->21101 21103 7ff6ee6ab9ed 21100->21103 21101->21097 21102 7ff6ee6ab966 21169 7ff6ee6aed84 HeapFree GetLastError 21102->21169 21105 7ff6ee6ab9fe 21103->21105 21107 7ff6ee6aba26 21103->21107 21171 7ff6ee69a690 HeapAlloc HeapAlloc HeapAlloc GetLastError _Ref_count 21105->21171 21106 7ff6ee6ab96f 21109 7ff6ee6ab980 21106->21109 21113 7ff6ee69fa20 LeaveCriticalSection 21106->21113 21112 7ff6ee69fa20 LeaveCriticalSection 21107->21112 21110 7ff6ee69fa20 LeaveCriticalSection 21109->21110 21110->21097 21111 7ff6ee6aba24 21111->21107 21114 7ff6ee6aba2e SetEvent 21112->21114 21113->21109 21114->21085 21116 7ff6ee69ac9a 21115->21116 21121 7ff6ee69acab 21115->21121 21187 7ff6ee69d350 EnterCriticalSection 21116->21187 21118 7ff6ee69aca3 21118->21121 21196 7ff6ee69d350 EnterCriticalSection 21118->21196 21120 7ff6ee69ad2d LeaveCriticalSection 21137 7ff6ee69ad3d 21120->21137 21121->21120 21121->21137 21122 7ff6ee6abcc5 21122->21121 21123 7ff6ee6abccd Sleep 21122->21123 21197 7ff6ee69d350 EnterCriticalSection 21123->21197 21125 7ff6ee6abce7 21125->21123 21129 7ff6ee6abceb 21125->21129 21126 7ff6ee69ad52 MsgWaitForMultipleObjectsEx 21126->21137 21127 7ff6ee69ad8b 21188 7ff6ee6a2800 21127->21188 21128 7ff6ee6abd1c GetLastError 21131 7ff6ee6abd47 Sleep 21128->21131 21128->21137 21129->21121 21131->21137 21133 7ff6ee6abdf2 WaitForMultipleObjectsEx 21133->21137 21134 7ff6ee6abd66 PeekMessageW 21134->21133 21135 7ff6ee6abd8c GetMessageW 21134->21135 21138 7ff6ee6abdcc PeekMessageW 21135->21138 21139 7ff6ee6abdaa TranslateMessage DispatchMessageW 21135->21139 21136 7ff6ee69adfe 21136->21137 21140 7ff6ee69a3e0 12 API calls 21136->21140 21137->21126 21137->21127 21137->21128 21137->21133 21137->21134 21137->21136 21141 7ff6ee6abe5c GetLastError 21137->21141 21174 7ff6ee699cc0 21137->21174 21138->21133 21138->21135 21139->21138 21140->21136 21141->21131 21141->21137 21144 7ff6ee69a60c 21143->21144 21148 7ff6ee6ab776 21143->21148 21145 7ff6ee69a639 HeapFree 21144->21145 21147 7ff6ee69a652 21144->21147 21144->21148 21145->21147 21145->21148 21147->21059 21239 7ff6ee6cfef4 GetLastError 21148->21239 21150 7ff6ee699d18 2 API calls 21149->21150 21151 7ff6ee69cf09 21150->21151 21151->21059 21152->21041 21153->21060 21154->21060 21155->21060 21156->21060 21157->21080 21158->21080 21160 7ff6ee69fa38 21159->21160 21161 7ff6ee69fa2a LeaveCriticalSection 21159->21161 21160->21092 21160->21093 21161->21160 21163 7ff6ee69a3b1 21162->21163 21167 7ff6ee69a3be 21162->21167 21172 7ff6ee69d350 EnterCriticalSection 21163->21172 21165 7ff6ee69a3b6 21165->21167 21168 7ff6ee6ab6b6 Sleep 21165->21168 21173 7ff6ee69d350 EnterCriticalSection 21165->21173 21167->21102 21167->21167 21168->21165 21169->21106 21170->21098 21171->21111 21172->21165 21173->21165 21198 7ff6ee698490 21174->21198 21177 7ff6ee6ab3f4 21223 7ff6ee698440 21177->21223 21178 7ff6ee699ce7 21218 7ff6ee699d18 21178->21218 21180 7ff6ee699cec 21180->21137 21182 7ff6ee6ab4d9 21183 7ff6ee6ab4f1 GetCurrentProcess TerminateProcess 21182->21183 21184 7ff6ee6ab4ca 21228 7ff6ee6985e0 21184->21228 21186 7ff6ee6ab429 21186->21182 21186->21184 21187->21118 21189 7ff6ee6a2809 21188->21189 21190 7ff6ee69ada5 21189->21190 21191 7ff6ee6a2980 RtlCaptureContext RtlLookupFunctionEntry 21189->21191 21190->21059 21192 7ff6ee6a29c5 RtlVirtualUnwind 21191->21192 21193 7ff6ee6a2a07 21191->21193 21192->21193 21238 7ff6ee6a293c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 21193->21238 21196->21122 21197->21125 21199 7ff6ee698440 2 API calls 21198->21199 21209 7ff6ee6984cc 21199->21209 21200 7ff6ee6984d8 NtQuerySystemInformation 21202 7ff6ee6984fb 21200->21202 21200->21209 21201 7ff6ee69853d 21203 7ff6ee6a2800 7 API calls 21201->21203 21205 7ff6ee6a9a32 21202->21205 21215 7ff6ee698503 char_traits 21202->21215 21208 7ff6ee69854d 21203->21208 21204 7ff6ee6985e0 2 API calls 21204->21209 21207 7ff6ee6985e0 2 API calls 21205->21207 21206 7ff6ee698510 GetCurrentProcessId 21206->21215 21207->21201 21208->21177 21208->21178 21209->21200 21209->21201 21209->21204 21210 7ff6ee698440 2 API calls 21209->21210 21210->21209 21211 7ff6ee69852e 21212 7ff6ee6985e0 2 API calls 21211->21212 21212->21201 21215->21206 21215->21211 21216 7ff6ee6afa94 12 API calls 21215->21216 21233 7ff6ee6b0d94 12 API calls 21215->21233 21234 7ff6ee6af324 22 API calls char_traits 21215->21234 21235 7ff6ee6b0894 HeapFree memmove GetLastError 21215->21235 21216->21215 21220 7ff6ee699d26 21218->21220 21219 7ff6ee699d33 21219->21180 21220->21219 21221 7ff6ee699d61 PostMessageW 21220->21221 21221->21219 21222 7ff6ee699d8f SetEvent 21221->21222 21224 7ff6ee69847a 21223->21224 21225 7ff6ee698462 RtlAllocateHeap 21223->21225 21224->21186 21225->21224 21226 7ff6ee6a9a1c 21225->21226 21236 7ff6ee6cfef4 GetLastError 21226->21236 21229 7ff6ee6985f1 HeapFree 21228->21229 21230 7ff6ee698606 21228->21230 21229->21230 21231 7ff6ee69860f 21229->21231 21230->21182 21237 7ff6ee6cfef4 GetLastError 21231->21237 21233->21215 21234->21215 21235->21215 21236->21224 21237->21230 21239->21147 21241 7ff6ee69cc85 21240->21241 21242 7ff6ee6985e0 2 API calls 21241->21242 21244 7ff6ee69ccad 21241->21244 21243 7ff6ee69cd05 21242->21243 21243->21071 21244->21071 21250 7ff6ee69a164 21245->21250 21248 7ff6ee69d07d 21248->21074 21249 7ff6ee6985e0 2 API calls 21249->21248 21251 7ff6ee6ab62e 21250->21251 21252 7ff6ee69a18d 21250->21252 21255 7ff6ee6985e0 2 API calls 21251->21255 21253 7ff6ee69a1a3 21252->21253 21254 7ff6ee69a196 FindCloseChangeNotification 21252->21254 21256 7ff6ee69a1b9 21253->21256 21257 7ff6ee69a1ac CloseHandle 21253->21257 21254->21253 21258 7ff6ee6ab637 21255->21258 21259 7ff6ee69a1cf 21256->21259 21260 7ff6ee69a1c2 CloseHandle 21256->21260 21257->21256 21261 7ff6ee69a1e5 21259->21261 21262 7ff6ee69a1d8 CloseHandle 21259->21262 21260->21259 21271 7ff6ee69a230 HeapFree GetLastError 21261->21271 21262->21261 21264 7ff6ee69a1f1 21272 7ff6ee69a230 HeapFree GetLastError 21264->21272 21266 7ff6ee69a1fe 21273 7ff6ee69a230 HeapFree GetLastError 21266->21273 21268 7ff6ee69a20b 21269 7ff6ee69a223 21268->21269 21270 7ff6ee69a216 DeleteCriticalSection 21268->21270 21269->21248 21269->21249 21270->21269 21271->21264 21272->21266 21273->21268 21274 7ff6ee6a2580 21295 7ff6ee6a2e94 21274->21295 21278 7ff6ee6a25cb 21279 7ff6ee6a25dd 21278->21279 21280 7ff6ee6a25f7 Sleep 21278->21280 21281 7ff6ee6a25ed _amsg_exit 21279->21281 21284 7ff6ee6a2604 21279->21284 21280->21278 21282 7ff6ee6a2659 21281->21282 21283 7ff6ee6a267c _initterm 21282->21283 21285 7ff6ee6a2699 _IsNonwritableInCurrentImage 21282->21285 21292 7ff6ee6a265d 21282->21292 21283->21285 21284->21282 21284->21292 21299 7ff6ee6a2cc0 SetUnhandledExceptionFilter 21284->21299 21286 7ff6ee6a2778 _ismbblead 21285->21286 21287 7ff6ee6a26fd 21285->21287 21285->21292 21286->21285 21300 7ff6ee69c69c HeapSetInformation 21287->21300 21290 7ff6ee6a274f 21290->21292 21293 7ff6ee6a2758 _cexit 21290->21293 21291 7ff6ee6a2747 exit 21291->21290 21293->21292 21296 7ff6ee6a2ec0 6 API calls 21295->21296 21297 7ff6ee6a2589 GetStartupInfoW 21295->21297 21298 7ff6ee6a2f3f 21296->21298 21297->21278 21298->21297 21299->21284 21317 7ff6ee69c808 21300->21317 21305 7ff6ee69c7b1 21307 7ff6ee69c7e7 21305->21307 21309 7ff6ee69c7d2 EtwUnregisterTraceGuids 21305->21309 21307->21290 21307->21291 21308 7ff6ee69c7ac 21443 7ff6ee699e60 21308->21443 21309->21305 21311 7ff6ee69c74d 21311->21308 21314 7ff6ee69c762 21311->21314 21390 7ff6ee69c890 7 API calls 21311->21390 21315 7ff6ee69c77a 21314->21315 21393 7ff6ee69b4d0 21314->21393 21315->21308 21316 7ff6ee69c783 DestroyWindow UnregisterClassW 21315->21316 21316->21308 21318 7ff6ee69c876 21317->21318 21319 7ff6ee69c822 EtwRegisterTraceGuidsW 21318->21319 21320 7ff6ee69c72a RegDisablePredefinedCache 21318->21320 21319->21318 21321 7ff6ee697c2c 21320->21321 21322 7ff6ee697c63 21321->21322 21323 7ff6ee697ce4 21321->21323 21494 7ff6ee699af0 GetProcessHeap 21322->21494 21324 7ff6ee69800e 21323->21324 21328 7ff6ee698440 2 API calls 21323->21328 21366 7ff6ee697f9b 21323->21366 21486 7ff6ee69f978 RegOpenKeyExW 21324->21486 21327 7ff6ee697c6c 21330 7ff6ee697c85 HeapAlloc 21327->21330 21331 7ff6ee6a972c 21327->21331 21332 7ff6ee697d16 21328->21332 21334 7ff6ee6a9724 21330->21334 21335 7ff6ee697ca8 21330->21335 21337 7ff6ee6a9771 21331->21337 21338 7ff6ee697cb0 21331->21338 21332->21324 21342 7ff6ee697d50 EventRegister 21332->21342 21332->21366 21503 7ff6ee6cfef4 GetLastError 21334->21503 21495 7ff6ee699af0 GetProcessHeap 21335->21495 21344 7ff6ee6a9779 HeapDestroy 21337->21344 21338->21331 21343 7ff6ee6a9741 HeapCreate 21338->21343 21346 7ff6ee697cc3 21338->21346 21341 7ff6ee6a98ad GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21351 7ff6ee698026 21341->21351 21342->21324 21347 7ff6ee697d79 21342->21347 21343->21346 21348 7ff6ee6a9765 21343->21348 21344->21323 21349 7ff6ee6a9796 21344->21349 21345 7ff6ee698043 21345->21305 21377 7ff6ee69c9dc GetCommandLineW 21345->21377 21346->21323 21350 7ff6ee697ccf GetProcessHeap 21346->21350 21353 7ff6ee698440 2 API calls 21347->21353 21504 7ff6ee6cfef4 GetLastError 21348->21504 21505 7ff6ee6cfef4 GetLastError 21349->21505 21350->21323 21350->21344 21351->21345 21506 7ff6ee6b11f0 EtwTraceMessage 21351->21506 21356 7ff6ee697d85 21353->21356 21356->21366 21496 7ff6ee69ba90 InitializeCriticalSectionAndSpinCount _ThrowMemoryException_ 21356->21496 21357 7ff6ee6a976a 21357->21346 21359 7ff6ee697da2 21359->21324 21360 7ff6ee698440 2 API calls 21359->21360 21359->21366 21361 7ff6ee697df4 21360->21361 21361->21366 21497 7ff6ee69badc InitializeCriticalSectionAndSpinCount _ThrowMemoryException_ 21361->21497 21363 7ff6ee697e11 21363->21324 21364 7ff6ee698440 2 API calls 21363->21364 21363->21366 21365 7ff6ee697e5d 21364->21365 21365->21366 21498 7ff6ee69bb28 InitializeCriticalSectionAndSpinCount _ThrowMemoryException_ 21365->21498 21366->21324 21468 7ff6ee69f3e8 21366->21468 21369 7ff6ee697e73 21369->21324 21369->21366 21370 7ff6ee698440 2 API calls 21369->21370 21371 7ff6ee697ec1 21370->21371 21371->21366 21499 7ff6ee69bb78 InitializeCriticalSectionAndSpinCount 21371->21499 21374 7ff6ee698440 2 API calls 21375 7ff6ee697f6c 21374->21375 21375->21366 21376 7ff6ee69bb78 2 API calls 21375->21376 21376->21366 21378 7ff6ee69ca11 wcstok wcstok 21377->21378 21389 7ff6ee69cb03 21377->21389 21379 7ff6ee69ca48 21378->21379 21378->21389 21380 7ff6ee69ca4f CompareStringW 21379->21380 21381 7ff6ee69ca82 CompareStringW 21380->21381 21382 7ff6ee6ac936 21380->21382 21383 7ff6ee69cb21 21381->21383 21384 7ff6ee69cab1 CompareStringW 21381->21384 21510 7ff6ee6b1cf0 72 API calls 21382->21510 21509 7ff6ee6b1dc0 15 API calls 21383->21509 21386 7ff6ee69cae0 21384->21386 21387 7ff6ee69cae2 wcstok 21384->21387 21386->21387 21387->21380 21387->21389 21389->21311 21391 7ff6ee69c9c0 21390->21391 21392 7ff6ee69c9a9 DeleteMenu 21390->21392 21391->21314 21392->21391 21511 7ff6ee69c334 21393->21511 21396 7ff6ee6ac0f0 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21399 7ff6ee69b85f 21396->21399 21401 7ff6ee69b87c 21399->21401 21717 7ff6ee6b11f0 EtwTraceMessage 21399->21717 21401->21315 21404 7ff6ee69b83f 21703 7ff6ee69d208 21404->21703 21407 7ff6ee69b525 21407->21404 21409 7ff6ee69b6d2 21407->21409 21410 7ff6ee69b562 SysAllocString 21407->21410 21408 7ff6ee69b844 21408->21396 21408->21399 21411 7ff6ee698440 2 API calls 21409->21411 21410->21409 21417 7ff6ee69b585 21410->21417 21412 7ff6ee69b6ed 21411->21412 21413 7ff6ee6ac0cc 21412->21413 21664 7ff6ee69b8fc 21412->21664 21418 7ff6ee6ac0d4 WaitForSingleObject 21413->21418 21415 7ff6ee69b6c3 SysFreeString 21415->21409 21417->21415 21653 7ff6ee69da94 SysAllocString 21417->21653 21418->21396 21419 7ff6ee69b830 21714 7ff6ee69d300 GetModuleHandleExW GetProcAddress GetProcAddress FreeLibrary FreeLibrary 21419->21714 21423 7ff6ee69b835 21715 7ff6ee694220 HeapFree GetLastError 21423->21715 21427 7ff6ee69b83a 21716 7ff6ee69d278 WmiDestroyObject WmiEventSourceDisconnect EtwTraceMessage 21427->21716 21428 7ff6ee69b67e 21711 7ff6ee69bc08 SysFreeString SysFreeString 21428->21711 21433 7ff6ee69b798 GetCurrentProcess GetCurrentProcess DuplicateHandle 21435 7ff6ee69b801 WaitForSingleObject CloseHandle 21433->21435 21713 7ff6ee69b8a0 EtwTraceMessage 21435->21713 21436 7ff6ee69b77b 21436->21418 21438 7ff6ee69b78a 21436->21438 21439 7ff6ee69b793 21438->21439 21699 7ff6ee69bbb4 21438->21699 21712 7ff6ee69b8a0 EtwTraceMessage 21439->21712 21444 7ff6ee699e82 21443->21444 21449 7ff6ee699eab 21443->21449 21770 7ff6ee69d010 HeapFree GetLastError 21444->21770 21446 7ff6ee699e87 21446->21449 21771 7ff6ee69d010 HeapFree GetLastError 21446->21771 21448 7ff6ee699e9b 21450 7ff6ee6985e0 2 API calls 21448->21450 21754 7ff6ee699da8 21449->21754 21450->21449 21453 7ff6ee69a01e EtwEventUnregister 21454 7ff6ee69a02a 21453->21454 21458 7ff6ee69a081 21454->21458 21772 7ff6ee699af0 GetProcessHeap 21454->21772 21456 7ff6ee69a09e 21456->21305 21457 7ff6ee69a03e 21459 7ff6ee6985e0 2 API calls 21457->21459 21458->21456 21774 7ff6ee6b11f0 EtwTraceMessage 21458->21774 21461 7ff6ee69a050 21459->21461 21462 7ff6ee69a064 GetProcessHeap 21461->21462 21463 7ff6ee69a079 21461->21463 21462->21463 21464 7ff6ee6ab536 HeapDestroy 21462->21464 21463->21458 21465 7ff6ee6ab55f GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21463->21465 21464->21463 21466 7ff6ee6ab554 21464->21466 21465->21458 21773 7ff6ee6cfef4 GetLastError 21466->21773 21469 7ff6ee69f411 21468->21469 21483 7ff6ee69f4ba 21468->21483 21470 7ff6ee69f472 21469->21470 21471 7ff6ee69f43f HeapAlloc 21469->21471 21472 7ff6ee6ad8dd 21469->21472 21469->21483 21475 7ff6ee69f492 HeapAlloc 21470->21475 21482 7ff6ee69f4b2 21470->21482 21470->21483 21473 7ff6ee69f45f 21471->21473 21474 7ff6ee6ad8ca 21471->21474 21480 7ff6ee6985e0 2 API calls 21472->21480 21473->21472 21477 7ff6ee69f467 21473->21477 21507 7ff6ee6cfef4 GetLastError 21474->21507 21478 7ff6ee6ad8fc 21475->21478 21475->21482 21477->21470 21508 7ff6ee6cfef4 GetLastError 21478->21508 21479 7ff6ee6ad8cf 21479->21472 21480->21483 21482->21483 21485 7ff6ee6985e0 2 API calls 21482->21485 21483->21324 21484 7ff6ee6ad901 21484->21482 21485->21483 21487 7ff6ee69f9b7 RegQueryValueExW RegCloseKey 21486->21487 21488 7ff6ee698019 21486->21488 21487->21488 21489 7ff6ee69f884 RegOpenKeyExW 21488->21489 21490 7ff6ee69f8c3 RegQueryValueExW 21489->21490 21491 7ff6ee69801e 21489->21491 21492 7ff6ee69f913 RegCloseKey 21490->21492 21493 7ff6ee6adb72 21490->21493 21491->21341 21491->21351 21492->21491 21493->21492 21494->21327 21495->21338 21496->21359 21497->21363 21498->21369 21500 7ff6ee6ac164 21499->21500 21501 7ff6ee697ef0 21499->21501 21500->21501 21502 7ff6ee6ac16e _ThrowMemoryException_ 21500->21502 21501->21324 21501->21366 21501->21374 21502->21501 21503->21338 21504->21357 21505->21323 21506->21345 21507->21479 21508->21484 21509->21389 21510->21389 21512 7ff6ee69c378 21511->21512 21513 7ff6ee69c38f InitializeSecurityDescriptor 21512->21513 21519 7ff6ee69c5e4 21512->21519 21514 7ff6ee6ac322 GetLastError 21513->21514 21515 7ff6ee69c3cc AllocateAndInitializeSid 21513->21515 21522 7ff6ee6ac334 21514->21522 21516 7ff6ee69c417 AllocateAndInitializeSid 21515->21516 21517 7ff6ee6ac3ba 21515->21517 21520 7ff6ee6ac486 21516->21520 21521 7ff6ee69c47a RtlLengthSid LocalAlloc 21516->21521 21525 7ff6ee6ac3c1 GetLastError 21517->21525 21518 7ff6ee6ac91b 21519->21518 21532 7ff6ee69c647 21519->21532 21550 7ff6ee6ac8ee GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21519->21550 21529 7ff6ee6ac48d GetLastError 21520->21529 21523 7ff6ee69c4c0 RtlCreateAcl 21521->21523 21524 7ff6ee6ac558 21521->21524 21526 7ff6ee6ac34d GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21522->21526 21555 7ff6ee6ac36a 21522->21555 21527 7ff6ee6ac5c1 RtlNtStatusToDosError 21523->21527 21528 7ff6ee69c4dd RtlAddAccessAllowedAce 21523->21528 21535 7ff6ee6ac55f GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21524->21535 21530 7ff6ee6ac3db 21525->21530 21526->21555 21531 7ff6ee6ac5d5 21527->21531 21533 7ff6ee69c4fe SetSecurityDescriptorOwner 21528->21533 21534 7ff6ee6ac64f RtlNtStatusToDosError 21528->21534 21536 7ff6ee6ac4a8 21529->21536 21537 7ff6ee6ac3e4 GetLastError 21530->21537 21538 7ff6ee6ac418 21530->21538 21549 7ff6ee6ac5e5 LocalFree 21531->21549 21532->21518 21551 7ff6ee6a2800 7 API calls 21532->21551 21543 7ff6ee6ac6f0 GetLastError 21533->21543 21544 7ff6ee69c530 SetSecurityDescriptorGroup 21533->21544 21540 7ff6ee6ac663 21534->21540 21545 7ff6ee6ac8c9 FreeSid 21535->21545 21565 7ff6ee6ac59d 21535->21565 21541 7ff6ee6ac4b1 GetLastError 21536->21541 21542 7ff6ee6ac4e5 21536->21542 21546 7ff6ee6ac3f6 21537->21546 21547 7ff6ee6ac3fb GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21537->21547 21539 7ff6ee6ac468 GetLastError 21538->21539 21558 7ff6ee6ac437 GetLastError 21538->21558 21539->21532 21561 7ff6ee6ac673 LocalFree 21540->21561 21552 7ff6ee6ac4c3 21541->21552 21553 7ff6ee6ac4c8 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21541->21553 21554 7ff6ee6ac538 GetLastError 21542->21554 21570 7ff6ee6ac504 GetLastError 21542->21570 21571 7ff6ee6ac702 21543->21571 21556 7ff6ee69c54f SetSecurityDescriptorDacl 21544->21556 21557 7ff6ee6ac76d GetLastError 21544->21557 21548 7ff6ee6ac8d9 FreeSid 21545->21548 21546->21547 21547->21538 21548->21532 21559 7ff6ee6ac5fd GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21549->21559 21549->21565 21550->21532 21560 7ff6ee69b501 21551->21560 21552->21553 21553->21542 21554->21548 21562 7ff6ee6ac54e 21554->21562 21555->21532 21718 7ff6ee6b11f0 EtwTraceMessage 21555->21718 21563 7ff6ee69c56f 21556->21563 21564 7ff6ee6ac7ea GetLastError 21556->21564 21573 7ff6ee6ac77f 21557->21573 21566 7ff6ee6ac447 21558->21566 21559->21565 21560->21396 21588 7ff6ee69c260 OpenFileMappingW 21560->21588 21561->21565 21569 7ff6ee6ac68b GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21561->21569 21562->21548 21581 7ff6ee69c5b4 LocalFree FreeSid FreeSid 21563->21581 21582 7ff6ee6ac858 21563->21582 21568 7ff6ee6ac7fc 21564->21568 21565->21545 21721 7ff6ee6b11f0 EtwTraceMessage 21565->21721 21719 7ff6ee6b11f0 EtwTraceMessage 21566->21719 21583 7ff6ee6ac815 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21568->21583 21585 7ff6ee6ac738 21568->21585 21569->21565 21574 7ff6ee6ac514 21570->21574 21576 7ff6ee6ac71b GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21571->21576 21571->21585 21578 7ff6ee6ac798 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21573->21578 21573->21585 21720 7ff6ee6b11f0 EtwTraceMessage 21574->21720 21576->21585 21577 7ff6ee6ac8b9 LocalFree 21577->21545 21578->21585 21580 7ff6ee6ac6eb 21580->21545 21581->21519 21584 7ff6ee6ac85f GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21582->21584 21583->21585 21584->21577 21584->21585 21585->21577 21722 7ff6ee6b11f0 EtwTraceMessage 21585->21722 21587 7ff6ee6ac8b8 21587->21577 21589 7ff6ee6ac226 GetLastError 21588->21589 21590 7ff6ee69c2ad MapViewOfFile 21588->21590 21593 7ff6ee6ac2af 21589->21593 21594 7ff6ee6ac237 21589->21594 21591 7ff6ee6ac2b9 21590->21591 21592 7ff6ee69c2dd 21590->21592 21591->21592 21595 7ff6ee6ac2c2 CloseHandle 21591->21595 21597 7ff6ee6ac2d7 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21592->21597 21603 7ff6ee69c2f3 21592->21603 21593->21590 21593->21591 21723 7ff6ee6b34ec 36 API calls 21594->21723 21595->21592 21597->21603 21598 7ff6ee6ac241 21598->21597 21600 7ff6ee6ac24b CreateFileMappingW 21598->21600 21599 7ff6ee69b513 21606 7ff6ee69c174 WmiEventSourceConnect 21599->21606 21601 7ff6ee6ac2a0 21600->21601 21602 7ff6ee6ac2ac 21600->21602 21604 7ff6ee6985e0 2 API calls 21601->21604 21602->21593 21603->21599 21724 7ff6ee6b11f0 EtwTraceMessage 21603->21724 21604->21602 21607 7ff6ee6ac1d6 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21606->21607 21610 7ff6ee69c1d1 21606->21610 21609 7ff6ee69c224 21607->21609 21608 7ff6ee69c1e1 WmiCreateObjectWithFormat 21608->21607 21608->21610 21612 7ff6ee69b518 21609->21612 21725 7ff6ee6b11f0 EtwTraceMessage 21609->21725 21610->21608 21610->21609 21612->21404 21613 7ff6ee69bcd4 AllocateAndInitializeSid 21612->21613 21614 7ff6ee6ac1cc 21613->21614 21615 7ff6ee69bd5b GetLengthSid 21613->21615 21616 7ff6ee698440 2 API calls 21615->21616 21617 7ff6ee69bd7f 21616->21617 21617->21614 21618 7ff6ee69bd8f CopySid 21617->21618 21619 7ff6ee698440 2 API calls 21618->21619 21620 7ff6ee69bdca 21619->21620 21620->21614 21621 7ff6ee69bdda CopySid AllocateAndInitializeSid 21620->21621 21621->21614 21622 7ff6ee69be50 GetLengthSid 21621->21622 21623 7ff6ee698440 2 API calls 21622->21623 21624 7ff6ee69be74 21623->21624 21624->21614 21625 7ff6ee69be84 CopySid 21624->21625 21626 7ff6ee698440 2 API calls 21625->21626 21627 7ff6ee69bebf 21626->21627 21627->21614 21628 7ff6ee69becf CopySid AllocateAndInitializeSid 21627->21628 21628->21614 21629 7ff6ee69bf45 GetLengthSid 21628->21629 21630 7ff6ee698440 2 API calls 21629->21630 21631 7ff6ee69bf69 21630->21631 21631->21614 21632 7ff6ee69bf79 CopySid 21631->21632 21633 7ff6ee698440 2 API calls 21632->21633 21634 7ff6ee69bfb4 21633->21634 21634->21614 21635 7ff6ee69bfc4 CopySid AllocateAndInitializeSid 21634->21635 21635->21614 21636 7ff6ee69c03d GetLengthSid 21635->21636 21637 7ff6ee698440 2 API calls 21636->21637 21638 7ff6ee69c061 21637->21638 21638->21614 21639 7ff6ee69c071 CopySid 21638->21639 21640 7ff6ee698440 2 API calls 21639->21640 21641 7ff6ee69c0ac 21640->21641 21641->21614 21642 7ff6ee69c0bc CopySid 21641->21642 21643 7ff6ee69c105 21642->21643 21644 7ff6ee69c0f9 FreeSid 21642->21644 21645 7ff6ee69c10e FreeSid 21643->21645 21646 7ff6ee69c11a 21643->21646 21644->21643 21645->21646 21647 7ff6ee69c12f 21646->21647 21648 7ff6ee69c123 FreeSid 21646->21648 21649 7ff6ee69c144 21647->21649 21650 7ff6ee69c138 FreeSid 21647->21650 21648->21647 21651 7ff6ee6a2800 7 API calls 21649->21651 21650->21649 21652 7ff6ee69c152 21651->21652 21652->21407 21654 7ff6ee69daca 21653->21654 21655 7ff6ee69b615 21653->21655 21656 7ff6ee69db2c SysFreeString 21654->21656 21726 7ff6ee69dbec VariantInit 21654->21726 21655->21428 21710 7ff6ee691100 8 API calls 21655->21710 21656->21655 21658 7ff6ee69db43 SysAllocString 21656->21658 21658->21655 21660 7ff6ee69db62 21658->21660 21659 7ff6ee69db18 21659->21656 21661 7ff6ee69dbc4 SysFreeString 21660->21661 21662 7ff6ee69dbec 23 API calls 21660->21662 21661->21655 21663 7ff6ee69dbb0 21662->21663 21663->21661 21665 7ff6ee69bb78 2 API calls 21664->21665 21666 7ff6ee69b93e 21665->21666 21667 7ff6ee69b715 21666->21667 21668 7ff6ee69b9f3 CreateEventW 21666->21668 21667->21419 21671 7ff6ee69b320 21667->21671 21668->21667 21669 7ff6ee69ba1d CreateEventW 21668->21669 21669->21667 21670 7ff6ee69ba4b CreateEventW 21669->21670 21670->21667 21672 7ff6ee69b35d 21671->21672 21673 7ff6ee69b337 21671->21673 21672->21419 21677 7ff6ee699b2c 21672->21677 21738 7ff6ee69b194 21673->21738 21676 7ff6ee69b343 WaitForSingleObject 21676->21672 21678 7ff6ee698440 2 API calls 21677->21678 21679 7ff6ee699b59 21678->21679 21681 7ff6ee6ab38e 21679->21681 21749 7ff6ee69b374 CreateEventW 21679->21749 21682 7ff6ee6ab3a9 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21681->21682 21683 7ff6ee699c7d 21682->21683 21684 7ff6ee699c9a 21683->21684 21751 7ff6ee6b11f0 EtwTraceMessage 21683->21751 21684->21433 21692 7ff6ee69a0b4 21684->21692 21686 7ff6ee699b6f 21686->21681 21687 7ff6ee698440 2 API calls 21686->21687 21688 7ff6ee699be0 21687->21688 21688->21681 21750 7ff6ee69b404 CreateEventW 21688->21750 21691 7ff6ee699bf6 CreateEventW 21691->21682 21691->21683 21693 7ff6ee698440 2 API calls 21692->21693 21696 7ff6ee69a0c6 21693->21696 21694 7ff6ee69a150 21694->21436 21695 7ff6ee6ab5e3 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ 21697 7ff6ee69a133 21695->21697 21696->21695 21696->21697 21697->21694 21752 7ff6ee6b11f0 EtwTraceMessage 21697->21752 21700 7ff6ee69bbb8 GetMessageW 21699->21700 21701 7ff6ee69bbd6 21700->21701 21702 7ff6ee69bbdc TranslateMessage DispatchMessageW 21700->21702 21701->21439 21702->21700 21704 7ff6ee69d218 UnmapViewOfFile 21703->21704 21705 7ff6ee69d22c 21703->21705 21704->21705 21706 7ff6ee69d238 CloseHandle 21705->21706 21707 7ff6ee69d24c 21705->21707 21706->21707 21709 7ff6ee69d269 21707->21709 21753 7ff6ee6b11f0 EtwTraceMessage 21707->21753 21709->21408 21710->21428 21711->21415 21712->21433 21713->21419 21714->21423 21715->21427 21716->21404 21717->21401 21718->21532 21719->21539 21720->21554 21721->21580 21722->21587 21723->21598 21724->21599 21725->21612 21727 7ff6ee69dc61 21726->21727 21728 7ff6ee69dd06 VariantClear 21727->21728 21729 7ff6ee6ad11e 21727->21729 21730 7ff6ee69dc76 21727->21730 21728->21659 21729->21728 21733 7ff6ee6ad131 SysFreeString 21729->21733 21736 7ff6ee69dcb4 21729->21736 21731 7ff6ee69dc82 SysAllocString 21730->21731 21732 7ff6ee6ad102 SysFreeString 21730->21732 21734 7ff6ee69dc9e 21731->21734 21731->21736 21732->21736 21733->21728 21737 7ff6ee69dd40 18 API calls 21734->21737 21736->21728 21737->21736 21739 7ff6ee69b1ae CreateThread 21738->21739 21740 7ff6ee6abf22 21739->21740 21741 7ff6ee69b1ea 21739->21741 21742 7ff6ee69a39c 2 API calls 21741->21742 21743 7ff6ee69b1fb 21742->21743 21748 7ff6ee69b234 HeapAlloc HeapAlloc HeapAlloc GetLastError _Ref_count 21743->21748 21745 7ff6ee69b212 21746 7ff6ee69fa20 LeaveCriticalSection 21745->21746 21747 7ff6ee69b220 21746->21747 21747->21672 21747->21676 21748->21745 21749->21686 21750->21691 21751->21684 21752->21694 21753->21709 21755 7ff6ee699dd5 21754->21755 21766 7ff6ee699e41 21754->21766 21756 7ff6ee6ab518 21755->21756 21757 7ff6ee699ded 21755->21757 21758 7ff6ee699dfc 21755->21758 21776 7ff6ee6b4304 HeapFree GetLastError 21756->21776 21760 7ff6ee6985e0 2 API calls 21757->21760 21761 7ff6ee699e2e 21758->21761 21758->21766 21775 7ff6ee69f804 HeapFree GetLastError 21758->21775 21760->21758 21762 7ff6ee6985e0 2 API calls 21761->21762 21762->21766 21763 7ff6ee6ab520 21767 7ff6ee6985e0 2 API calls 21763->21767 21765 7ff6ee699e22 21768 7ff6ee6985e0 2 API calls 21765->21768 21766->21453 21766->21454 21769 7ff6ee6ab52c 21767->21769 21768->21761 21770->21446 21771->21448 21772->21457 21773->21463 21774->21456 21775->21765 21776->21763 21777 7ff6ee6a32b7 21778 7ff6ee6a3238 21777->21778 21781 7ff6ee69f260 LdrResolveDelayLoadedAPI 21778->21781 21780 7ff6ee6a3277 21780->21780 21781->21780 21782 7ff6ee69fe78 21783 7ff6ee69fe90 TlsFree 21782->21783 21784 7ff6ee69fe9d 21782->21784 21783->21784 21785 7ff6ee6a3378 21786 7ff6ee6a32d5 21785->21786 21786->21785 21788 7ff6ee69f260 LdrResolveDelayLoadedAPI 21786->21788 21788->21786

    Executed Functions

    Function 00007FF6EE69C334, Relevance: 96.8, APIs: 54, Strings: 1, Instructions: 556memoryCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 0 7ff6ee69c334-7ff6ee69c389 call 7ff6ee6fc088 3 7ff6ee69c38f-7ff6ee69c3c6 InitializeSecurityDescriptor 0->3 4 7ff6ee69c5e4-7ff6ee69c604 call 7ff6ee6fc098 0->4 6 7ff6ee6ac322-7ff6ee6ac332 GetLastError 3->6 7 7ff6ee69c3cc-7ff6ee69c411 AllocateAndInitializeSid 3->7 8 7ff6ee69c60b-7ff6ee69c612 4->8 11 7ff6ee6ac334-7ff6ee6ac337 6->11 12 7ff6ee6ac33d-7ff6ee6ac34b call 7ff6ee6fc080 6->12 9 7ff6ee69c417-7ff6ee69c474 AllocateAndInitializeSid 7->9 10 7ff6ee6ac3ba-7ff6ee6ac3d9 call 7ff6ee6fc080 GetLastError 7->10 13 7ff6ee6ac920-7ff6ee6ac92c call 7ff6ee6fc080 8->13 14 7ff6ee69c618-7ff6ee69c641 8->14 15 7ff6ee6ac486-7ff6ee6ac4a6 call 7ff6ee6fc080 GetLastError 9->15 16 7ff6ee69c47a-7ff6ee69c4ba RtlLengthSid LocalAlloc 9->16 33 7ff6ee6ac3e2 10->33 34 7ff6ee6ac3db-7ff6ee6ac3e0 10->34 11->12 25 7ff6ee6ac34d-7ff6ee6ac365 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 12->25 26 7ff6ee6ac36a-7ff6ee6ac37b 12->26 65 7ff6ee6ac8ee-7ff6ee6ac90b GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 14->65 66 7ff6ee69c647-7ff6ee69c658 14->66 42 7ff6ee6ac4af 15->42 43 7ff6ee6ac4a8-7ff6ee6ac4ad 15->43 20 7ff6ee69c4c0-7ff6ee69c4d7 RtlCreateAcl 16->20 21 7ff6ee6ac558-7ff6ee6ac597 call 7ff6ee6fc080 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 16->21 28 7ff6ee6ac5c1-7ff6ee6ac5d3 RtlNtStatusToDosError 20->28 29 7ff6ee69c4dd-7ff6ee69c4f8 RtlAddAccessAllowedAce 20->29 58 7ff6ee6ac8c9-7ff6ee6ac8d8 FreeSid 21->58 59 7ff6ee6ac59d-7ff6ee6ac5a1 21->59 25->26 37 7ff6ee6ac381-7ff6ee6ac385 26->37 38 7ff6ee69c664 26->38 35 7ff6ee6ac5de-7ff6ee6ac5fb call 7ff6ee6fc080 LocalFree 28->35 36 7ff6ee6ac5d5-7ff6ee6ac5d8 28->36 39 7ff6ee69c4fe-7ff6ee69c52a SetSecurityDescriptorOwner 29->39 40 7ff6ee6ac64f-7ff6ee6ac661 RtlNtStatusToDosError 29->40 44 7ff6ee6ac3e4-7ff6ee6ac3f4 GetLastError 33->44 45 7ff6ee6ac418-7ff6ee6ac429 33->45 34->33 84 7ff6ee6ac5fd-7ff6ee6ac615 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 35->84 85 7ff6ee6ac61a-7ff6ee6ac62b 35->85 36->35 37->38 55 7ff6ee6ac38b-7ff6ee6ac38f 37->55 50 7ff6ee69c666-7ff6ee69c692 call 7ff6ee6a2800 38->50 56 7ff6ee6ac6f0-7ff6ee6ac700 GetLastError 39->56 57 7ff6ee69c530-7ff6ee69c549 SetSecurityDescriptorGroup 39->57 51 7ff6ee6ac663-7ff6ee6ac666 40->51 52 7ff6ee6ac66c-7ff6ee6ac689 call 7ff6ee6fc080 LocalFree 40->52 53 7ff6ee6ac4b1-7ff6ee6ac4c1 GetLastError 42->53 54 7ff6ee6ac4e5-7ff6ee6ac4f6 42->54 43->42 60 7ff6ee6ac3f6-7ff6ee6ac3f9 44->60 61 7ff6ee6ac3fb-7ff6ee6ac413 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 44->61 46 7ff6ee6ac468-7ff6ee6ac476 GetLastError 45->46 47 7ff6ee6ac42b-7ff6ee6ac42f 45->47 46->50 67 7ff6ee6ac47c-7ff6ee6ac481 46->67 47->46 63 7ff6ee6ac431-7ff6ee6ac435 47->63 51->52 104 7ff6ee6ac6a8-7ff6ee6ac6b9 52->104 105 7ff6ee6ac68b-7ff6ee6ac6a3 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 52->105 70 7ff6ee6ac4c3-7ff6ee6ac4c6 53->70 71 7ff6ee6ac4c8-7ff6ee6ac4e0 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 53->71 72 7ff6ee6ac538-7ff6ee6ac548 GetLastError 54->72 73 7ff6ee6ac4f8-7ff6ee6ac4fc 54->73 55->38 74 7ff6ee6ac395-7ff6ee6ac3b5 call 7ff6ee6b11f0 55->74 75 7ff6ee6ac702-7ff6ee6ac705 56->75 76 7ff6ee6ac70b-7ff6ee6ac719 call 7ff6ee6fc080 56->76 77 7ff6ee69c54f-7ff6ee69c569 SetSecurityDescriptorDacl 57->77 78 7ff6ee6ac76d-7ff6ee6ac77d GetLastError 57->78 62 7ff6ee6ac8d9-7ff6ee6ac8e9 FreeSid 58->62 59->58 79 7ff6ee6ac5a7-7ff6ee6ac5ab 59->79 60->61 61->45 62->38 63->46 81 7ff6ee6ac437-7ff6ee6ac445 GetLastError 63->81 98 7ff6ee6ac911-7ff6ee6ac915 65->98 66->38 86 7ff6ee69c65a-7ff6ee69c65e 66->86 67->50 70->71 71->54 72->62 91 7ff6ee6ac54e-7ff6ee6ac553 72->91 73->72 89 7ff6ee6ac4fe-7ff6ee6ac502 73->89 74->38 75->76 120 7ff6ee6ac738-7ff6ee6ac749 76->120 121 7ff6ee6ac71b-7ff6ee6ac733 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 76->121 92 7ff6ee69c56f-7ff6ee69c59e call 7ff6ee6fc090 77->92 93 7ff6ee6ac7ea-7ff6ee6ac7fa GetLastError 77->93 82 7ff6ee6ac77f-7ff6ee6ac782 78->82 83 7ff6ee6ac788-7ff6ee6ac796 call 7ff6ee6fc080 78->83 79->58 80 7ff6ee6ac5b1-7ff6ee6ac5bc 79->80 95 7ff6ee6ac6db-7ff6ee6ac6eb call 7ff6ee6b11f0 80->95 96 7ff6ee6ac447-7ff6ee6ac44a 81->96 97 7ff6ee6ac44c-7ff6ee6ac463 call 7ff6ee6b11f0 81->97 82->83 124 7ff6ee6ac7b5-7ff6ee6ac7c6 83->124 125 7ff6ee6ac798-7ff6ee6ac7b0 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 83->125 84->85 85->58 100 7ff6ee6ac631-7ff6ee6ac635 85->100 86->38 86->98 89->72 106 7ff6ee6ac504-7ff6ee6ac512 GetLastError 89->106 91->62 119 7ff6ee69c5a5-7ff6ee69c5ae 92->119 102 7ff6ee6ac805-7ff6ee6ac813 call 7ff6ee6fc080 93->102 103 7ff6ee6ac7fc-7ff6ee6ac7ff 93->103 95->58 96->97 97->46 98->38 109 7ff6ee6ac91b 98->109 100->58 112 7ff6ee6ac63b-7ff6ee6ac63f 100->112 136 7ff6ee6ac815-7ff6ee6ac82d GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 102->136 137 7ff6ee6ac832-7ff6ee6ac843 102->137 103->102 104->58 115 7ff6ee6ac6bf-7ff6ee6ac6c3 104->115 105->104 116 7ff6ee6ac514-7ff6ee6ac517 106->116 117 7ff6ee6ac519-7ff6ee6ac533 call 7ff6ee6b11f0 106->117 109->13 112->58 126 7ff6ee6ac645-7ff6ee6ac64a 112->126 115->58 128 7ff6ee6ac6c9-7ff6ee6ac6cd 115->128 116->117 117->72 131 7ff6ee69c5b4-7ff6ee69c5e3 LocalFree FreeSid * 2 119->131 132 7ff6ee6ac858-7ff6ee6ac892 call 7ff6ee6fc080 GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 119->132 122 7ff6ee6ac74f-7ff6ee6ac753 120->122 123 7ff6ee6ac8b9-7ff6ee6ac8c8 LocalFree 120->123 121->120 122->123 133 7ff6ee6ac759-7ff6ee6ac75d 122->133 123->58 124->123 134 7ff6ee6ac7cc-7ff6ee6ac7d0 124->134 125->124 135 7ff6ee6ac6d8 126->135 128->58 138 7ff6ee6ac6d3 128->138 131->4 132->123 147 7ff6ee6ac894-7ff6ee6ac898 132->147 133->123 140 7ff6ee6ac763-7ff6ee6ac768 133->140 134->123 141 7ff6ee6ac7d6-7ff6ee6ac7da 134->141 135->95 136->137 137->123 142 7ff6ee6ac845-7ff6ee6ac849 137->142 138->135 144 7ff6ee6ac8a5-7ff6ee6ac8b8 call 7ff6ee6b11f0 140->144 141->123 145 7ff6ee6ac7e0-7ff6ee6ac7e5 141->145 142->123 146 7ff6ee6ac84b-7ff6ee6ac84f 142->146 144->123 145->144 146->123 148 7ff6ee6ac851-7ff6ee6ac856 146->148 147->123 149 7ff6ee6ac89a-7ff6ee6ac89e 147->149 148->144 149->123 151 7ff6ee6ac8a0 149->151 151->144
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Error$Last$Log@@MemoryObjectWrite@$Free$Local$DescriptorSecurity$Initialize$AllocateStatus$AccessAllocAllowedCreateDaclGroupLengthOwner
    • String ID: @
    • API String ID: 839596735-2766056989
    • Opcode ID: 8c723d9ffb27e65b3770e332976803b59c30872583bfd1e90f88a267b8357a44
    • Instruction ID: 276e0106deb1fd6088d673b5355245507d022a59448db8e98ea1946532aac8c6
    • Opcode Fuzzy Hash: 8c723d9ffb27e65b3770e332976803b59c30872583bfd1e90f88a267b8357a44
    • Instruction Fuzzy Hash: E2427137A08A428AE7009F11D4443787FA1FBA9B15F969135EA0EC33A4CFBED405D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69AC50, Relevance: 18.2, APIs: 12, Instructions: 238sleepCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 237 7ff6ee69ac50-7ff6ee69ac98 238 7ff6ee69acab-7ff6ee69acb5 237->238 239 7ff6ee69ac9a-7ff6ee69aca5 call 7ff6ee69d350 237->239 241 7ff6ee69acc4 238->241 242 7ff6ee69acb7-7ff6ee69acbe 238->242 239->238 246 7ff6ee6abcbc-7ff6ee6abcc7 call 7ff6ee69d350 239->246 245 7ff6ee69acc7-7ff6ee69acca 241->245 242->241 244 7ff6ee69ae30-7ff6ee69ae3a 242->244 244->241 249 7ff6ee69ae40 244->249 247 7ff6ee69ad1b-7ff6ee69ad21 245->247 248 7ff6ee69accc-7ff6ee69accf 245->248 246->238 263 7ff6ee6abccd-7ff6ee6abce9 Sleep call 7ff6ee69d350 246->263 252 7ff6ee69ad27-7ff6ee69ad2b 247->252 253 7ff6ee6abd0b 247->253 248->247 250 7ff6ee69acd1-7ff6ee69acdb 248->250 249->244 256 7ff6ee6abcf0 250->256 257 7ff6ee69ace1-7ff6ee69aced 250->257 254 7ff6ee69ad3d-7ff6ee69ad40 252->254 255 7ff6ee69ad2d-7ff6ee69ad38 LeaveCriticalSection 252->255 259 7ff6ee6abd12 253->259 254->259 260 7ff6ee69ad46 254->260 255->254 265 7ff6ee6abcfa-7ff6ee6abd04 256->265 261 7ff6ee69adbe-7ff6ee69adc8 257->261 262 7ff6ee69acf3-7ff6ee69acfa 257->262 274 7ff6ee6abd1c-7ff6ee6abd2b GetLastError 259->274 264 7ff6ee69ad4e-7ff6ee69ad50 260->264 266 7ff6ee69adce 261->266 267 7ff6ee69ad12-7ff6ee69ad19 261->267 262->267 268 7ff6ee69acfc-7ff6ee69ad04 262->268 276 7ff6ee6abceb 263->276 271 7ff6ee69ad52-7ff6ee69ad82 MsgWaitForMultipleObjectsEx 264->271 272 7ff6ee69ad8b-7ff6ee69adbc call 7ff6ee6a2800 264->272 265->265 273 7ff6ee6abd06 265->273 266->265 267->245 267->247 268->267 275 7ff6ee69ad06-7ff6ee69ad10 268->275 277 7ff6ee69add3-7ff6ee69add5 271->277 278 7ff6ee69ad84-7ff6ee69ad89 271->278 273->267 280 7ff6ee6abd47-7ff6ee6abd61 Sleep 274->280 281 7ff6ee6abd2d-7ff6ee6abd30 274->281 275->267 275->268 276->238 283 7ff6ee69ae42-7ff6ee69ae47 277->283 284 7ff6ee69add7-7ff6ee69addd 277->284 278->264 280->264 285 7ff6ee6abd32-7ff6ee6abd35 281->285 286 7ff6ee6abd3b-7ff6ee6abd42 281->286 283->264 287 7ff6ee69addf-7ff6ee69ade5 284->287 288 7ff6ee69ae16-7ff6ee69ae20 call 7ff6ee699cc0 284->288 285->286 289 7ff6ee69adf0-7ff6ee69adf2 285->289 290 7ff6ee6abdf2-7ff6ee6abe15 WaitForMultipleObjectsEx 286->290 294 7ff6ee69ade7-7ff6ee69adea 287->294 295 7ff6ee69ae4c-7ff6ee69ae4e 287->295 300 7ff6ee69ae26-7ff6ee69ae28 288->300 291 7ff6ee6abd66-7ff6ee6abd8a PeekMessageW 289->291 292 7ff6ee69adf8 289->292 290->283 293 7ff6ee6abe1b-7ff6ee6abe1e 290->293 291->290 296 7ff6ee6abd8c-7ff6ee6abda8 GetMessageW 291->296 297 7ff6ee69adfe-7ff6ee69ae11 call 7ff6ee69a3e0 292->297 298 7ff6ee6abe52-7ff6ee6abe57 292->298 293->278 299 7ff6ee6abe24-7ff6ee6abe29 293->299 294->274 294->289 295->264 301 7ff6ee6abdcc-7ff6ee6abdf0 PeekMessageW 296->301 302 7ff6ee6abdaa-7ff6ee6abdc7 TranslateMessage DispatchMessageW 296->302 297->264 298->264 299->288 304 7ff6ee6abe2f-7ff6ee6abe32 299->304 300->264 301->290 301->296 302->301 306 7ff6ee6abe34-7ff6ee6abe36 304->306 307 7ff6ee6abe5c-7ff6ee6abe6b GetLastError 304->307 306->298 308 7ff6ee6abe38-7ff6ee6abe4d call 7ff6ee69a3e0 306->308 307->280 309 7ff6ee6abe71-7ff6ee6abe76 307->309 308->264 309->264
    APIs
    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69AD31
    • MsgWaitForMultipleObjectsEx.USER32 ref: 00007FF6EE69AD71
      • Part of subcall function 00007FF6EE69D350: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF6EE69A3B6), ref: 00007FF6EE69D35A
    • Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6EE6ABCD2
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CriticalSection$EnterLeaveMultipleObjectsSleepWait
    • String ID:
    • API String ID: 1173844453-0
    • Opcode ID: a745c0e0f876e26306f9d46a9b60649f614862a05416d7ac85aead05d917477e
    • Instruction ID: 88ac9e99881b20daf26f3ce249ad04667bb154d3d2327958288cc9e41abde6e9
    • Opcode Fuzzy Hash: a745c0e0f876e26306f9d46a9b60649f614862a05416d7ac85aead05d917477e
    • Instruction Fuzzy Hash: 4DA1E033A0864282EA608B15D44477977E1FFA5B84F674131EA4EC7290DFBFE845E70A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE698490, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139nativeCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AllocateCurrentHeapInformationProcessQuerySystemchar_traits
    • String ID: HandleCount$PrivatePageCount$ThreadCount
    • API String ID: 4172923599-1022455807
    • Opcode ID: 0009d0f3211147f6729f4867fc0437a0785ba300d8f549d4203438b50944a81f
    • Instruction ID: 35295fd13d775f1013ec839018974044fffb9a78f444f860f1f927f37b0ca404
    • Opcode Fuzzy Hash: 0009d0f3211147f6729f4867fc0437a0785ba300d8f549d4203438b50944a81f
    • Instruction Fuzzy Hash: 36517F23A2864282EB50DF11E84077973A0FBA4B40F525135FA4EC7796DFBEE844DB45
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE699E60, Relevance: 7.7, APIs: 5, Instructions: 155memoryCOMMON
    Download Yara Rule
    APIs
    • EtwEventUnregister.NTDLL ref: 00007FF6EE69A01E
    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6EE69A064
      • Part of subcall function 00007FF6EE6985E0: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,80000002,00007FF6EE6AD91A,?,?,?,00007FF6EE69800E), ref: 00007FF6EE6985F6
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Heap$EventFreeProcessUnregister
    • String ID:
    • API String ID: 1416143176-0
    • Opcode ID: e5d6496c9477112659f9e88a0831bb703ce4b367f3a88c3037666df4770912f1
    • Instruction ID: a95cf3c4d927f03543d2478dec5087b946c15f7bd28ed04778e7944f1a0fe039
    • Opcode Fuzzy Hash: e5d6496c9477112659f9e88a0831bb703ce4b367f3a88c3037666df4770912f1
    • Instruction Fuzzy Hash: 3A81DB27A58A0A85EB109F15D8543383761FFA8B95F624231E91D873B1CFAFE454E30A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69F110, Relevance: 3.0, APIs: 2, Instructions: 18nativewindowCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: MessageNtdllPostProc_Window
    • String ID:
    • API String ID: 3717879920-0
    • Opcode ID: e17f56cb4a7ce05c59183ad68f8b8db617f9f3891a303444387c22ae15eb203f
    • Instruction ID: e4572947ad4ebf7e5ecede616d4cfd41f83557b9650c71172591c5f223c3e957
    • Opcode Fuzzy Hash: e17f56cb4a7ce05c59183ad68f8b8db617f9f3891a303444387c22ae15eb203f
    • Instruction Fuzzy Hash: B4E0CD33A04501C7E3641FB0D44DA797720EB5F711B1A5030DE0D417408F7E6495E605
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69F260, Relevance: 1.5, APIs: 1, Instructions: 12libraryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: DelayLoadedResolve
    • String ID:
    • API String ID: 841769287-0
    • Opcode ID: 8c62940f31489bd919e188286d043ab842333bba8da889ca5f5923d987ab52e5
    • Instruction ID: 56328fe00b894cabf5ba8f897be4c83ab1e6448efbd7bc463e42bb34e3948094
    • Opcode Fuzzy Hash: 8c62940f31489bd919e188286d043ab842333bba8da889ca5f5923d987ab52e5
    • Instruction Fuzzy Hash: 1FE0B67A908A4586D610DF40E8402647BA0FB69B84F924132F94CC3734CF7D9514DB09
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A2CC0, Relevance: 1.5, APIs: 1, Instructions: 6COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: ExceptionFilterUnhandled
    • String ID:
    • API String ID: 3192549508-0
    • Opcode ID: f67ced8c2176299b387adc415fe50041e30ae321456327889725b89db8fc2d11
    • Instruction ID: ec846410b0338af0c5fec765697775a910127cbd1a1db92dea4dc2a5953b648f
    • Opcode Fuzzy Hash: f67ced8c2176299b387adc415fe50041e30ae321456327889725b89db8fc2d11
    • Instruction Fuzzy Hash: 30B01215FE5403D2D604BB22DC8517413A0BF7C304FD24430E00EC0220DE9D919BAB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69B4D0, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 248memorysynchronizationCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 153 7ff6ee69b4d0-7ff6ee69b508 call 7ff6ee69c334 156 7ff6ee6ac0f0-7ff6ee6ac10d GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 153->156 157 7ff6ee69b50e-7ff6ee69b51a call 7ff6ee69c260 call 7ff6ee69c174 153->157 160 7ff6ee6ac113-7ff6ee6ac117 156->160 167 7ff6ee69b83f-7ff6ee69b84b call 7ff6ee69d208 call 7ff6ee69cec8 call 7ff6ee6fc080 157->167 168 7ff6ee69b520-7ff6ee69b527 call 7ff6ee69bcd4 157->168 162 7ff6ee6ac11d-7ff6ee6ac136 call 7ff6ee6b11f0 160->162 163 7ff6ee69b87c-7ff6ee69b895 160->163 162->163 181 7ff6ee69b852-7ff6ee69b859 167->181 168->167 174 7ff6ee69b52d-7ff6ee69b55c call 7ff6ee6fc098 168->174 179 7ff6ee69b6e3-7ff6ee69b6f7 call 7ff6ee698440 174->179 180 7ff6ee69b562-7ff6ee69b57f SysAllocString 174->180 189 7ff6ee6ac0cc 179->189 190 7ff6ee69b6fd-7ff6ee69b731 call 7ff6ee69b8fc 179->190 182 7ff6ee69b6d2-7ff6ee69b6d9 180->182 183 7ff6ee69b585-7ff6ee69b5be 180->183 181->156 184 7ff6ee69b85f-7ff6ee69b870 181->184 182->179 192 7ff6ee69b6c3-7ff6ee69b6cd SysFreeString 183->192 193 7ff6ee69b5c4-7ff6ee69b5fd 183->193 184->163 186 7ff6ee69b872-7ff6ee69b876 184->186 186->160 186->163 197 7ff6ee6ac0d4-7ff6ee6ac0ea WaitForSingleObject 189->197 198 7ff6ee69b830-7ff6ee69b83a call 7ff6ee69d300 call 7ff6ee694220 call 7ff6ee69d278 190->198 199 7ff6ee69b737-7ff6ee69b765 call 7ff6ee69b320 190->199 192->182 195 7ff6ee69b5ff-7ff6ee69b602 193->195 196 7ff6ee69b60c-7ff6ee69b610 call 7ff6ee69da94 193->196 195->196 202 7ff6ee69b615-7ff6ee69b617 196->202 197->156 198->167 199->198 215 7ff6ee69b76b-7ff6ee69b772 call 7ff6ee699b2c 199->215 205 7ff6ee69b6a8-7ff6ee69b6be call 7ff6ee69bc08 202->205 206 7ff6ee69b61d-7ff6ee69b666 202->206 205->192 208 7ff6ee69b675-7ff6ee69b680 call 7ff6ee691100 206->208 209 7ff6ee69b668-7ff6ee69b66b 206->209 218 7ff6ee69b69f-7ff6ee69b6a3 call 7ff6ee69bc84 208->218 219 7ff6ee69b682-7ff6ee69b698 208->219 209->208 223 7ff6ee69b774-7ff6ee69b784 call 7ff6ee69a0b4 call 7ff6ee6a338c 215->223 224 7ff6ee69b798-7ff6ee69b7f7 GetCurrentProcess * 2 DuplicateHandle 215->224 218->205 219->218 223->197 231 7ff6ee69b78a-7ff6ee69b78c 223->231 226 7ff6ee69b801-7ff6ee69b82b WaitForSingleObject CloseHandle call 7ff6ee69b8a0 224->226 226->198 232 7ff6ee69b78e call 7ff6ee69bbb4 231->232 233 7ff6ee69b793 call 7ff6ee69b8a0 231->233 232->233 233->224
    APIs
      • Part of subcall function 00007FF6EE69C334: InitializeSecurityDescriptor.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE69C3B8
      • Part of subcall function 00007FF6EE69C334: AllocateAndInitializeSid.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE69C403
      • Part of subcall function 00007FF6EE69C334: AllocateAndInitializeSid.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE69C466
      • Part of subcall function 00007FF6EE69C334: RtlLengthSid.NTDLL ref: 00007FF6EE69C495
      • Part of subcall function 00007FF6EE69C334: LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF6EE69C4A8
      • Part of subcall function 00007FF6EE69C334: RtlCreateAcl.NTDLL ref: 00007FF6EE69C4C9
    • SysAllocString.OLEAUT32 ref: 00007FF6EE69B56D
    • SysFreeString.OLEAUT32 ref: 00007FF6EE69B6C6
    • GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6EE69B7A7
    • GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6EE69B7B6
    • DuplicateHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6EE69B7E1
    • WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69B808
    • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6EE69B818
    • GetMemLogObject.WBEMCOMN ref: 00007FF6EE6AC0F0
    • ?Write@CMemoryLog@@QEAAXJ@Z.WBEMCOMN ref: 00007FF6EE6AC101
      • Part of subcall function 00007FF6EE69C260: OpenFileMappingW.KERNELBASE ref: 00007FF6EE69C290
      • Part of subcall function 00007FF6EE69C260: MapViewOfFile.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF6EE69C2C3
      • Part of subcall function 00007FF6EE69C174: WmiEventSourceConnect.NCOBJAPI ref: 00007FF6EE69C1B2
      • Part of subcall function 00007FF6EE69C174: WmiCreateObjectWithFormat.NCOBJAPI ref: 00007FF6EE69C1F8
      • Part of subcall function 00007FF6EE69BCD4: AllocateAndInitializeSid.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE69BD47
      • Part of subcall function 00007FF6EE69BCD4: GetLengthSid.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE69BD5F
      • Part of subcall function 00007FF6EE69BCD4: CopySid.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE69BD99
      • Part of subcall function 00007FF6EE69BCD4: CopySid.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE69BDE4
      • Part of subcall function 00007FF6EE69BCD4: AllocateAndInitializeSid.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE69BE3C
      • Part of subcall function 00007FF6EE69BCD4: GetLengthSid.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE69BE54
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Initialize$Allocate$LengthObject$AllocCopyCreateCurrentFileHandleProcessString$CloseConnectDescriptorDuplicateEventFormatFreeLocalLog@@MappingMemoryOpenSecuritySingleSourceViewWaitWithWrite@
    • String ID: Root
    • API String ID: 3934963168-3066451557
    • Opcode ID: bf7f30300bae9e2d9c47c816e5df0a5e30c4a5cbcde9337f07ab91f8079d285b
    • Instruction ID: da90027fab7a0adf18823c77dd2b1d5ee17ff03cadb33682b2183ddb63534535
    • Opcode Fuzzy Hash: bf7f30300bae9e2d9c47c816e5df0a5e30c4a5cbcde9337f07ab91f8079d285b
    • Instruction Fuzzy Hash: 47C16F37A08B468AE700DF25D8402BC37A0FBA9B54B524235EE0D93765DFBEE415E709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69C890, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 66windowregistryCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Window$LoadMenu$ClassCreateCursorDeleteIconRegisterShowSystemUpdate
    • String ID: Wmi Provider Host
    • API String ID: 2564365438-660353315
    • Opcode ID: 07ee024710d894325b704247af5016c181b44703dfe2c019a49ed5c6e65fb461
    • Instruction ID: 7c3918e3e333cf6f88a611e7cb7e1eb89c3b0002883bb1be23b040474daf78a3
    • Opcode Fuzzy Hash: 07ee024710d894325b704247af5016c181b44703dfe2c019a49ed5c6e65fb461
    • Instruction Fuzzy Hash: 99311C33A08B8187E7108F15F40837ABBA0F799B51F559138EA8E82B58DF7DD058CB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69A940, Relevance: 15.3, APIs: 10, Instructions: 321COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 316 7ff6ee69a940-7ff6ee69a97d 317 7ff6ee69a980-7ff6ee69a997 call 7ff6ee69a8a8 316->317 320 7ff6ee69a999-7ff6ee69a99e 317->320 321 7ff6ee69aa95-7ff6ee69aa97 320->321 322 7ff6ee69a9a4-7ff6ee69a9a9 320->322 321->317 323 7ff6ee69aa9d-7ff6ee69aaa3 321->323 324 7ff6ee69a9ab-7ff6ee69a9b6 call 7ff6ee69d350 322->324 325 7ff6ee69a9bc 322->325 323->317 326 7ff6ee69aaa9-7ff6ee69aacb call 7ff6ee69a230 323->326 324->325 333 7ff6ee6aba50-7ff6ee6aba5b call 7ff6ee69d350 324->333 327 7ff6ee69a9bf-7ff6ee69a9c6 325->327 331 7ff6ee6aba84-7ff6ee6aba86 327->331 332 7ff6ee69a9cc-7ff6ee69a9d1 327->332 331->332 337 7ff6ee6aba8c-7ff6ee6abaa7 call 7ff6ee69a690 331->337 335 7ff6ee69a9d3-7ff6ee69a9e3 LeaveCriticalSection 332->335 336 7ff6ee69a9e7-7ff6ee69a9e9 332->336 333->325 347 7ff6ee6aba61-7ff6ee6aba7d Sleep call 7ff6ee69d350 333->347 335->336 339 7ff6ee69aa40-7ff6ee69aa46 336->339 340 7ff6ee69a9eb-7ff6ee69a9f0 336->340 337->327 351 7ff6ee6abaad-7ff6ee6ababb call 7ff6ee6aedd8 337->351 339->321 343 7ff6ee69aa48-7ff6ee69aa4d 339->343 344 7ff6ee69aa03-7ff6ee69aa1b call 7ff6ee69abf0 340->344 345 7ff6ee69a9f2-7ff6ee69a9fd call 7ff6ee69d350 340->345 348 7ff6ee69aa4f-7ff6ee69aa5a call 7ff6ee69d350 343->348 349 7ff6ee69aa64 343->349 365 7ff6ee69aa21-7ff6ee69aa26 344->365 366 7ff6ee69aacd-7ff6ee69aad5 344->366 345->344 363 7ff6ee6abac0-7ff6ee6abacb call 7ff6ee69d350 345->363 368 7ff6ee6aba7f 347->368 371 7ff6ee6abc41-7ff6ee6abc4c call 7ff6ee69d350 348->371 372 7ff6ee69aa60 348->372 355 7ff6ee69aa67-7ff6ee69aa6a 349->355 351->327 361 7ff6ee69aa70-7ff6ee69aa75 355->361 362 7ff6ee6abc75-7ff6ee6abc77 355->362 373 7ff6ee69aa87-7ff6ee69aa89 361->373 374 7ff6ee69aa77-7ff6ee69aa82 LeaveCriticalSection 361->374 362->361 367 7ff6ee6abc7d-7ff6ee6abc98 call 7ff6ee69a690 362->367 363->344 385 7ff6ee6abad1-7ff6ee6abaed Sleep call 7ff6ee69d350 363->385 376 7ff6ee69aa38-7ff6ee69aa3a 365->376 377 7ff6ee69aa28-7ff6ee69aa33 LeaveCriticalSection 365->377 369 7ff6ee6abb3f 366->369 370 7ff6ee69aadb-7ff6ee69aae8 366->370 396 7ff6ee6abca3-7ff6ee6abcb5 call 7ff6ee6aedd8 367->396 397 7ff6ee6abc9a-7ff6ee6abc9e 367->397 368->325 386 7ff6ee6abb49-7ff6ee6abb71 call 7ff6ee69a39c call 7ff6ee6aed84 369->386 380 7ff6ee69aaf7-7ff6ee69aafe 370->380 381 7ff6ee69aaea-7ff6ee69aaf1 370->381 371->372 400 7ff6ee6abc52-7ff6ee6abc6e Sleep call 7ff6ee69d350 371->400 372->349 373->323 382 7ff6ee69aa8b-7ff6ee69aa8e call 7ff6ee69ac50 373->382 374->373 376->340 378 7ff6ee69aa3c 376->378 377->376 378->339 389 7ff6ee6abb35 380->389 390 7ff6ee69ab04 380->390 381->380 388 7ff6ee6abaf4-7ff6ee6abafe 381->388 399 7ff6ee69aa93 382->399 408 7ff6ee6abaef 385->408 417 7ff6ee6abb7e-7ff6ee6abb83 call 7ff6ee69fa20 386->417 418 7ff6ee6abb73-7ff6ee6abb79 call 7ff6ee69fa20 386->418 388->388 395 7ff6ee6abb00 388->395 389->369 398 7ff6ee69ab07-7ff6ee69ab0e 390->398 395->380 396->355 397->355 405 7ff6ee6abb05-7ff6ee6abb0f call 7ff6ee69b070 398->405 406 7ff6ee69ab14-7ff6ee69ab1c 398->406 399->321 413 7ff6ee6abc70 400->413 419 7ff6ee6abb20 405->419 420 7ff6ee6abb11-7ff6ee6abb1e call 7ff6ee69b04c 405->420 406->405 412 7ff6ee69ab22-7ff6ee69ab35 call 7ff6ee69a5e0 406->412 408->344 427 7ff6ee6abc32-7ff6ee6abc3b call 7ff6ee69fa20 412->427 428 7ff6ee69ab3b-7ff6ee69ab3f 412->428 413->372 439 7ff6ee6abbc6-7ff6ee6abbd6 417->439 418->340 425 7ff6ee6abb22-7ff6ee6abb26 419->425 426 7ff6ee6abb28 419->426 420->419 433 7ff6ee6abb2c-7ff6ee6abb2f 425->433 426->433 427->371 434 7ff6ee69ab51-7ff6ee69ab5a 428->434 435 7ff6ee69ab41-7ff6ee69ab4c LeaveCriticalSection 428->435 433->389 433->398 436 7ff6ee69ab60-7ff6ee69ab6d call 7ff6ee69cf00 434->436 437 7ff6ee6abb85-7ff6ee6abbbc call 7ff6ee69a39c call 7ff6ee6aed84 call 7ff6ee69fa20 434->437 435->434 442 7ff6ee69ab73-7ff6ee69ab78 436->442 437->439 449 7ff6ee6abbdc-7ff6ee6abbe7 call 7ff6ee69d350 439->449 442->386 445 7ff6ee69ab7e-7ff6ee69ab83 442->445 447 7ff6ee69ab85-7ff6ee69ab90 call 7ff6ee69d350 445->447 448 7ff6ee69ab96-7ff6ee69ab9d 445->448 447->448 447->449 452 7ff6ee6abc10-7ff6ee6abc12 448->452 453 7ff6ee69aba3-7ff6ee69abbb call 7ff6ee69a690 448->453 449->448 464 7ff6ee6abbed-7ff6ee6abc09 Sleep call 7ff6ee69d350 449->464 455 7ff6ee6abc14-7ff6ee6abc17 452->455 456 7ff6ee6abc29 452->456 462 7ff6ee69abbd-7ff6ee69abc2 453->462 461 7ff6ee6abc1d 455->461 455->462 456->427 461->456 465 7ff6ee69abd4-7ff6ee69abe4 SetEvent 462->465 466 7ff6ee69abc4-7ff6ee69abcf LeaveCriticalSection 462->466 469 7ff6ee6abc0b 464->469 465->376 466->465 469->448
    APIs
      • Part of subcall function 00007FF6EE69A8A8: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69A90A
    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69A9D7
    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69AA2C
    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69AA7B
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CriticalLeaveSection
    • String ID:
    • API String ID: 3988221542-0
    • Opcode ID: 77a85c4642fc07aa3be59ea04cd757de25151c3c374c9b4c7c58f576d0ec66b4
    • Instruction ID: 77ad30e9def35bceb44c01cb097a10d691ab37026f0a8249dc803f905bb7fde8
    • Opcode Fuzzy Hash: 77a85c4642fc07aa3be59ea04cd757de25151c3c374c9b4c7c58f576d0ec66b4
    • Instruction Fuzzy Hash: 75E17023E0864296FB109B51D4847B837A4EF75784F970131EA0DC72D5EFABE845E34A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69C260, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 105fileCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: File$Mapping$CloseCreateErrorHandleLastLog@@MemoryObjectOpenViewWrite@
    • String ID: Global\Wmi Provider Sub System Counters
    • API String ID: 1489113169-3057216162
    • Opcode ID: bcf6ec7b18f721335222fbd12099de190e4c59b0f9bdfc9a034ef6e2e368fd1d
    • Instruction ID: 563ec4f346fb2d5684e0c2d11f2eee6698799947c18c7c2029d54cce19ea13e5
    • Opcode Fuzzy Hash: bcf6ec7b18f721335222fbd12099de190e4c59b0f9bdfc9a034ef6e2e368fd1d
    • Instruction Fuzzy Hash: 9D41E733A08B4286E7109F50E4443787BA1FBA9B90FA64235EA1D837D4DFBEE404D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A2580, Relevance: 12.1, APIs: 8, Instructions: 136sleepCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 496 7ff6ee6a2580-7ff6ee6a25c9 call 7ff6ee6a2e94 GetStartupInfoW 500 7ff6ee6a25cb-7ff6ee6a25d6 496->500 501 7ff6ee6a25e2-7ff6ee6a25eb 500->501 502 7ff6ee6a25d8-7ff6ee6a25db 500->502 505 7ff6ee6a2604-7ff6ee6a260c 501->505 506 7ff6ee6a25ed-7ff6ee6a25f5 _amsg_exit 501->506 503 7ff6ee6a25f7-7ff6ee6a2602 Sleep 502->503 504 7ff6ee6a25dd 502->504 503->500 504->501 508 7ff6ee6a260e-7ff6ee6a262b 505->508 509 7ff6ee6a2667 505->509 507 7ff6ee6a2671-7ff6ee6a267a 506->507 511 7ff6ee6a2699-7ff6ee6a269b 507->511 512 7ff6ee6a267c-7ff6ee6a268f _initterm 507->512 510 7ff6ee6a262f-7ff6ee6a2632 508->510 509->507 515 7ff6ee6a2634-7ff6ee6a2636 510->515 516 7ff6ee6a2659-7ff6ee6a265b 510->516 513 7ff6ee6a26a6-7ff6ee6a26ae 511->513 514 7ff6ee6a269d-7ff6ee6a269f 511->514 512->511 517 7ff6ee6a26b0-7ff6ee6a26be call 7ff6ee6a2e00 513->517 518 7ff6ee6a26da-7ff6ee6a26e9 513->518 514->513 519 7ff6ee6a2638-7ff6ee6a263c 515->519 520 7ff6ee6a265d-7ff6ee6a2662 515->520 516->507 516->520 517->518 529 7ff6ee6a26c0-7ff6ee6a26d0 517->529 524 7ff6ee6a26ed-7ff6ee6a26f3 518->524 522 7ff6ee6a264e-7ff6ee6a2657 519->522 523 7ff6ee6a263e-7ff6ee6a2648 call 7ff6ee6a2cc0 519->523 525 7ff6ee6a27c4-7ff6ee6a27d9 520->525 522->510 532 7ff6ee6a264a 523->532 527 7ff6ee6a26f5-7ff6ee6a26f7 524->527 528 7ff6ee6a2766-7ff6ee6a2769 524->528 533 7ff6ee6a26f9-7ff6ee6a26fb 527->533 534 7ff6ee6a26fd-7ff6ee6a2702 527->534 530 7ff6ee6a2778-7ff6ee6a2780 _ismbblead 528->530 531 7ff6ee6a276b-7ff6ee6a2774 528->531 529->518 535 7ff6ee6a2782-7ff6ee6a2785 530->535 536 7ff6ee6a278a-7ff6ee6a2792 530->536 531->530 532->522 533->528 533->534 537 7ff6ee6a2710-7ff6ee6a2745 call 7ff6ee69c69c 534->537 538 7ff6ee6a2704-7ff6ee6a270e 534->538 535->536 536->524 536->525 541 7ff6ee6a274f-7ff6ee6a2756 537->541 542 7ff6ee6a2747-7ff6ee6a2749 exit 537->542 538->534 543 7ff6ee6a2764 541->543 544 7ff6ee6a2758-7ff6ee6a275e _cexit 541->544 542->541 543->525 544->543
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
    • String ID:
    • API String ID: 2995914023-0
    • Opcode ID: 1b2c3ffdca65d3f28dde6d4b15da860c4e3d8628c268bcf447f6e91f46cbfdae
    • Instruction ID: 9de4b201b97f9078e74c56e6d718212955d2c038987daf271e9a0605c6f8fb5e
    • Opcode Fuzzy Hash: 1b2c3ffdca65d3f28dde6d4b15da860c4e3d8628c268bcf447f6e91f46cbfdae
    • Instruction Fuzzy Hash: 68516633E8C65686E7209B20E85077937A0FF64744F660031E90DC72A0DFBEE940EB0A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE697C2C, Relevance: 10.9, APIs: 7, Instructions: 361memoryCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 546 7ff6ee697c2c-7ff6ee697c5d 547 7ff6ee697c63-7ff6ee697c7f call 7ff6ee699af0 546->547 548 7ff6ee697cec-7ff6ee697cf9 546->548 558 7ff6ee697c85-7ff6ee697ca2 HeapAlloc 547->558 559 7ff6ee6a972c 547->559 549 7ff6ee697cff-7ff6ee697d06 548->549 550 7ff6ee698014-7ff6ee698020 call 7ff6ee69f978 call 7ff6ee69f884 548->550 552 7ff6ee6a97a9 549->552 553 7ff6ee697d0c-7ff6ee697d21 call 7ff6ee698440 549->553 576 7ff6ee698026-7ff6ee698037 550->576 577 7ff6ee6a98ad-7ff6ee6a98ca GetMemLogObject ?Write@CMemoryLog@@QEAAXJ@Z 550->577 562 7ff6ee6a97b1 552->562 567 7ff6ee6a97a1 553->567 568 7ff6ee697d27-7ff6ee697d42 553->568 564 7ff6ee6a9724-7ff6ee6a972a call 7ff6ee6cfef4 558->564 565 7ff6ee697ca8-7ff6ee697cbd call 7ff6ee699af0 558->565 561 7ff6ee6a9731-7ff6ee6a9733 559->561 569 7ff6ee6a9771 561->569 570 7ff6ee6a9735 561->570 575 7ff6ee6a97b9-7ff6ee6a97c3 562->575 564->561 580 7ff6ee6a9741-7ff6ee6a975f HeapCreate 565->580 586 7ff6ee697cc3-7ff6ee697ccd 565->586 567->552 568->552 574 7ff6ee697d48-7ff6ee697d4a 568->574 583 7ff6ee6a9779-7ff6ee6a978a HeapDestroy 569->583 570->580 574->550 579 7ff6ee697d50-7ff6ee697d73 EventRegister 574->579 581 7ff6ee6a97d5 575->581 582 7ff6ee6a97c5-7ff6ee6a97cb 575->582 584 7ff6ee698043-7ff6ee69805e 576->584 585 7ff6ee698039-7ff6ee69803d 576->585 592 7ff6ee6a98d0-7ff6ee6a98d4 577->592 579->550 587 7ff6ee697d79-7ff6ee697d8d call 7ff6ee698440 579->587 580->586 588 7ff6ee6a9765-7ff6ee6a976c call 7ff6ee6cfef4 580->588 589 7ff6ee6a97dc 581->589 582->581 590 7ff6ee6a9796-7ff6ee6a979c call 7ff6ee6cfef4 583->590 591 7ff6ee6a978c-7ff6ee6a9791 583->591 585->584 585->592 593 7ff6ee697ccf-7ff6ee697cde GetProcessHeap 586->593 594 7ff6ee697ce4-7ff6ee697ce6 586->594 587->562 605 7ff6ee697d93-7ff6ee697db5 call 7ff6ee69ba90 587->605 588->586 603 7ff6ee6a97e4 589->603 590->594 591->594 592->584 595 7ff6ee6a98da-7ff6ee6a98f3 call 7ff6ee6b11f0 592->595 593->583 593->594 594->548 594->550 595->584 606 7ff6ee6a97ec-7ff6ee6a97f6 603->606 605->589 612 7ff6ee697dbb-7ff6ee697dde 605->612 608 7ff6ee6a9808 606->608 609 7ff6ee6a97f8-7ff6ee6a97fe 606->609 611 7ff6ee6a980f 608->611 609->608 614 7ff6ee6a9817 611->614 612->575 617 7ff6ee697de4-7ff6ee697de6 612->617 616 7ff6ee6a981f-7ff6ee6a9829 614->616 618 7ff6ee6a983b 616->618 619 7ff6ee6a982b-7ff6ee6a9831 616->619 617->550 620 7ff6ee697dec-7ff6ee697dfc call 7ff6ee698440 617->620 621 7ff6ee6a9842 618->621 619->618 620->603 625 7ff6ee697e02-7ff6ee697e1e call 7ff6ee69badc 620->625 624 7ff6ee6a984a 621->624 626 7ff6ee6a9852-7ff6ee6a985c 624->626 625->611 632 7ff6ee697e24-7ff6ee697e47 625->632 628 7ff6ee6a986e 626->628 629 7ff6ee6a985e-7ff6ee6a9864 626->629 631 7ff6ee6a9875 628->631 629->628 633 7ff6ee6a987d 631->633 632->606 637 7ff6ee697e4d-7ff6ee697e4f 632->637 635 7ff6ee6a9885-7ff6ee6a988f 633->635 638 7ff6ee6a98a1-7ff6ee6a98a8 635->638 639 7ff6ee6a9891-7ff6ee6a9897 635->639 637->550 640 7ff6ee697e55-7ff6ee697e65 call 7ff6ee698440 637->640 641 7ff6ee698060-7ff6ee698063 638->641 639->638 640->614 646 7ff6ee697e6b-7ff6ee697e80 call 7ff6ee69bb28 640->646 642 7ff6ee698005-7ff6ee698007 641->642 642->550 645 7ff6ee698009-7ff6ee698010 call 7ff6ee69f3e8 642->645 645->550 646->621 651 7ff6ee697e86-7ff6ee697ea9 646->651 651->616 654 7ff6ee697eaf-7ff6ee697eb1 651->654 654->550 655 7ff6ee697eb7-7ff6ee697ecc call 7ff6ee698440 654->655 655->624 658 7ff6ee697ed2-7ff6ee697f28 call 7ff6ee69bb78 655->658 658->631 661 7ff6ee697f2e-7ff6ee697f54 658->661 661->626 664 7ff6ee697f5a-7ff6ee697f5c 661->664 664->550 665 7ff6ee697f62-7ff6ee697f77 call 7ff6ee698440 664->665 665->633 668 7ff6ee697f7d-7ff6ee697fd3 call 7ff6ee69bb78 665->668 668->641 671 7ff6ee697fd9-7ff6ee697fff 668->671 671->635 671->642
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Heap$Process$AllocCreateEventRegister
    • String ID:
    • API String ID: 861403313-0
    • Opcode ID: 57327b1a173ec6dca0a6aef04701fe4a2a6c47191cbf9749d22fa1829b1a9c67
    • Instruction ID: 54d238ddd487d01b98e7c6ae45c61ebe23965bb24e1a3e31773d5af07d94ac66
    • Opcode Fuzzy Hash: 57327b1a173ec6dca0a6aef04701fe4a2a6c47191cbf9749d22fa1829b1a9c67
    • Instruction Fuzzy Hash: 2BF13B27A49B0686EA509F15E44033877A0FFA4B50B664135EA4E877A0DFBFF451E30A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69DBEC, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101memoryCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$FreeVariant$AllocClearInitType
    • String ID: ClearAfter
    • API String ID: 205876146-1373074809
    • Opcode ID: 8f75aa0f25e001a35e037801d3004651ea934c7664730159f0328fcf5a27bd42
    • Instruction ID: adc57632571f51d906e13e5afcc5773653041a57ba3400dd67d62453b2811afe
    • Opcode Fuzzy Hash: 8f75aa0f25e001a35e037801d3004651ea934c7664730159f0328fcf5a27bd42
    • Instruction Fuzzy Hash: 54417F33A04B01CAEB109F24D4503BC77A4FBA8B58F464235EA1E87794DF7AE558D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69DA94, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84memoryCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$Alloc$FreeVariant$ClearInit
    • String ID: __EventProviderCacheControl=@$__ObjectProviderCacheControl=@
    • API String ID: 2896020287-2580875564
    • Opcode ID: dceccf2cae2346d73daf8f65b4abcf32c6ea89e677fd9e32a439cd3da5fc9f33
    • Instruction ID: 29a9568a8a4d5a7819ced332960b06af1550a0ffe1a1a28b9eec6f8c66df61be
    • Opcode Fuzzy Hash: dceccf2cae2346d73daf8f65b4abcf32c6ea89e677fd9e32a439cd3da5fc9f33
    • Instruction Fuzzy Hash: C1414C77608F4682DB108F56E040369B7A0FB9DB94F524132EA4D83B28DFBED155DB09
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69C69C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80registrymemoryCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6EE69C6BC
    • RegDisablePredefinedCache.ADVAPI32 ref: 00007FF6EE69C72A
      • Part of subcall function 00007FF6EE697C2C: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6EE697C8C
      • Part of subcall function 00007FF6EE697C2C: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6EE697CCF
      • Part of subcall function 00007FF6EE697C2C: EventRegister.API-MS-WIN-EVENTING-PROVIDER-L1-1-0 ref: 00007FF6EE697D63
    • EtwUnregisterTraceGuids.NTDLL ref: 00007FF6EE69C7D2
      • Part of subcall function 00007FF6EE69C9DC: GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,00007FF6EE69C74D), ref: 00007FF6EE69C9FC
      • Part of subcall function 00007FF6EE69C9DC: wcstok.MSVCRT ref: 00007FF6EE69CA1B
      • Part of subcall function 00007FF6EE69C9DC: wcstok.MSVCRT ref: 00007FF6EE69CA30
      • Part of subcall function 00007FF6EE69C9DC: CompareStringW.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,00007FF6EE69C74D), ref: 00007FF6EE69CA6D
      • Part of subcall function 00007FF6EE69C9DC: CompareStringW.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,00007FF6EE69C74D), ref: 00007FF6EE69CAA0
      • Part of subcall function 00007FF6EE69C9DC: CompareStringW.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,00007FF6EE69C74D), ref: 00007FF6EE69CACF
      • Part of subcall function 00007FF6EE69C9DC: wcstok.MSVCRT ref: 00007FF6EE69CAEB
    • DestroyWindow.USER32 ref: 00007FF6EE69C78A
    • UnregisterClassW.USER32 ref: 00007FF6EE69C7A0
      • Part of subcall function 00007FF6EE69C890: LoadIconW.USER32 ref: 00007FF6EE69C8CA
      • Part of subcall function 00007FF6EE69C890: LoadCursorW.USER32 ref: 00007FF6EE69C8E5
      • Part of subcall function 00007FF6EE69C890: RegisterClassW.USER32 ref: 00007FF6EE69C91E
      • Part of subcall function 00007FF6EE69C890: CreateWindowExW.USER32 ref: 00007FF6EE69C964
      • Part of subcall function 00007FF6EE69C890: ShowWindow.USER32 ref: 00007FF6EE69C978
      • Part of subcall function 00007FF6EE69C890: UpdateWindow.USER32 ref: 00007FF6EE69C987
      • Part of subcall function 00007FF6EE69C890: GetSystemMenu.USER32 ref: 00007FF6EE69C998
      • Part of subcall function 00007FF6EE69C890: DeleteMenu.USER32 ref: 00007FF6EE69C9B4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Window$CompareHeapStringwcstok$ClassLoadMenuRegisterUnregister$AllocCacheCommandCreateCursorDeleteDestroyDisableEventGuidsIconInformationLinePredefinedProcessShowSystemTraceUpdate
    • String ID: Wmi Provider Host
    • API String ID: 143112325-660353315
    • Opcode ID: acf7dc74e7269a57921760be4d024ab2fb519413accd334ab9636eb3cfa467b5
    • Instruction ID: 253a758b545277f8fac5b70726153f5b491a25b794004fc4a8c25b0a4894d1a0
    • Opcode Fuzzy Hash: acf7dc74e7269a57921760be4d024ab2fb519413accd334ab9636eb3cfa467b5
    • Instruction Fuzzy Hash: DA413B37918A4296E7009F10E8403B47BA4FF64B84B664136F94DCA665DFBFF424E70A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69C174, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Object$ConnectCreateEventFormatLog@@MemorySourceWithWrite@
    • String ID: ProviderSubSystem$root\cimv2
    • API String ID: 3037073835-474028568
    • Opcode ID: fd2e6e4c3f93275b1b9ed7dd8d4af24b48827d0ba8df2ab954d451dc1091ddbb
    • Instruction ID: 9eb0c970fc50ec74bc0f64247217135a00c9645ffa6ae2e16ba066aab040d2dd
    • Opcode Fuzzy Hash: fd2e6e4c3f93275b1b9ed7dd8d4af24b48827d0ba8df2ab954d451dc1091ddbb
    • Instruction Fuzzy Hash: E6319437A08B4286EB108F05E44437877A1FBA8B44FA64435EA0D83354DFBEE546D749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69F884, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39registryCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CloseOpenQueryValue
    • String ID: DefaultRpcStackSize$Software\Microsoft\Wbem\Cimom
    • API String ID: 3677997916-1710159536
    • Opcode ID: e55298bf2c94b6b169dae4c27c82baacbd020aeb8c2c6be4b892d8d5ab4d0de4
    • Instruction ID: d00eba69783ff78ef0be4175e12ca143cf84a6349651b4562fda3ae02f435ede
    • Opcode Fuzzy Hash: e55298bf2c94b6b169dae4c27c82baacbd020aeb8c2c6be4b892d8d5ab4d0de4
    • Instruction Fuzzy Hash: DF116D37A08A419AE7108F14E40072ABBB0FB95354F914235FA8C82768DFBED118DF05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69F978, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31registryCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CloseOpenQueryValue
    • String ID: Sink Transmit Buffer Size$Software\Microsoft\WBEM\CIMOM
    • API String ID: 3677997916-3607532515
    • Opcode ID: 0caf20f3fc621c95a47c2ce3296a8ad7ab2ef3a846648a516cf08344389450f7
    • Instruction ID: fba4dd7352038c3d85c56cd705b00f1593b32a11ab93b8d04a96d2703cba533b
    • Opcode Fuzzy Hash: 0caf20f3fc621c95a47c2ce3296a8ad7ab2ef3a846648a516cf08344389450f7
    • Instruction Fuzzy Hash: 3201C93AA08B41C6D7109F54F840669BB70FB9A754F914231EA4D83764DFBED114DF09
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69A164, Relevance: 7.6, APIs: 5, Instructions: 55COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Close$Handle$ChangeCriticalDeleteFindNotificationSection
    • String ID:
    • API String ID: 2366415780-0
    • Opcode ID: 887c3cca207599f24ad1a6ba64e49930058a7cb00094a3e78fed6c74b8173d6d
    • Instruction ID: e85d12378477436de5102c6e61f2d023111e4fc3145056b14b4be7d391b256c0
    • Opcode Fuzzy Hash: 887c3cca207599f24ad1a6ba64e49930058a7cb00094a3e78fed6c74b8173d6d
    • Instruction Fuzzy Hash: 9521A237A09A418AEB00AF64D01437C77A0FFA6F55F5A9630E91E832A1CF6BD445D31A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69BBB4, Relevance: 4.5, APIs: 3, Instructions: 18windowCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Message$DispatchTranslate
    • String ID:
    • API String ID: 1706434739-0
    • Opcode ID: d01fa456b169024905821af58e566ef6aae29338f380d2e2354b80fbef61be83
    • Instruction ID: edda451d31903109859944e2924471f712036410b9bb29eaba8757b980826f4e
    • Opcode Fuzzy Hash: d01fa456b169024905821af58e566ef6aae29338f380d2e2354b80fbef61be83
    • Instruction Fuzzy Hash: 3EE09233918881C3E2209B14E858279BB30FBEA709BD64130E64E816A8DF3ED108DB08
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE699CC0, Relevance: 3.1, APIs: 2, Instructions: 93COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00007FF6EE698490: NtQuerySystemInformation.NTDLL ref: 00007FF6EE6984E8
      • Part of subcall function 00007FF6EE698490: GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6EE698513
    • GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6EE6AB4F1
    • TerminateProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6EE6AB505
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Process$Current$InformationQuerySystemTerminate
    • String ID:
    • API String ID: 3934176361-0
    • Opcode ID: 9e8c0b4e96c77d085304ef45b624f7b61937b1fb198f676b9f76498d6e332834
    • Instruction ID: a1e5a9e8ede0c8b6f9b163d8572f5d83a7b4f9427833eb279e0bc23c3be0047b
    • Opcode Fuzzy Hash: 9e8c0b4e96c77d085304ef45b624f7b61937b1fb198f676b9f76498d6e332834
    • Instruction Fuzzy Hash: 6141A433A48A4681EB009B26E8503787760FF99F94F564231EA1EC33A5DFBED405D706
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69A0B4, Relevance: 3.1, APIs: 2, Instructions: 66COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AllocateHeap
    • String ID:
    • API String ID: 1279760036-0
    • Opcode ID: 18ad28867c11d85dcee626c3599d483ba0aec4071da85a5e326870dc1cdce650
    • Instruction ID: ce7c94b1a690a56b61ee0215bb728b59ed8d945c71f2c3b3afe3fafef21a1d10
    • Opcode Fuzzy Hash: 18ad28867c11d85dcee626c3599d483ba0aec4071da85a5e326870dc1cdce650
    • Instruction Fuzzy Hash: 07316E33A18A0286FB009F10E8543743BA4FF65745FA65035E90D863A1DFBFE459E70A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69B194, Relevance: 1.5, APIs: 1, Instructions: 41threadCOMMON
    Download Yara Rule
    APIs
    • CreateThread.KERNELBASE ref: 00007FF6EE69B1D1
      • Part of subcall function 00007FF6EE69B234: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6EE69B29C
      • Part of subcall function 00007FF6EE69FA20: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69FA2A
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AllocCreateCriticalHeapLeaveSectionThread
    • String ID:
    • API String ID: 3522657792-0
    • Opcode ID: bca23a1166f8ba30ba3b858a4079989081ac05bba6f538450568af6b9ad981d5
    • Instruction ID: e66b77cdd573080b9d7514d77c48cf18548d3576abcb49690c323fa286625178
    • Opcode Fuzzy Hash: bca23a1166f8ba30ba3b858a4079989081ac05bba6f538450568af6b9ad981d5
    • Instruction Fuzzy Hash: 8611AC37608B4582EB009F24E4403B977B0FB58B84FA64131EA4C87365DFBED459D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE699D18, Relevance: 1.5, APIs: 1, Instructions: 32COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 3cce4a06a9f02964a55e763556b23a1c041e33f0a21067738e2a78e5354bd037
    • Instruction ID: e57beceec4f5284d4ef21a0669510d9d679564112dfbd9c96005264f732f94b7
    • Opcode Fuzzy Hash: 3cce4a06a9f02964a55e763556b23a1c041e33f0a21067738e2a78e5354bd037
    • Instruction Fuzzy Hash: 38012133E18602C6F7149F21A8957353761AF69701F965435E80EC6250CEBFB459E70A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69B120, Relevance: 1.5, APIs: 1, Instructions: 31COMMON
    Download Yara Rule
    APIs
    • SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69B149
      • Part of subcall function 00007FF6EE69A940: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69A9D7
      • Part of subcall function 00007FF6EE69A940: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69AA2C
      • Part of subcall function 00007FF6EE69A940: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69AA7B
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CriticalLeaveSection$Event
    • String ID:
    • API String ID: 3363972230-0
    • Opcode ID: 468f4079afd67c253c0e160e91c45eccd527b1185a2bf9d558737bf88757af60
    • Instruction ID: 5dead61af643f0307a3f6be1e104b89f9723ef2dfd4cb49cbbc103d0dc9d8349
    • Opcode Fuzzy Hash: 468f4079afd67c253c0e160e91c45eccd527b1185a2bf9d558737bf88757af60
    • Instruction Fuzzy Hash: 5AF04F2B714B0A86DB00AF2AE89023827B0FF99F947574131EE1E83330DE7DC4559705
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69C808, Relevance: 1.5, APIs: 1, Instructions: 29COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: GuidsRegisterTrace
    • String ID:
    • API String ID: 3540399512-0
    • Opcode ID: 6821b378e45b07a1ce288d0b40075502476f32c7685eccd2cacab646a47effcc
    • Instruction ID: 906b289a6c8319b9a6974bda2af2a020d78d76a4aafa3f242098e235fc8ee838
    • Opcode Fuzzy Hash: 6821b378e45b07a1ce288d0b40075502476f32c7685eccd2cacab646a47effcc
    • Instruction Fuzzy Hash: 6C011A33618B4592D7108F01F1403A9B774F758B88F694235EB8C4B658DF7ED564C749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69B320, Relevance: 1.5, APIs: 1, Instructions: 29synchronizationCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00007FF6EE69B194: CreateThread.KERNELBASE ref: 00007FF6EE69B1D1
    • WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6EE6C7390), ref: 00007FF6EE69B349
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CreateObjectSingleThreadWait
    • String ID:
    • API String ID: 1891408510-0
    • Opcode ID: d0bbf05717f960358e330a993c2b347ad261e14c4f4a8875d1ffb17c9922de24
    • Instruction ID: a58cc0cd2a905f5fc28af5b4f113155b99cc5761acf7223bae8a9ad59a77d40a
    • Opcode Fuzzy Hash: d0bbf05717f960358e330a993c2b347ad261e14c4f4a8875d1ffb17c9922de24
    • Instruction Fuzzy Hash: 50F03033E18546D6E750CF29D48137973A0EF68B94F214034EA0DC7259FE6BE8909B49
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE698440, Relevance: 1.5, APIs: 1, Instructions: 25memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AllocateHeap
    • String ID:
    • API String ID: 1279760036-0
    • Opcode ID: 5e5c636c68ae9ceaf29c88842d810163a31ceaa73c8eee9b0867bba47d92b475
    • Instruction ID: 19cbbffc1ea232d580b9b693b54b4485da789134730e5a61295e957c513d4f38
    • Opcode Fuzzy Hash: 5e5c636c68ae9ceaf29c88842d810163a31ceaa73c8eee9b0867bba47d92b475
    • Instruction Fuzzy Hash: 2FE09253E1A70681FE558B52984033427A0AFBCF41F6E4430EE0DC6381EFBEF850A65A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69FE78, Relevance: 1.5, APIs: 1, Instructions: 11COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Free
    • String ID:
    • API String ID: 3978063606-0
    • Opcode ID: 2d49d7b125421083320701a9310e85dacbaaab062d48e9bc65b14fdeaf88b777
    • Instruction ID: 861b6b5621b074ed6974f1261c11d72e221a527257616d3e484140f4aea56f52
    • Opcode Fuzzy Hash: 2d49d7b125421083320701a9310e85dacbaaab062d48e9bc65b14fdeaf88b777
    • Instruction Fuzzy Hash: 0FD05E36C04A4286D1345B24AC051383B21BBA6334BA60324F1BE852F4CF7DA016DB05
    Uniqueness

    Uniqueness Score: -1.00%

    Non-executed Functions

    Function 00007FF6EE6922D0, Relevance: 160.6, APIs: 66, Strings: 25, Instructions: 1398memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Variant$ClearInit$String$Alloc$Free
    • String ID: CLSID$ClientLoadableCLSID$ConcurrentIndependantRequests$DefaultMachineName$DefaultNetworkServiceHost$Enabled$HostingModel$ImpersonationLevel$InitializationReentrancy$InitializationTimeoutInterval$InitializeAsAdminFirst$Name$OperationTimeoutInterval$PerLocaleInitialization$PerUserInitialization$Pure$SecurityDescriptor$SupportsQuotas$SupportsSendStatus$SupportsShutdown$SupportsThrottling$UnloadTimeout$Version$__NAMESPACE$__RELPATH
    • API String ID: 2302583246-829198682
    • Opcode ID: 0b41557d9a72976ef50d1907882301312694f3173bc941d16f0a2dbda55ff086
    • Instruction ID: 4e0ac95a8b1ea22e1b39fd5f1c7bbb64a51744d1a31684dfc84ec878d325744b
    • Opcode Fuzzy Hash: 0b41557d9a72976ef50d1907882301312694f3173bc941d16f0a2dbda55ff086
    • Instruction Fuzzy Hash: 60E27337A48A52C6EB209F14E4403B977A0FBA5748F524135EB4E83664DFBFE448E709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6D0AC4, Relevance: 120.0, APIs: 48, Strings: 20, Instructions: 961COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Variant$ClearInit$String$ArraySafe$Bound$ElementFree
    • String ID: CacheRefreshInterval$InteractionType$PerUserSchema$QuerySupportLevels$ReSynchroniseOnNamespaceOpen$ReferencedSetQueries$ResultSetQueries$SupportsBatching$SupportsDelete$SupportsEnumeration$SupportsGet$SupportsPut$SupportsTransactions$UnSupportedQueries$Version$WQL:Associators$WQL:References$WQL:UnarySelect$WQL:V1ProviderDefined$__ClassProviderRegistration
    • API String ID: 3756312870-3152331778
    • Opcode ID: ed9d752fe71a02e59acae1870345c69a7a688dbb0f0e1a98738882664f1c25a3
    • Instruction ID: 0f52407202e7e7a230e208685fe84cfb4ec29bcb5cfd205d7de0fe34800c4362
    • Opcode Fuzzy Hash: ed9d752fe71a02e59acae1870345c69a7a688dbb0f0e1a98738882664f1c25a3
    • Instruction Fuzzy Hash: 54A2653BA08741C7E720AF10D4802BD77B4FB69748BA24135EA4D83A54DFBEE558DB09
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6B1264, Relevance: 65.2, APIs: 35, Strings: 2, Instructions: 493memoryregistryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Initialize$AllocateLength$CopyDescriptorFreeSecurity$DaclGroupHeapLog@@MakeMemoryObjectOwnerRelativeSelfValueWrite@
    • String ID: LaunchPermission$Microsoft WMI Provider Subsystem Host
    • API String ID: 2460958007-1944748634
    • Opcode ID: 61bba1533552776ee4d8420f2578fb51a79de3e89371a7012b178bff525ffa86
    • Instruction ID: 178277da047191335c6a84e3e2cc2da431da502134a4f69af189155d0fadd20d
    • Opcode Fuzzy Hash: 61bba1533552776ee4d8420f2578fb51a79de3e89371a7012b178bff525ffa86
    • Instruction Fuzzy Hash: AC329D33B086818BE7109F61E4402BD7BB0FB99B84B525135EE0EA7B98DF7AD405DB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BDFD0, Relevance: 63.5, APIs: 9, Strings: 27, Instructions: 475memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$Variant$AllocClearCurrentFreeInitLog@@MemoryObjectProcessWrite@
    • String ID: HostProcessIdentifier$Msft_Providers$ProviderOperation_AccessCheck$ProviderOperation_CancelQuery$ProviderOperation_CreateClassEnumAsync$ProviderOperation_CreateInstanceEnumAsync$ProviderOperation_CreateRefreshableEnum$ProviderOperation_CreateRefreshableObject$ProviderOperation_CreateRefresher$ProviderOperation_DeleteClassAsync$ProviderOperation_DeleteInstanceAsync$ProviderOperation_ExecMethodAsync$ProviderOperation_ExecNotificationQueryAsync$ProviderOperation_ExecQueryAsync$ProviderOperation_FindConsumer$ProviderOperation_GetObjectAsync$ProviderOperation_GetObjects$ProviderOperation_GetProperty$ProviderOperation_NewQuery$ProviderOperation_ProvideEvents$ProviderOperation_PutClassAsync$ProviderOperation_PutInstanceAsync$ProviderOperation_PutProperty$ProviderOperation_QueryInstances$ProviderOperation_SetRegistrationObject$ProviderOperation_StopRefreshing$ProviderOperation_ValidateSubscription
    • API String ID: 2174166760-2198336999
    • Opcode ID: 8d0b8ce01f6127dde1bd504b74c3466ba5d36308da6c1758d7ba40e69e197a5e
    • Instruction ID: 69971e1f38b9e8aa6c517f06103deeb69be6d07c5a9eb78f1a6aa80ebc6f84a8
    • Opcode Fuzzy Hash: 8d0b8ce01f6127dde1bd504b74c3466ba5d36308da6c1758d7ba40e69e197a5e
    • Instruction Fuzzy Hash: 6A426F77614B9A86DB10CF15E8806A97BA5FB9CB98F425136EE4D83B28DF7DC104CB04
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BD580, Relevance: 63.5, APIs: 9, Strings: 27, Instructions: 475memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$Variant$AllocClearCurrentFreeInitLog@@MemoryObjectProcessWrite@
    • String ID: HostProcessIdentifier$Msft_Providers$ProviderOperation_AccessCheck$ProviderOperation_CancelQuery$ProviderOperation_CreateClassEnumAsync$ProviderOperation_CreateInstanceEnumAsync$ProviderOperation_CreateRefreshableEnum$ProviderOperation_CreateRefreshableObject$ProviderOperation_CreateRefresher$ProviderOperation_DeleteClassAsync$ProviderOperation_DeleteInstanceAsync$ProviderOperation_ExecMethodAsync$ProviderOperation_ExecNotificationQueryAsync$ProviderOperation_ExecQueryAsync$ProviderOperation_FindConsumer$ProviderOperation_GetObjectAsync$ProviderOperation_GetObjects$ProviderOperation_GetProperty$ProviderOperation_NewQuery$ProviderOperation_ProvideEvents$ProviderOperation_PutClassAsync$ProviderOperation_PutInstanceAsync$ProviderOperation_PutProperty$ProviderOperation_QueryInstances$ProviderOperation_SetRegistrationObject$ProviderOperation_StopRefreshing$ProviderOperation_ValidateSubscription
    • API String ID: 2174166760-2198336999
    • Opcode ID: 75a332b072a2d772100f8de9ce77e8d87328dff64c648ec8a7289b55530ed476
    • Instruction ID: 04de33dfd9b4694046f41c3260fb2c6ba939b8990252864654e485613d3d4b6c
    • Opcode Fuzzy Hash: 75a332b072a2d772100f8de9ce77e8d87328dff64c648ec8a7289b55530ed476
    • Instruction Fuzzy Hash: EF427F77614B9686DB10CF19E8806A97BA5FB9CB98F425136EE4D83B28DF7DC104CB04
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6B34EC, Relevance: 45.9, APIs: 25, Strings: 1, Instructions: 383memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Initialize$Allocate$CopyFreeLength$DescriptorSecurity$DaclHeapLog@@MemoryObjectWrite@
    • String ID: Global\Wmi Provider Sub System Counters
    • API String ID: 790938941-3057216162
    • Opcode ID: e1216f7808de3b9d06fc073dab8606a9bba8e613695bbb048467e4e7537ccedd
    • Instruction ID: d204ea2ebbb467e0906879db999d274ea035f8e0ea6b16cdec8ae478c0a72eeb
    • Opcode Fuzzy Hash: e1216f7808de3b9d06fc073dab8606a9bba8e613695bbb048467e4e7537ccedd
    • Instruction Fuzzy Hash: 78026F37B086818AE7109F21E4406BE7BB0FB99B48B525135FE4D93B68DFBAD404D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6B1E60, Relevance: 40.7, APIs: 14, Strings: 9, Instructions: 488registryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Close$CreateValue$FileFreeHeapModuleNameOpen
    • String ID: ?$APPID\$AppIDFlags$AppId$Both$CLSID\$LocalServer32$NotInsertable$ThreadingModel
    • API String ID: 807124017-932693166
    • Opcode ID: bbd784c193a6f99d01535bc95273eda68c77843abdbcc585b6de6f5158c611f5
    • Instruction ID: 4253975f1cb0143128316d11d5677251fdfa016dee648ed2fdf8683f5e86b41a
    • Opcode Fuzzy Hash: bbd784c193a6f99d01535bc95273eda68c77843abdbcc585b6de6f5158c611f5
    • Instruction Fuzzy Hash: B7128E67F1868295EA209F21D8103BA63A4FFA4B84F524131FA0DC7B99DFBED504D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6CE9E8, Relevance: 39.4, APIs: 26, Instructions: 430COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: DescriptorSecurity$Make$InitializeLength$AbsoluteErrorGroupInformationLastOwnerRelativeSelf$AllocateCopyDaclHeapmemmove
    • String ID:
    • API String ID: 1094331661-0
    • Opcode ID: 400b851a78be5933eafcb84392394e27d0459f2086d4391a6583a3e5d5f53fac
    • Instruction ID: 175bc1a5233cec8c98ef6416f0180efb6af8a52f0efc347b8ee513eeabce20f3
    • Opcode Fuzzy Hash: 400b851a78be5933eafcb84392394e27d0459f2086d4391a6583a3e5d5f53fac
    • Instruction Fuzzy Hash: 69125027B08A428AEB109F61A4403BD77F1BF59B88B524035EE0D9B754DFBEE405E709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6938C4, Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 200registryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CloseOpenQueryValue
    • String ID: DefaultSecuredHost$SOFTWARE\Microsoft\WBEM\CIMOM\CompatibleHostProviders$SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders$Software\Microsoft\WBEM\CIMOM
    • API String ID: 3677997916-590304595
    • Opcode ID: fdbb5d6d12196acb7d215e2e40c34db746e3ff7e2cae11550d2896073631a190
    • Instruction ID: e9c110d1c3c9181f1d271f8eb0a8448d340f9538ffaaaed3c51bf4bcce9eca06
    • Opcode Fuzzy Hash: fdbb5d6d12196acb7d215e2e40c34db746e3ff7e2cae11550d2896073631a190
    • Instruction Fuzzy Hash: 0E91B037E04B61CAE7208F60E4406BD7BA0FB59B98B825235EE4E83B04DF79D544DB45
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6D5F00, Relevance: 26.9, APIs: 13, Strings: 2, Instructions: 609COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String
    • String ID: Lower$Upper
    • API String ID: 2568140703-361161821
    • Opcode ID: e497a0a6e5dfa857643ed9bf1c3a61973be6c5d88d32219b51fc515d7ae34baa
    • Instruction ID: f6eb382de37f1e63a065112ac91f51284f205e19f517978edc15a9f19e2e4e1a
    • Opcode Fuzzy Hash: e497a0a6e5dfa857643ed9bf1c3a61973be6c5d88d32219b51fc515d7ae34baa
    • Instruction Fuzzy Hash: CA42F837E0974285E714AF51A4003BD27A0FB64798FA64035E94E87B85DF7EE440EB45
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6AEA6C, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 162windowsleepCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Message$ErrorLastMultipleObjectsWait$DispatchPeekSleepTranslate
    • String ID: :
    • API String ID: 2223531894-336475711
    • Opcode ID: 54a36b7c58106e23defce4ad74a69fd5b3be9f2f3bd5310a8d0a736bead4d9e2
    • Instruction ID: 83a6bb56ecb0f83bdbcb8d6fed428cb34809e5f5e87e8a9835c8e2d9b898317d
    • Opcode Fuzzy Hash: 54a36b7c58106e23defce4ad74a69fd5b3be9f2f3bd5310a8d0a736bead4d9e2
    • Instruction Fuzzy Hash: 3461B533E9866286F6608BA8E44437D6791FBA9754F524131FA0F83690CF7EE484D70A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69775C, Relevance: 12.8, APIs: 8, Instructions: 770synchronizationCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Object$CommitSingleWait
    • String ID:
    • API String ID: 4292635895-0
    • Opcode ID: daecce16aa0192b35a5f89d88524924fe1bfeb1900bdc9605bb976dc922bd1cc
    • Instruction ID: ac09e811f873c34f591809178a4b8a274a1dc8df88817d828b8599ffc989fbef
    • Opcode Fuzzy Hash: daecce16aa0192b35a5f89d88524924fe1bfeb1900bdc9605bb976dc922bd1cc
    • Instruction Fuzzy Hash: 1C829537A0CB8682DB20DF15E4403A9B7A1FB94B94F624035EA8D87754CFBEE445DB09
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C9B00, Relevance: 12.6, APIs: 8, Instructions: 594synchronizationCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Object$Commit$SingleThreadTokenWait$CloseCurrentHandleInformationLog@@MemoryOpenWrite@
    • String ID:
    • API String ID: 2682698108-0
    • Opcode ID: 88f463e200b10d83fc9a013829797b036701c6059566ea4c3ae31ca0c64e73da
    • Instruction ID: a5965b860b0fcba9cbc7503cdf96a4015ae413b2b6b41580c5e416f75c7f0eb0
    • Opcode Fuzzy Hash: 88f463e200b10d83fc9a013829797b036701c6059566ea4c3ae31ca0c64e73da
    • Instruction Fuzzy Hash: 2D428133708B8686EB10CF65E4802A9B7A1FB98B94F124135EE4E87754CFBEE454DB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6AF868, Relevance: 12.1, APIs: 8, Instructions: 135sleepwindowCOMMON
    Download Yara Rule
    APIs
    • MsgWaitForMultipleObjects.USER32 ref: 00007FF6EE6AF902
    • PeekMessageW.USER32 ref: 00007FF6EE6AF98E
    • WaitForMultipleObjectsEx.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EE6AF819), ref: 00007FF6EE6AF9B1
    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EE6AF819), ref: 00007FF6EE6AF9E1
    • Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EE6AF819), ref: 00007FF6EE6AF9FC
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: MultipleObjectsWait$ErrorLastMessagePeekSleep
    • String ID:
    • API String ID: 1890068862-0
    • Opcode ID: 5d8e7b178e1a7d3ff2e1484ac7b2fdb8143ac09070fe3f97731f7d6b66ea428a
    • Instruction ID: c31d2778a2f20d7fe6b608277900eff1907a23e8143b6fb035a3b830399a27ae
    • Opcode Fuzzy Hash: 5d8e7b178e1a7d3ff2e1484ac7b2fdb8143ac09070fe3f97731f7d6b66ea428a
    • Instruction Fuzzy Hash: CF518F33E44A52CAF7608F21E4803BC77A0FB29B44F5A5231EA0ED2654CF7AD454D70A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6AFF50, Relevance: 12.1, APIs: 8, Instructions: 109sleepwindowCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: MultipleObjectsWait$ErrorLastMessagePeekSleep
    • String ID:
    • API String ID: 1890068862-0
    • Opcode ID: f06a71133979ee200c8f002aac760af63754c7724974ffb011682881722a08e2
    • Instruction ID: 4f2dfaf4e2a5eb4032b66413f82c9cd561ca0a0dfd5265fa594a1aba1012f118
    • Opcode Fuzzy Hash: f06a71133979ee200c8f002aac760af63754c7724974ffb011682881722a08e2
    • Instruction Fuzzy Hash: DE418F33E08A02CAFB608B65D84477D7BA1FB69758F924135EA0DC2648CFBAD444D70A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6AFC40, Relevance: 12.1, APIs: 8, Instructions: 105windowsleepCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Message$MultipleObjectsWait$DispatchErrorLastPeekSleepTranslate
    • String ID:
    • API String ID: 1449207833-0
    • Opcode ID: 3ff2884ba3b3a468489f0cfc5135bbe4a0ffa616ee2fae1fda9384e7e3f3496d
    • Instruction ID: 86cbda7b18734e829f733d72ba642b0b9dfc469ec8f5045162dfaf81a77de62b
    • Opcode Fuzzy Hash: 3ff2884ba3b3a468489f0cfc5135bbe4a0ffa616ee2fae1fda9384e7e3f3496d
    • Instruction Fuzzy Hash: 61419D33E48A1286F7609B65D84477D3BA0FB5A714F924235EA0EC7680CF7ED444E70A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C728C, Relevance: 9.6, APIs: 6, Instructions: 550synchronizationCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Object$CommitHeapSingleWait$AllocateFreeLog@@MemoryWrite@
    • String ID:
    • API String ID: 2534703132-0
    • Opcode ID: b1c0253f40eb63f2207106d9ed5a15c298f470d6fc0bb09924dad90fe44d2ccf
    • Instruction ID: 144b0e7ffcc45a1c0b7c734a9282f00669a1eba72b5dbd0dcdb2015604eea9e9
    • Opcode Fuzzy Hash: b1c0253f40eb63f2207106d9ed5a15c298f470d6fc0bb09924dad90fe44d2ccf
    • Instruction Fuzzy Hash: 9C428C37B08B4686EB00CB66E88066D7BB4FB58B98F120135EE4D8B764DF7AE450D705
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A2E94, Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
    • String ID:
    • API String ID: 4104442557-0
    • Opcode ID: 5a2420faf78a2611e95b285a4fdd0f065f2ee18ea06d2d75afacdf71e5ef3990
    • Instruction ID: 5b5f6e9c3b6af35fcff11b178a6a8d6e2de46f78d6161f060cb5432964bed5bf
    • Opcode Fuzzy Hash: 5a2420faf78a2611e95b285a4fdd0f065f2ee18ea06d2d75afacdf71e5ef3990
    • Instruction Fuzzy Hash: 18118C26A04F458AEB00DF60E8453A833A0FB29758F511A30FA6DC3754EFBDD1A48784
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69B8FC, Relevance: 4.6, APIs: 3, Instructions: 108COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00007FF6EE69BB78: InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000248BBAAE6F0,00007FF6EE69BAB7,?,?,00000000,00007FF6EE697DA2), ref: 00007FF6EE69BB88
    • CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69B9FD
    • CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69BA27
    • CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE69BA55
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CreateEvent$CountCriticalInitializeSectionSpin
    • String ID:
    • API String ID: 1354401513-0
    • Opcode ID: 73766af3980474a927c25c160ea3e7e355073ad924cf15d8011c94569e302796
    • Instruction ID: 3353d35b9f2492f1bcfab76127e1ae2ab2deed7cea5db5a712685d7ff1c05fc8
    • Opcode Fuzzy Hash: 73766af3980474a927c25c160ea3e7e355073ad924cf15d8011c94569e302796
    • Instruction Fuzzy Hash: 6A413A36A04B858BE7288F2AF45076EB7A4F750B40F54922DD7DA83B60DF79E0548708
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE694E10, Relevance: 42.5, APIs: 16, Strings: 8, Instructions: 466memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$Variant$AllocClearFreeInit
    • String ID: Wql$__CLASS$__ClassProviderRegistration$__EventConsumerProviderRegistration$__EventProviderRegistration$__InstanceProviderRegistration$__MethodProviderRegistration$__PropertyProviderRegistration
    • API String ID: 1513835179-260539986
    • Opcode ID: cbbb1584397e2e213482b745d6472324ae71bd7b0c8cfb7997f40ed33c766206
    • Instruction ID: 2f5a642aeb62babaa7ec0ccd88f36c21b1a3a0effcc04b12c9da74917040abb4
    • Opcode Fuzzy Hash: cbbb1584397e2e213482b745d6472324ae71bd7b0c8cfb7997f40ed33c766206
    • Instruction Fuzzy Hash: B7228133A086568AE7209F20D0503FD37A0FB24B48F824136EE4D97694EFBEE555E749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69BCD4, Relevance: 30.3, APIs: 20, Instructions: 259memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Copy$Allocate$FreeInitializeLength$Heap
    • String ID:
    • API String ID: 3030590722-0
    • Opcode ID: 03ab739749bbe2d38b0a7099b7feefe2b184a46a67dc48670b54e31ab210f187
    • Instruction ID: 3a45ba4784f4a69e1fe5d46005fe8c0d5635689cc2d3cbdcacea6b21d2732d8d
    • Opcode Fuzzy Hash: 03ab739749bbe2d38b0a7099b7feefe2b184a46a67dc48670b54e31ab210f187
    • Instruction Fuzzy Hash: 7AD17D33A15B928AD7108F20E4402B87BB0FFA9B08B169136FA4D87750DFBEE415D749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A0A50, Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 344memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AllocVariant$ClearString$CommitHeapInitObject
    • String ID: ExecMethodAsync$__GET_EXTENSIONS$__GET_EXT_CLIENT_REQUEST$__GET_EXT_KEYS_ONLY$__GET_EXT_PROPERTIES
    • API String ID: 444761291-2842013111
    • Opcode ID: 6f4937fcb200931e547b8134f240165f687af337a014294fe7a7e8294dcd4bc1
    • Instruction ID: 8d60371725d674f2d6d24afe6484ff67ce0e2106304ab36790c92cf5df0ef3dd
    • Opcode Fuzzy Hash: 6f4937fcb200931e547b8134f240165f687af337a014294fe7a7e8294dcd4bc1
    • Instruction Fuzzy Hash: E5F19F37A08B4686EB509F15E84076977A0FB99F84F564132EE0E83364CFBEE444E709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6933F0, Relevance: 24.9, APIs: 4, Strings: 10, Instructions: 390COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String
    • String ID: Decoupled:Com$Decoupled:NonCom$LocalServiceHost$LocalSystemHost$LocalSystemHostOrSelfHost$NetworkServiceHost$NetworkServiceHostOrSelfHost$SelfHost$WmiCore$WmiCoreOrSelfHost
    • API String ID: 2568140703-1063480193
    • Opcode ID: 6995557c7da7ad3b8f8819eb5aa20e1c2201710b0ae1a009ceb6a83151656fd4
    • Instruction ID: 21d1193eed6938cb8dfe100d9bf32979acfa1a9bf92e2426c027518d803c34d0
    • Opcode Fuzzy Hash: 6995557c7da7ad3b8f8819eb5aa20e1c2201710b0ae1a009ceb6a83151656fd4
    • Instruction Fuzzy Hash: AAF19377E4826296E7209F1594503BD37A0FB24B88F524036FA4D876A4DFBFE454E30A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A12B0, Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 312memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Variant$AllocClear$CommitHeapInitObjectString
    • String ID: CreateInstanceEnumAsync$__GET_EXTENSIONS$__GET_EXT_CLIENT_REQUEST$__GET_EXT_KEYS_ONLY$__GET_EXT_PROPERTIES
    • API String ID: 461702680-1040527617
    • Opcode ID: 687cc5f9d246874947e7b3fcec245eb77291b6a0a44ce2616fa293540fd25461
    • Instruction ID: 795cd9554d2c5a904d4ee38bb5b30669c279768f028133b9f4603e07f7a119d6
    • Opcode Fuzzy Hash: 687cc5f9d246874947e7b3fcec245eb77291b6a0a44ce2616fa293540fd25461
    • Instruction Fuzzy Hash: 18E18D37A08B4682EB109F15E8443A877A0FB99F90F564132EE0E83760DFBEE405D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A02F0, Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 311memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Variant$AllocClear$CommitHeapInitObjectString
    • String ID: GetObjectAsync$__GET_EXTENSIONS$__GET_EXT_CLIENT_REQUEST$__GET_EXT_KEYS_ONLY$__GET_EXT_PROPERTIES
    • API String ID: 461702680-2040179058
    • Opcode ID: 6c2c97ec7de86791dcb095eae594e29e156491c513dd4c4c57c78e9c48c69fe6
    • Instruction ID: b73d6acda9975cb317307864eab029fd40561f19afb043b216a06f6f2109944e
    • Opcode Fuzzy Hash: 6c2c97ec7de86791dcb095eae594e29e156491c513dd4c4c57c78e9c48c69fe6
    • Instruction Fuzzy Hash: 3AE1BD3BA08B5686EB509F15E84076877A0FB59F94F564132EE1D83364CFBEE404E709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE694028, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 158registryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$Free$CloseOpenQueryValue$AllocErrorLast
    • String ID: InProcServer32$LocalServer32
    • API String ID: 258664285-2351252009
    • Opcode ID: ee40bded5c41926ad234f1d253eebe2a5d935485b63d4743606c268aae2d87d0
    • Instruction ID: bdcbe4dcca1a3836071b513d975f7ae1c7927387a30b27dd4f310013b6e9d57d
    • Opcode Fuzzy Hash: ee40bded5c41926ad234f1d253eebe2a5d935485b63d4743606c268aae2d87d0
    • Instruction Fuzzy Hash: 2271C137618B82C6E7108F21F84026AB7A0FB99790F565231FA8E83B64DF7ED444DB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6CF1F4, Relevance: 22.6, APIs: 15, Instructions: 139threadCOMMON
    Download Yara Rule
    APIs
    • GetCurrentThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,?,00000000), ref: 00007FF6EE6CF221
    • OpenThreadToken.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,?,00000000), ref: 00007FF6EE6CF23B
    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,00000000), ref: 00007FF6EE6CF249
    • MapGenericMask.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE6CF297
    • AccessCheck.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE6CF2D6
    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6EE6CF2F0
    • AccessCheck.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE6CF34B
    • GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,?,00000000), ref: 00007FF6EE6CF37D
    • OpenProcessToken.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,?,00000000), ref: 00007FF6EE6CF393
    • ImpersonateLoggedOnUser.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,?,?,?,?,00000000), ref: 00007FF6EE6CF3AB
    • GetCurrentThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,?,00000000), ref: 00007FF6EE6CF3BB
    • OpenThreadToken.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,?,00000000), ref: 00007FF6EE6CF3D5
    • RevertToSelf.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,?,?,?,?,00000000), ref: 00007FF6EE6CF3E7
    • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,?,?,?,00000000), ref: 00007FF6EE6CF3FC
    • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6EE6CF41B
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Thread$CurrentOpenToken$AccessCheckCloseErrorHandleLastProcess$GenericImpersonateLoggedMaskRevertSelfUser
    • String ID:
    • API String ID: 282326827-0
    • Opcode ID: 3414c39c8ea25c814f9514623a0cb6eb8b00d31c7dd253a3c190a834e5d46ea1
    • Instruction ID: 00fcffabf6977f7938f7b722bf3a2946101f01e967bc5553b803ed6e9353df8d
    • Opcode Fuzzy Hash: 3414c39c8ea25c814f9514623a0cb6eb8b00d31c7dd253a3c190a834e5d46ea1
    • Instruction Fuzzy Hash: D9517B37A04A46CAEB509F20E8403BC7BA0FB99B49F528131EA0E87754DF7DD548DB45
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6D3C60, Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 351COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String
    • String ID: __CLASS$__DYNASTY$__SUPERCLASS$__THIS
    • API String ID: 2568140703-2708593128
    • Opcode ID: 8d4e8f3067fca903dd4a3d0046d0f4a23d307d36fb342896b0fad77c92e6bc16
    • Instruction ID: 10467507b6bde86502a392030632f8be14c1d6036d1c2fc1076a5c3394e553c2
    • Opcode Fuzzy Hash: 8d4e8f3067fca903dd4a3d0046d0f4a23d307d36fb342896b0fad77c92e6bc16
    • Instruction Fuzzy Hash: 29E19037A087458AE724AF11D4002B977A1FB68B94FA20135EE5E93BD4DF7ED840DB06
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE694D54, Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 342registryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: QueryValue
    • String ID: Synchronization
    • API String ID: 3660427363-37155492
    • Opcode ID: 85868e097440b1bd5597135b64a604e621270a31bb6588addbe712a19502bd7d
    • Instruction ID: 52c6bcc35616ae6b62dc715d893e65b34ab321b1890c95504d505ca8b0d15ced
    • Opcode Fuzzy Hash: 85868e097440b1bd5597135b64a604e621270a31bb6588addbe712a19502bd7d
    • Instruction Fuzzy Hash: 04F1B873A0C69286E7645B00F0403BEB7A1FB94B54F925136FA8E83A94DF7ED444DB09
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69539C, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 134COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Variant$ClearExceptionInitThrow
    • String ID: __ProviderArchitecture$__RequiredArchitecture
    • API String ID: 734493686-1330146419
    • Opcode ID: b25b577c57c7b0cd0ba27e70574f4356025bf2492df432fc51754060a12563ea
    • Instruction ID: 523d2f39bdba1620e8838e4b9d24576ab4e7d452f90b4b06c0f4859699d030c6
    • Opcode Fuzzy Hash: b25b577c57c7b0cd0ba27e70574f4356025bf2492df432fc51754060a12563ea
    • Instruction Fuzzy Hash: C3514133A44A42D9E7109F30D8803B87760FB69748B525232FA1DD3694EFBEE548D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6D00B0, Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 326COMMON
    Download Yara Rule
    APIs
    • LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,000006A9,00000690,00000000,000000FF,000000FF,0000000D,?,00007FF6EE6A62F1), ref: 00007FF6EE6D01AF
    • LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,000006A9,00000690,00000000,000000FF,000000FF,0000000D,?,00007FF6EE6A62F1), ref: 00007FF6EE6D01FF
    • LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,000006A9,00000690,00000000,000000FF,000000FF), ref: 00007FF6EE6D0319
    • LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,000006A9,00000690,00000000,000000FF,000000FF), ref: 00007FF6EE6D0374
    • LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,000006A9,00000690,00000000,000000FF,000000FF), ref: 00007FF6EE6D0411
    • LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,000006A9,00000690,00000000,000000FF,000000FF), ref: 00007FF6EE6D046C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String
    • String ID: Decoupled:Com$Decoupled:Com:$FALSE$FoldIdentity$TRUE
    • API String ID: 2568140703-1285790333
    • Opcode ID: 6856c338c5d9170a21334616a3a3e6d71e207dc82491f4269d13878af3fbea1c
    • Instruction ID: 18ac99994e7004f0c00c7efdb8f5a7545382aabb99fd3b6e2dc77d3c9f2b809b
    • Opcode Fuzzy Hash: 6856c338c5d9170a21334616a3a3e6d71e207dc82491f4269d13878af3fbea1c
    • Instruction Fuzzy Hash: 92E1B137A087428AEB60AF61D4402FD37A5FB24748F910835EE4D93A88EFB9D544DB09
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6911B8, Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 210COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Variant$ClearInit
    • String ID: HandlesPerHost$MemoryAllHosts$MemoryPerHost$ProcessLimitAllHosts$ThreadsPerHost
    • API String ID: 2610073882-2981524028
    • Opcode ID: 7bb02f7dc466ed871794d6f94c2bf4b25c52553094067eae3fff1c9d57c74385
    • Instruction ID: 3bb082de7cba11f717d3947bfb47eeecc67de19d451a27957b5948cbc9fb262f
    • Opcode Fuzzy Hash: 7bb02f7dc466ed871794d6f94c2bf4b25c52553094067eae3fff1c9d57c74385
    • Instruction Fuzzy Hash: F7A16A37A04B52DAEB208F64D4802AC3BB4FB18798F624135EB4D53B58CFBAD194D745
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE691940, Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 352COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: FreeString
    • String ID: references of {__Win32Provider.Name="
    • API String ID: 3341692771-1092576982
    • Opcode ID: 6d22c10e7795f9ca2b27066fb0eabee3c60c9694f69baa0bb49d70562c45ddc2
    • Instruction ID: f5e67f21f52e5db00da755e948447f643f6090adfde644e29e9a32abc6717da2
    • Opcode Fuzzy Hash: 6d22c10e7795f9ca2b27066fb0eabee3c60c9694f69baa0bb49d70562c45ddc2
    • Instruction Fuzzy Hash: A8F18D23E08A4286EB149F21D4403BC37A1FB69B58F620135EA0D87795DFBFE445E74A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69517C, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 285registryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: QueryStringValue
    • String ID: ThreadingModel
    • API String ID: 260547354-3156129679
    • Opcode ID: 1667176baefd8360ca57ca6a79d8bab75f34931a6a0204572f98f951f274f16e
    • Instruction ID: 1094966e192d9c467e1e54527ba434c9c5d5317133fec6142ef745234ef35584
    • Opcode Fuzzy Hash: 1667176baefd8360ca57ca6a79d8bab75f34931a6a0204572f98f951f274f16e
    • Instruction Fuzzy Hash: 18D1D833A1C692C2D7609F10E0403BAB7A1FB94754F924136FA8E87A94EF7ED444EB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69C9DC, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 83COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CompareStringwcstok$CommandLine
    • String ID: -secured$/RegServer$/UnRegServer
    • API String ID: 1457712244-2803500518
    • Opcode ID: cb3b6356c2ce7b379cb3b66b209affcd9f0ed59be34cc83b808fb9b7c3fd8d83
    • Instruction ID: 9c7038ac25f75e1190c2d988f4242b83cc040e5335b2017608468b55e5738508
    • Opcode Fuzzy Hash: cb3b6356c2ce7b379cb3b66b209affcd9f0ed59be34cc83b808fb9b7c3fd8d83
    • Instruction Fuzzy Hash: 5531EB37A08B8186D710AF01A440239BBE4FB6DB84FA65138EA4D93395CFBDE404DB09
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE693998, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 118registrymemoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$AllocFree$CloseOpenQueryValue
    • String ID: CLSID\
    • API String ID: 686035130-4114017780
    • Opcode ID: 1dfba9ebfe4470b1a2672402d5000eb6a32e1f87a6bd10db6385ebed478e4a77
    • Instruction ID: e9ebb978d21e80779d290c2159a2b67a17d382f0849dc0e359773146ea7dc8b0
    • Opcode Fuzzy Hash: 1dfba9ebfe4470b1a2672402d5000eb6a32e1f87a6bd10db6385ebed478e4a77
    • Instruction Fuzzy Hash: 58516C33A04B5286EB108F25E4003B97BA0FB68B98F164231EE0E87758DFBED045D749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6B262C, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 81registryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Delete$_vsnwprintf
    • String ID: %s\%s$APPID\$CLSID\$LocalServer32$NotInsertable
    • API String ID: 331555913-4016042841
    • Opcode ID: 2cbf56834e45818300e5e3609c17da9fc37e8f713c1e1ac735820fadc5988bd5
    • Instruction ID: 47aac664ef75b2fc8b85d1e73fc5eca868cfae13368a6ca4b4a48cc58971571e
    • Opcode Fuzzy Hash: 2cbf56834e45818300e5e3609c17da9fc37e8f713c1e1ac735820fadc5988bd5
    • Instruction Fuzzy Hash: B241CE77A18A81D6E720DF24E8007E93760FBA9344F955132FA0E87B59DF7AD608CB44
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE698B80, Relevance: 15.4, APIs: 10, Instructions: 379COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Locale@@$Free@Languages@Preferred
    • String ID:
    • API String ID: 314991416-0
    • Opcode ID: b7879feb6440b492c9511d42d4fea967490f7bdc8b0c492f849fca2b523f5392
    • Instruction ID: bcbac267cd230ea5b0bf2644246f69f701c22066f4d2ccd72d77448a9758d7e7
    • Opcode Fuzzy Hash: b7879feb6440b492c9511d42d4fea967490f7bdc8b0c492f849fca2b523f5392
    • Instruction Fuzzy Hash: 06028137A08A528AEB109F65E4407BC37A1FB68B98F524035EE0E93754CF7EE805D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BF6E0, Relevance: 15.4, APIs: 10, Instructions: 365memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$String$AllocAllocateFreeHeap
    • String ID:
    • API String ID: 1514251789-0
    • Opcode ID: 7cd74076afa0e93269df8ecfbc6881c1a00e0492867c5ce08bd94f34be6d4970
    • Instruction ID: 1cf077713750ebecbcf24427aef56166fc396cb5fe2a5f72cad7559bd4728e37
    • Opcode Fuzzy Hash: 7cd74076afa0e93269df8ecfbc6881c1a00e0492867c5ce08bd94f34be6d4970
    • Instruction Fuzzy Hash: 7C029E37B04B4686EB008F25D8443A83BA1FB59B98F564136EE0D97768CF7EE449D309
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE695788, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 310COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Publish$CommitEvent@@ObjectOperation$CurrentInit@ProcessProviderStarted@
    • String ID: wmiprvse.exe
    • API String ID: 2732922947-74504709
    • Opcode ID: a973c233ae91b68df89df6fb90387143c5410c077a51ae4b3c4784a47057e9c2
    • Instruction ID: 2b086e50734c2de4899f6440f0f4b2c308f6c9af7944f76a0f4ee11815c4407e
    • Opcode Fuzzy Hash: a973c233ae91b68df89df6fb90387143c5410c077a51ae4b3c4784a47057e9c2
    • Instruction Fuzzy Hash: D1D1B033A08B818AE7108F21E8402AD77A0FB98B98F560135EF4E87B54DF7EE440D708
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C54FC, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 133memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$AllocFreeLog@@MemoryMessageObjectTraceWrite@
    • String ID: Operation$Provider$Provider Subsystem Error Report$StatusCode
    • API String ID: 2484744183-2493281790
    • Opcode ID: 215be966765b909de5af54e42640fd8d8bf9c6cfec3fdb4df1658414b4e82768
    • Instruction ID: 263d5c27dbf563bab5ed44b742f1dc1f0bb3563bca9e6e6bc3b8c7aa19ba122f
    • Opcode Fuzzy Hash: 215be966765b909de5af54e42640fd8d8bf9c6cfec3fdb4df1658414b4e82768
    • Instruction Fuzzy Hash: 2651A067B08B8682EB10DB16E8403A93BA1FB98B88F564032EE4D87764CF7ED445D745
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69D300, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57libraryloaderCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AddressProc$FreeHandleLibraryModule
    • String ID: CoEEShutDownCOM$CorExitProcess$mscoree.dll
    • API String ID: 3351650562-694248032
    • Opcode ID: 14eb53aa9a79fb759ec5829e2dba5280ea3b761f375d835a89dd01a652d64903
    • Instruction ID: d3ddd2b0b81e985b98c44b448bfa024d79a9851d534774db171717ea1967111b
    • Opcode Fuzzy Hash: 14eb53aa9a79fb759ec5829e2dba5280ea3b761f375d835a89dd01a652d64903
    • Instruction Fuzzy Hash: AA218833908B46C6EB015B10E404378BBA0FF6AB65F569230E55E83394DFBED044D70A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE696AC0, Relevance: 13.8, APIs: 9, Instructions: 287COMMON
    Download Yara Rule
    APIs
    • WmiSetAndCommitObject.NCOBJAPI ref: 00007FF6EE696C39
    • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6EE696D71
    • SysFreeString.OLEAUT32 ref: 00007FF6EE696D8A
    • SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE696E1D
      • Part of subcall function 00007FF6EE696EF0: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EE696A62), ref: 00007FF6EE696F95
      • Part of subcall function 00007FF6EE696EF0: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EE696A62), ref: 00007FF6EE696FD9
      • Part of subcall function 00007FF6EE696EF0: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EE696A62), ref: 00007FF6EE697010
    • DeleteCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE696E44
    • DeleteCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE696E7C
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Free$Heap$CriticalDeleteSection$CloseCommitEventHandleObjectString
    • String ID:
    • API String ID: 3665358772-0
    • Opcode ID: 7f3645eedcf729e4a4069026ad875a1c95e078b3b4551d10bb60da006ebb0a44
    • Instruction ID: 52273680b63b3b0c156d29a0f1cf9e24c83aa9023101489afaa6f61f0a359dda
    • Opcode Fuzzy Hash: 7f3645eedcf729e4a4069026ad875a1c95e078b3b4551d10bb60da006ebb0a44
    • Instruction Fuzzy Hash: 24E15937A0AB4585EB009F24E4843B833A4FB69F54F664232EA1D87360DFBED455E309
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6970EC, Relevance: 13.7, APIs: 9, Instructions: 185COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: FreeString
    • String ID:
    • API String ID: 3341692771-0
    • Opcode ID: 2fd2df3b91e5e9ed2ac48686d74b9f85ab357a12b60df736f6df7b819e678569
    • Instruction ID: 621d0218932c903390b11f0caf342e8f18c5b1871d299d2a234d31adb548ec09
    • Opcode Fuzzy Hash: 2fd2df3b91e5e9ed2ac48686d74b9f85ab357a12b60df736f6df7b819e678569
    • Instruction Fuzzy Hash: 4A818D27A09A06C6EF549F25C4547782760FFA6F55F1A4231EA1E8B3A0CF6EE044E309
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6D19F0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 96COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Variant$ClearInit
    • String ID: SupportsGet$SupportsPut$__PropertyProviderRegistration
    • API String ID: 2610073882-4249854961
    • Opcode ID: e79b0278d4a8ecd8b90a0c0a57098967b1855ad5228e26dcb0ca639a173e39a6
    • Instruction ID: d9d505bed6891e25b9f061ac5a9031c399233918b830d2fb92e4089588f8aede
    • Opcode Fuzzy Hash: e79b0278d4a8ecd8b90a0c0a57098967b1855ad5228e26dcb0ca639a173e39a6
    • Instruction Fuzzy Hash: D3417227B14752DAEB209F60D8401FC7BB0F758748BA54136EA0E83A54DFBDD085DB09
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE699800, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Locale@@$Languages@PreferredVariant$ClearFree@Init
    • String ID: __ClientPreferredLanguages
    • API String ID: 2422115333-2977330997
    • Opcode ID: 6f93cda2942f151eaedac31c5242271109309bc5771efa59e48beb4076b91054
    • Instruction ID: ce1a81aafb1414ad848a51e8eba089d6c0d53b6836e4981bcb51784b218b717b
    • Opcode Fuzzy Hash: 6f93cda2942f151eaedac31c5242271109309bc5771efa59e48beb4076b91054
    • Instruction Fuzzy Hash: B841C623A08B8682EB009B15E4403797770FBA9BA0F528236EA5E83394DFBED444D705
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BB990, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 62COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Variant$Clear$Init
    • String ID: __GET_EXTENSIONS$__GET_EXT_CLIENT_REQUEST$__GET_EXT_KEYS_ONLY$__GET_EXT_PROPERTIES
    • API String ID: 3740757921-352387391
    • Opcode ID: cce55f2b1b314aa8b76d5c4f5252492b4a7399fad03d3c49524b8fbde8a306e6
    • Instruction ID: 0d1f27746b68e03842736283a723884e375b872d42ef988330e9a8c7d3aec53c
    • Opcode Fuzzy Hash: cce55f2b1b314aa8b76d5c4f5252492b4a7399fad03d3c49524b8fbde8a306e6
    • Instruction Fuzzy Hash: EE212167B24A0BC2EB00AF19D8547692760FF69F84BD75131E91D87724DFAED004DB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A00F0, Relevance: 12.3, APIs: 8, Instructions: 306COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Locale@@$Free@Languages@Preferred
    • String ID:
    • API String ID: 314991416-0
    • Opcode ID: 44d050ba2db44fcdefed2c67fd314677c91c6c93517920e34569b568ea8da4d7
    • Instruction ID: 2917a845cce6b924b28bcc07abfdb77d859d81f0c6fcb7e2ba2849f3fb21bb1d
    • Opcode Fuzzy Hash: 44d050ba2db44fcdefed2c67fd314677c91c6c93517920e34569b568ea8da4d7
    • Instruction Fuzzy Hash: 2CD18F33E08B518AEB548F55E4447B83BA1FB58B88F514036EE0D93799CFBAD841D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A10C0, Relevance: 12.3, APIs: 8, Instructions: 294COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Locale@@$Free@Languages@Preferred
    • String ID:
    • API String ID: 314991416-0
    • Opcode ID: 981f5c00646a2cec581503dd0f93660e6db7ef51936ae42243d40c68fd3145e3
    • Instruction ID: 5e483caef431b9adc43d8a0a7ce120760ce65f7baa0ccd0b6987524bba9a2e01
    • Opcode Fuzzy Hash: 981f5c00646a2cec581503dd0f93660e6db7ef51936ae42243d40c68fd3145e3
    • Instruction Fuzzy Hash: 64D1A273E086A286E7108B25D4007BC3BA1FB68B98F564531EE0D87B94CF7ED841E749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A07A0, Relevance: 12.3, APIs: 8, Instructions: 288COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Locale@@$Free@Languages@Preferred
    • String ID:
    • API String ID: 314991416-0
    • Opcode ID: 3a8fa17648dc10cf8e70daee5ea723314f194b0c335b30220b8cdb3263b89141
    • Instruction ID: acf8a8b7b7518461017e5360ae2eb813a043f3d2849e8ec01ccaa1a4fc04ab86
    • Opcode Fuzzy Hash: 3a8fa17648dc10cf8e70daee5ea723314f194b0c335b30220b8cdb3263b89141
    • Instruction Fuzzy Hash: ECD19033F08A518AEB548F65D4407B837A0FB58788F524136EE4D83B98CFBAE815D749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6B2818, Relevance: 12.1, APIs: 8, Instructions: 112threadCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CallSecurity@@Wbem$Thread$Handle@@@Security@$Interface@Log@@MemoryNew@ObjectQueryRef@Release@W4tag_Write@
    • String ID:
    • API String ID: 4067766105-0
    • Opcode ID: 9a3730f2b8dec10cd371938ded017e3c399ddac8d6ab94b803d61171a510583a
    • Instruction ID: 26dc7f1be130cf56bc7b42b74db9322a2b16ed4d97e9bce001170470cf1d3575
    • Opcode Fuzzy Hash: 9a3730f2b8dec10cd371938ded017e3c399ddac8d6ab94b803d61171a510583a
    • Instruction Fuzzy Hash: F7517E27A08B4686EB009F56E444378BBA0FB99F94F964131EE1D83364CFBED445D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6AB08F, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 211memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AllocClearVariant$CommitHeapObjectString
    • String ID: __GET_EXT_CLIENT_REQUEST
    • API String ID: 4148425054-2781797842
    • Opcode ID: bcac05a344e53ad4ceef163fc8969cbc4573e2cf06fb6769150e0fcf326c011f
    • Instruction ID: d4bce48798875888d712a424604c3379bdfba8163a74e903841d7b46550b4e6c
    • Opcode Fuzzy Hash: bcac05a344e53ad4ceef163fc8969cbc4573e2cf06fb6769150e0fcf326c011f
    • Instruction Fuzzy Hash: 30A18B37A09B8686DB518F25D8443A83BA0FB99F94F564132DE4D83320EFBED841D705
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C07B4, Relevance: 9.2, APIs: 6, Instructions: 199COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Object$CommitLog@@MemoryWrite@
    • String ID:
    • API String ID: 4114940835-0
    • Opcode ID: 2c99aff10ec46ac91fbbb96e00b94ab9c317819813eaa8bd502ca308216ee1df
    • Instruction ID: 1139a2d18e40f4e6fff1babcd829f19d2ab37fd79ef40c497f7db59685c6802d
    • Opcode Fuzzy Hash: 2c99aff10ec46ac91fbbb96e00b94ab9c317819813eaa8bd502ca308216ee1df
    • Instruction Fuzzy Hash: 92A18A37A09B818AEB508F51E4403A977A4FB88B88F110136EE8C87B68DF7AD441D705
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C9368, Relevance: 9.2, APIs: 6, Instructions: 187memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AllocLog@@MemoryObjectStringWrite@
    • String ID:
    • API String ID: 2684555511-0
    • Opcode ID: 788f6b69d235acf8708357cb7d0b5ba60219b38b931f8117cc341e7725cd56cc
    • Instruction ID: ea2ce80bedc3bea2f702075821f6c143cf508a0291a4f7d6abf9deebb00fc85f
    • Opcode Fuzzy Hash: 788f6b69d235acf8708357cb7d0b5ba60219b38b931f8117cc341e7725cd56cc
    • Instruction Fuzzy Hash: 6E81C233708B8286EB249B16E4403B97790FB68B84F124035EE4D87791DFBEE441E70A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C1404, Relevance: 9.2, APIs: 6, Instructions: 159COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Object$CommitLog@@MemoryWrite@
    • String ID:
    • API String ID: 4114940835-0
    • Opcode ID: 815967cda5116546826925d6346c0cd66273780f2d2343888630418cdb107ec8
    • Instruction ID: 6e74c6fa225115a353d8c1f8394bde5d4144f6466e553c52f756292da9645a1f
    • Opcode Fuzzy Hash: 815967cda5116546826925d6346c0cd66273780f2d2343888630418cdb107ec8
    • Instruction Fuzzy Hash: 9A71BC3B605B818ADB008F12E4443A93BB4FB98B88F660136EE4D87765CF7ED442D705
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C16C8, Relevance: 9.2, APIs: 6, Instructions: 150COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Object$CommitLog@@MemoryWrite@
    • String ID:
    • API String ID: 4114940835-0
    • Opcode ID: db9ad04930285b553243c293cd12145595f214928d812a00b208a26575ecfe31
    • Instruction ID: a8f9f86032018893597cbb967316ae90a30c7929ee1708c8b233fa99c0cd1b67
    • Opcode Fuzzy Hash: db9ad04930285b553243c293cd12145595f214928d812a00b208a26575ecfe31
    • Instruction Fuzzy Hash: 0671BD37609B829ADB008F11E4443A93BB0FB98B98F664136EE4D8B764CF7ED442D745
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C0B18, Relevance: 9.1, APIs: 6, Instructions: 148COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Object$CommitLog@@MemoryWrite@
    • String ID:
    • API String ID: 4114940835-0
    • Opcode ID: 62ee7cd588e01a84bd5f7cf72b355cd3cdbcbbb7a53bedb2e889662375be7e41
    • Instruction ID: 9192cdbf83a8e96b0b24980d1a740cabbdb0e0abda38668e8bcedc7ceb3b0986
    • Opcode Fuzzy Hash: 62ee7cd588e01a84bd5f7cf72b355cd3cdbcbbb7a53bedb2e889662375be7e41
    • Instruction Fuzzy Hash: 8171BD37605B818ADB408F15E4843A93BA4FB98B88F660132FE4D87728CF7EE442D745
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C5930, Relevance: 9.1, APIs: 6, Instructions: 96synchronizationCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Object$Log@@MemorySingleWaitWrite@$MessageTrace
    • String ID:
    • API String ID: 1897939771-0
    • Opcode ID: c64ea0a0f27fba676473c6bfda9af18f691fad1b1490c81571fb4de91cc0e725
    • Instruction ID: 40562f065c55d1443e348b2fa97d80c529a562946ed34eced5d9fc58bcae5b85
    • Opcode Fuzzy Hash: c64ea0a0f27fba676473c6bfda9af18f691fad1b1490c81571fb4de91cc0e725
    • Instruction Fuzzy Hash: B141D923B08E8286EB149B41D8443787B91FB94B4CFA65031EA0DC7395CFBFE845974A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6B44E8, Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$AllocExceptionFreeThrow
    • String ID:
    • API String ID: 929037355-0
    • Opcode ID: f15c8e607f52712143e6815d0f54941b9d40640eca7326c5dac5a90b4f2ecaaf
    • Instruction ID: 0ac7e2c882d9a620e7c278817f9c5d35e2e236ee72f75a748b2007a9fce3f8c5
    • Opcode Fuzzy Hash: f15c8e607f52712143e6815d0f54941b9d40640eca7326c5dac5a90b4f2ecaaf
    • Instruction Fuzzy Hash: 57214A73A19A4187EB44CF14E05037977A0FF68B48F194134EA1E82705EF7EE455D745
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BEC94, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 214memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$AllocFreeLog@@MemoryObjectWrite@
    • String ID: CreateClassEnumAsync
    • API String ID: 2678036425-1192769357
    • Opcode ID: 914ce6173a95391daeefe2d5cf02f9d84f007b8d8f92727875eeb25e4753741c
    • Instruction ID: ac118ee4baa69551c94454bd70a3855a069036da168bfd7ff727273cdeacad43
    • Opcode Fuzzy Hash: 914ce6173a95391daeefe2d5cf02f9d84f007b8d8f92727875eeb25e4753741c
    • Instruction Fuzzy Hash: F5A1A037A18B4A82EB148B55E84036977A4FB58F90F124135FE1D837A4DFBEE445D309
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BF00C, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 210memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$AllocFreeLog@@MemoryObjectWrite@
    • String ID: DeleteClassAsync
    • API String ID: 2678036425-1059552648
    • Opcode ID: bf33a8664787e9ce858bd960fa1efffb44f2af2a7f7c5cad65aaf9fcaf212f4b
    • Instruction ID: a2c451d3a346959062b3ed2306e26fc2b5cf33eff67203b00a123d89fe79ab19
    • Opcode Fuzzy Hash: bf33a8664787e9ce858bd960fa1efffb44f2af2a7f7c5cad65aaf9fcaf212f4b
    • Instruction Fuzzy Hash: F1919F37A08B4686EB108B55D84436877A0FB69F94F164232EE1D837A8CFBEE444D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BF374, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 210memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$AllocFreeLog@@MemoryObjectWrite@
    • String ID: DeleteInstanceAsync
    • API String ID: 2678036425-991506802
    • Opcode ID: a91dc0644f1b5f83f1c8b91cc6050f151764c7bd20ffd3fe5f5cb05ce361df39
    • Instruction ID: a51c6a25be94c28b9e1c0bede9eff92592f776e324659ed6f4c0c90561921bcc
    • Opcode Fuzzy Hash: a91dc0644f1b5f83f1c8b91cc6050f151764c7bd20ffd3fe5f5cb05ce361df39
    • Instruction Fuzzy Hash: 8E91BF27B08B4686DB108F15E84436977A4FB68F94F524231EE0D83764DFBEE444D30A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6AF324, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120registryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: char_traits$CloseOpen
    • String ID: SOFTWARE\Classes\CLSID\%s\InprocServer32
    • API String ID: 3362776682-450560693
    • Opcode ID: 29acf3eb0573ddf26fbda36ef0c8853dae8c41bdbe71e73077e6c589b71569d4
    • Instruction ID: 07146a08e516f0ac7f7e79ced8f161f6d10cffc34b3b3819fd9c53b0000c051f
    • Opcode Fuzzy Hash: 29acf3eb0573ddf26fbda36ef0c8853dae8c41bdbe71e73077e6c589b71569d4
    • Instruction Fuzzy Hash: 8F518233A58B8681EB109F15E4403A97760FBA9B90F524232FE8D837A5CF7EE405D706
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6AF4CE, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87registryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: char_traits$CloseOpen
    • String ID: SOFTWARE\Classes\CLSID\%s\InprocServer32
    • API String ID: 3362776682-450560693
    • Opcode ID: 17d41ade73b41a8a74fcaf6e51cebeac4352bdb9556afd2bfed58afa0467aa0c
    • Instruction ID: e2e4f95f3b2fd54897298d438bc3a290f774cc280af6540656f451ec5050b84a
    • Opcode Fuzzy Hash: 17d41ade73b41a8a74fcaf6e51cebeac4352bdb9556afd2bfed58afa0467aa0c
    • Instruction Fuzzy Hash: D3418323A5CB8681EB509B11E4403B9A760FFA5B80F515136FE4D837AADFBEE404D706
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE693CDC, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64registryCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00007FF6EE694C00: SysAllocStringLen.OLEAUT32 ref: 00007FF6EE694C62
    • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6EE693D4C
    • SysFreeString.OLEAUT32 ref: 00007FF6EE693DD5
      • Part of subcall function 00007FF6EE69517C: RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6EE6951ED
    • RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6EE693DB5
    • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6EE693DC5
      • Part of subcall function 00007FF6EE694D54: RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6EE694DBC
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: QueryValue$String$AllocCloseFreeOpen
    • String ID: InProcServer32
    • API String ID: 3901537117-1075336519
    • Opcode ID: 30908204a4333dc8729670f87b3c2b915aa414cde3c108a553ee345983fe658a
    • Instruction ID: d861baab5af9ca60858d9778d9f472d6e5b23a19f3af230d476e9aabb28108d8
    • Opcode Fuzzy Hash: 30908204a4333dc8729670f87b3c2b915aa414cde3c108a553ee345983fe658a
    • Instruction Fuzzy Hash: EC31AC76B04B418AEB109F65E8403AD7BA0FB88788F415231EE5D83B59DFBAD154CB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE693DFC, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56registryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$AllocCloseFreeOpenQueryValue
    • String ID: LocalServer32
    • API String ID: 3575068234-1789907217
    • Opcode ID: 468aa7a1cc40b3be54658a8c4271c35bed7547b43f7f0357f6ca78d20b078a09
    • Instruction ID: aac236c658f9dfe6477c3716386bd2f1e01602ca50b3cc23d4dc02ddd75651e6
    • Opcode Fuzzy Hash: 468aa7a1cc40b3be54658a8c4271c35bed7547b43f7f0357f6ca78d20b078a09
    • Instruction Fuzzy Hash: 1D219F33618B8186E7408F24F4407AABBA0F789784F459231FA8E83B59CF7DD044CB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6B1CF0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00007FF6EE6B1DC0: GetMemLogObject.WBEMCOMN(?,?,?,?,00000001,00007FF6EE6B1CFB,?,?,?,?,?,?,00000001,00007FF6EE6AC93D), ref: 00007FF6EE6B1DFA
      • Part of subcall function 00007FF6EE6B1DC0: ?Write@CMemoryLog@@QEAAXJ@Z.WBEMCOMN(?,?,?,?,00000001,00007FF6EE6B1CFB,?,?,?,?,?,?,00000001,00007FF6EE6AC93D), ref: 00007FF6EE6B1E0B
      • Part of subcall function 00007FF6EE6B1E60: GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6EE6B1ECE
    • GetMemLogObject.WBEMCOMN ref: 00007FF6EE6B1D5C
    • ?Write@CMemoryLog@@QEAAXJ@Z.WBEMCOMN ref: 00007FF6EE6B1D6D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$FileModuleName
    • String ID: -secured$Microsoft WMI Provider Subsystem Host$Microsoft WMI Provider Subsystem Secured Host
    • API String ID: 3559867509-268285720
    • Opcode ID: cbb24e1e2d1be36817a5d8481ba71177f6808da234c0d9390555971857b2a8f6
    • Instruction ID: 0dd66986fd2bf4fff238d404653f1690aa81b6651f44746efa37eb8849f43ce4
    • Opcode Fuzzy Hash: cbb24e1e2d1be36817a5d8481ba71177f6808da234c0d9390555971857b2a8f6
    • Instruction Fuzzy Hash: 5C11D563D18B8691E7009B14D4407F52770FF68348F911231F98DC22A9DFBEE245D74A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A1700, Relevance: 7.7, APIs: 5, Instructions: 234memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AllocCommitCriticalHeapLeaveObjectSection
    • String ID:
    • API String ID: 3139073153-0
    • Opcode ID: a2e0228be2a5fc1cc3770ef0a7a9ccb78e03be7365dd7c633c897a387a4e60ac
    • Instruction ID: b5b44db683b9f46cc1a259927bef74f299847eed5936705f7fcb2c29710ffa85
    • Opcode Fuzzy Hash: a2e0228be2a5fc1cc3770ef0a7a9ccb78e03be7365dd7c633c897a387a4e60ac
    • Instruction Fuzzy Hash: C3B1CF37A08B8286EA609F11E4403B977A0FB98B94F554136EF8D83795CFBEE440D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6D0848, Relevance: 7.7, APIs: 5, Instructions: 169COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: ArraySafe$ExceptionThrow$Bound$AllocateElementFreeHeapString
    • String ID:
    • API String ID: 2782141072-0
    • Opcode ID: a6274680ac7c826ef8a7f438ce81a426cfd96eba8f9a7fb1c4ccac3d89416ed8
    • Instruction ID: 761c0cc10a377917b8d0b71be5b02aea06d380f3b14906b8516b0a59ea19b3a4
    • Opcode Fuzzy Hash: a6274680ac7c826ef8a7f438ce81a426cfd96eba8f9a7fb1c4ccac3d89416ed8
    • Instruction Fuzzy Hash: 4B718B37B04A128AEB00DF65D4806AC37B1FB58B98FA64131EE0D93758DFBAD845DB44
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6AFA94, Relevance: 7.6, APIs: 5, Instructions: 99COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: _itow$CurrentEventProcessWrite
    • String ID:
    • API String ID: 1710260688-0
    • Opcode ID: c2c806ffa203979300d4b8677ba4fa662c067851a353b9c2c78873bb6e61951f
    • Instruction ID: 42e571333bca33b3597e9abe73dcba55251115e910ae8d13db23b966cee37608
    • Opcode Fuzzy Hash: c2c806ffa203979300d4b8677ba4fa662c067851a353b9c2c78873bb6e61951f
    • Instruction Fuzzy Hash: 8841AF33A04B958AE710DF69E8442ADBBB0F798754F414236EA4D837A4EF79D144CF41
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6CFDC4, Relevance: 7.6, APIs: 5, Instructions: 77threadCOMMON
    Download Yara Rule
    APIs
    • GetCurrentThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6EE6CFDED
    • OpenThreadToken.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6EE6CFE09
      • Part of subcall function 00007FF6EE6CF708: GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF753
      • Part of subcall function 00007FF6EE6CF708: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF767
      • Part of subcall function 00007FF6EE6CF708: GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF7A7
      • Part of subcall function 00007FF6EE6CF708: GetLengthSid.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF7BA
      • Part of subcall function 00007FF6EE6CF708: memmove.MSVCRT(?,?,?,00000000,00000020), ref: 00007FF6EE6CF7E3
    • GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6EE6CFE32
    • OpenProcessToken.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6EE6CFE4A
    • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6EE6CFED4
      • Part of subcall function 00007FF6EE6CF4B8: GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF503
      • Part of subcall function 00007FF6EE6CF4B8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF517
      • Part of subcall function 00007FF6EE6CF4B8: GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF557
      • Part of subcall function 00007FF6EE6CF4B8: GetLengthSid.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF56A
      • Part of subcall function 00007FF6EE6CF4B8: memmove.MSVCRT(?,?,?,00000000,00000020), ref: 00007FF6EE6CF593
      • Part of subcall function 00007FF6EE6CE9E8: MakeAbsoluteSD.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE6CEA9E
      • Part of subcall function 00007FF6EE6CE9E8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6EE6CEAB2
      • Part of subcall function 00007FF6EE6CE9E8: GetLengthSid.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE6CEACA
      • Part of subcall function 00007FF6EE6CE9E8: InitializeSecurityDescriptor.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE6CEB5C
      • Part of subcall function 00007FF6EE694A40: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6EE694A6A
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Token$Information$ErrorLastLength$CurrentOpenProcessThreadmemmove$AbsoluteCloseDescriptorFreeHandleHeapInitializeMakeSecurity
    • String ID:
    • API String ID: 2044367899-0
    • Opcode ID: 54d943f914f2c009aaafbd5cb2ee283b67a1a13d10a8a6774a74cafa9f01d686
    • Instruction ID: 1c776a7c2070d502da387b4d2b5465edb3a1b7f260e87b3b4eb6c87a708158dd
    • Opcode Fuzzy Hash: 54d943f914f2c009aaafbd5cb2ee283b67a1a13d10a8a6774a74cafa9f01d686
    • Instruction Fuzzy Hash: A0315E33B04A469AEB009F61D4443FC2BA0FB59B89F415131FA0E8B745DFBAD489D74A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6CF708, Relevance: 7.6, APIs: 5, Instructions: 77COMMON
    Download Yara Rule
    APIs
    • GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF753
    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF767
      • Part of subcall function 00007FF6EE698440: RtlAllocateHeap.NTDLL(?,?,00000001,00007FF6EE697D16), ref: 00007FF6EE698462
    • GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF7A7
    • GetLengthSid.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF7BA
    • memmove.MSVCRT(?,?,?,00000000,00000020), ref: 00007FF6EE6CF7E3
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: InformationToken$AllocateErrorHeapLastLengthmemmove
    • String ID:
    • API String ID: 3400817826-0
    • Opcode ID: 6e25c720302c5f9004fa330389e28d3bf97986e9dc598e71dc1d40826a534365
    • Instruction ID: fb2b5bab171758769d0fb642bcdf446a2b19a0c65d02f6d37cc76fe0758ca9e9
    • Opcode Fuzzy Hash: 6e25c720302c5f9004fa330389e28d3bf97986e9dc598e71dc1d40826a534365
    • Instruction Fuzzy Hash: 2731A437B0A78286EB508B11A440379ABE0FF98B94F528134EE0D8B745DFFEE4409709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6CF4B8, Relevance: 7.6, APIs: 5, Instructions: 77COMMON
    Download Yara Rule
    APIs
    • GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF503
    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF517
      • Part of subcall function 00007FF6EE698440: RtlAllocateHeap.NTDLL(?,?,00000001,00007FF6EE697D16), ref: 00007FF6EE698462
    • GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF557
    • GetLengthSid.API-MS-WIN-SECURITY-BASE-L1-1-0(?,?,?,00000000,00000020), ref: 00007FF6EE6CF56A
    • memmove.MSVCRT(?,?,?,00000000,00000020), ref: 00007FF6EE6CF593
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: InformationToken$AllocateErrorHeapLastLengthmemmove
    • String ID:
    • API String ID: 3400817826-0
    • Opcode ID: 04160e9d5f0925990a4e7652c0b3491b054e5ffbde9a94aaab3af255483f5e06
    • Instruction ID: 4c77e80aa7ae60977e595defb2865fa8025b4db8374f874ec163ce17bda0d6dc
    • Opcode Fuzzy Hash: 04160e9d5f0925990a4e7652c0b3491b054e5ffbde9a94aaab3af255483f5e06
    • Instruction Fuzzy Hash: 1C316123B0874287EA508F11A440379ABD1FFA8B85F468534EA0D8B746DFBEE4519709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6B29D8, Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON
    Download Yara Rule
    APIs
    • SetThreadToken.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6EE6B2A0C
    • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6EE6B2A42
      • Part of subcall function 00007FF6EE6B2818: ?New@CWbemCallSecurity@@SAPEAV1@XZ.FASTPROX ref: 00007FF6EE6B288E
      • Part of subcall function 00007FF6EE6B2818: ?AddRef@CWbemCallSecurity@@UEAAKXZ.FASTPROX ref: 00007FF6EE6B28A9
      • Part of subcall function 00007FF6EE6B2818: ?GetThreadSecurity@CWbemCallSecurity@@UEAAJW4tag_WMI_THREAD_SECURITY_ORIGIN@@PEAPEAU_IWmiThreadSecHandle@@@Z.FASTPROX ref: 00007FF6EE6B28C9
      • Part of subcall function 00007FF6EE6B2818: ?SetThreadSecurity@CWbemCallSecurity@@UEAAJPEAU_IWmiThreadSecHandle@@@Z.FASTPROX ref: 00007FF6EE6B28E4
      • Part of subcall function 00007FF6EE6B2818: ?QueryInterface@CWbemCallSecurity@@UEAAJAEBU_GUID@@PEAPEAX@Z.FASTPROX ref: 00007FF6EE6B2903
      • Part of subcall function 00007FF6EE6B2818: ?Release@CWbemCallSecurity@@UEAAKXZ.FASTPROX ref: 00007FF6EE6B2941
      • Part of subcall function 00007FF6EE6B2818: GetMemLogObject.WBEMCOMN ref: 00007FF6EE6B2968
      • Part of subcall function 00007FF6EE6B2818: ?Write@CMemoryLog@@QEAAXJ@Z.WBEMCOMN ref: 00007FF6EE6B2979
    • RevertToSelf.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6EE6B2A2C
    • GetMemLogObject.WBEMCOMN ref: 00007FF6EE6B2A52
    • ?Write@CMemoryLog@@QEAAXJ@Z.WBEMCOMN ref: 00007FF6EE6B2A63
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CallSecurity@@Wbem$Thread$Handle@@@Log@@MemoryObjectSecurity@Write@$CloseHandleInterface@New@QueryRef@Release@RevertSelfTokenW4tag_
    • String ID:
    • API String ID: 1192238532-0
    • Opcode ID: 3ae73fbb3e58bdca401a35a3749b955422922a0fc1110c9842808d53282ec410
    • Instruction ID: c6b692bbbb48a444f9f61982b4ff3549d12ff1f97910e6abfbeb7bf9c4b4a045
    • Opcode Fuzzy Hash: 3ae73fbb3e58bdca401a35a3749b955422922a0fc1110c9842808d53282ec410
    • Instruction Fuzzy Hash: 0121B222A08B8186EB145F11A4443787BA1FBA9F84F569035FE0E83759CFBEE8419709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE698834, Relevance: 7.6, APIs: 5, Instructions: 56threadCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: ThreadToken$CloseCurrentErrorHandleInformationLastOpen
    • String ID:
    • API String ID: 1364139418-0
    • Opcode ID: a31c0bc1aa53b0a9607fad20e53c2ef41cc794bb3fdc3fc28ba85568d9e48ee6
    • Instruction ID: 8a962435f466d1166e8e87e94be2d236e2b970741df8fe5dcafdc80758b067d8
    • Opcode Fuzzy Hash: a31c0bc1aa53b0a9607fad20e53c2ef41cc794bb3fdc3fc28ba85568d9e48ee6
    • Instruction Fuzzy Hash: B521B037A08A8287E7109B14E00437DB7B0FB99721F664635EB4E83644DFBEE818DB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6B1A14, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110registryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CloseCreateValue
    • String ID: ?
    • API String ID: 1818849710-1684325040
    • Opcode ID: 63ef8a6b0bff02c34b0014a29d1129975237a091ab5aa8fbd785978a58773ae8
    • Instruction ID: ca855f9abc05b246308e294bd70662924e9730c4b7b794f307b31a96a7f4f38c
    • Opcode Fuzzy Hash: 63ef8a6b0bff02c34b0014a29d1129975237a091ab5aa8fbd785978a58773ae8
    • Instruction Fuzzy Hash: DE41C433A0878596EA208F11E4147BA73A0FBA4B90F554231FE4D83798DFBDE504D704
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE693B40, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44registrymemoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$AllocFreeQueryValue
    • String ID: AppId
    • API String ID: 106098572-4145749797
    • Opcode ID: 45f5ca1bf6ebd63fbf83d86286dc755a5d887a80e2d2f9541f6b239f58b0afde
    • Instruction ID: 343a9b357727e17c5fc11e02c56c8f708630e28b39889c5c56a516da57a9504c
    • Opcode Fuzzy Hash: 45f5ca1bf6ebd63fbf83d86286dc755a5d887a80e2d2f9541f6b239f58b0afde
    • Instruction Fuzzy Hash: 6B118232619A8186EB508F10F49437AB7A0FB98B44F955135EA8E83B44DF7DD018DB04
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE693844, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AllocString
    • String ID: DefaultLocalServiceHost$DefaultLocalSystemHost$DefaultNetworkServiceHost
    • API String ID: 2525500382-1257024311
    • Opcode ID: 1945fbb44870ce32ba293760b83dc0664e50085646f0ddb8a81a280794e106c0
    • Instruction ID: cd0b2cca36acb83adf83750312d93610f1c0a2329aacb6e93a25582a5f191da3
    • Opcode Fuzzy Hash: 1945fbb44870ce32ba293760b83dc0664e50085646f0ddb8a81a280794e106c0
    • Instruction Fuzzy Hash: 90014822E4854295FA684B0CA6D137C2360EF79360B664039F20FC19B0CE9FE845A20F
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C7BD0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON
    Download Yara Rule
    APIs
    • ?Init@CPublishWMIOperationEvent@@SAJXZ.WBEMCOMN(?,?,?,?,00000001,00007FF6EE6C7A7F), ref: 00007FF6EE6C7BF1
    • GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00000001,00007FF6EE6C7A7F), ref: 00007FF6EE6C7C1C
    • ?PublishProviderStarted@CPublishWMIOperationEvent@@SAJPEAGJ0K0@Z.WBEMCOMN(?,?,?,?,00000001,00007FF6EE6C7A7F), ref: 00007FF6EE6C7C3C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Publish$Event@@Operation$CurrentInit@ProcessProviderStarted@
    • String ID: wmiprvse.exe
    • API String ID: 1806684630-74504709
    • Opcode ID: c8a05661b24f71906888f126ff5b315d75aab4d765c054f1a6dd361c2fa26a37
    • Instruction ID: b7c6e6d937b9e0c719fbf196847a1fc135135ed038616ce52151e15c62e9a987
    • Opcode Fuzzy Hash: c8a05661b24f71906888f126ff5b315d75aab4d765c054f1a6dd361c2fa26a37
    • Instruction Fuzzy Hash: 21014C37608B82CBD7109F21F400169BBB0F799B95F9A4231EA4D87618CF7AE454DB89
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE695C10, Relevance: 6.4, APIs: 4, Instructions: 433COMMON
    Download Yara Rule
    APIs
    • InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE695CCC
    • InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE695E9A
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CountCriticalInitializeSectionSpin
    • String ID:
    • API String ID: 2593887523-0
    • Opcode ID: 103e698838d4783133e8ab57ed6fc67efa90a96f92c0a0c115118dd03acd5bd0
    • Instruction ID: d952b325e8d76916eb4cfddc40f352151276f8bc5a552ec66160de9251402633
    • Opcode Fuzzy Hash: 103e698838d4783133e8ab57ed6fc67efa90a96f92c0a0c115118dd03acd5bd0
    • Instruction Fuzzy Hash: 6A32A537A08B8691EB198F14E8443A833A4FB14744FA64136DB5CC3360DFBEE565E34A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69806C, Relevance: 6.3, APIs: 4, Instructions: 298synchronizationCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 00007FF6EE698440: RtlAllocateHeap.NTDLL(?,?,00000001,00007FF6EE697D16), ref: 00007FF6EE698462
      • Part of subcall function 00007FF6EE695C10: InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE695CCC
    • WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE6982F9
    • SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6EE6983D4
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AllocateCountCriticalEventHeapInitializeObjectSectionSingleSpinWait
    • String ID:
    • API String ID: 2274017952-0
    • Opcode ID: 5972031a824bd58df97bc30504874612a3bb94a0eaec471de29083395307b6b1
    • Instruction ID: 2897cde27db4c53d79f550f72106bf7f0a39db711b52031bf69b5bafc1e6c7c7
    • Opcode Fuzzy Hash: 5972031a824bd58df97bc30504874612a3bb94a0eaec471de29083395307b6b1
    • Instruction Fuzzy Hash: 98D19E23B08B4685EB10CB55E8403A837B0FB68B98F524135EE4D937A4DFBEE455E349
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A921A, Relevance: 6.3, APIs: 4, Instructions: 269synchronizationCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Object$Commit$MessageSingleTraceWait
    • String ID:
    • API String ID: 863467152-0
    • Opcode ID: 085e2b40ce4db8a582ba844f9fe6aaa482a3c231ea880c274a24ff9105fdfffe
    • Instruction ID: ba0150da16d229c37714d34e4bfebff549aabe24ddea2d9162fd12ded0e199aa
    • Opcode Fuzzy Hash: 085e2b40ce4db8a582ba844f9fe6aaa482a3c231ea880c274a24ff9105fdfffe
    • Instruction Fuzzy Hash: 8FD16037A08B8586DB20CF15E4403AAB7A1FB99B94F524136EA8D83764CF7EE444DB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A9136, Relevance: 6.3, APIs: 4, Instructions: 256synchronizationCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Object$CommitSingleWait
    • String ID:
    • API String ID: 4292635895-0
    • Opcode ID: 68c7015d70dcf6a8a9ac2df2c902623aaa7a99c3e1312ae9217d4cc73a4659f0
    • Instruction ID: ba9eff92a1fd97bc197ef8f65c4edf63d7e814cfd9aa1d5552fa70800e6c32d1
    • Opcode Fuzzy Hash: 68c7015d70dcf6a8a9ac2df2c902623aaa7a99c3e1312ae9217d4cc73a4659f0
    • Instruction Fuzzy Hash: 70C18F37A08B8586DB20CF25F4403AAB7A1FB99B94F524135EA8D83764CF7EE444DB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C9020, Relevance: 6.2, APIs: 4, Instructions: 208COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1886302522-0
    • Opcode ID: 35bbbf6fdbc0fc93a11726737f5210e78b3b9eb4ceb6b5381b84e71a279d6954
    • Instruction ID: 7d9a7d7f35d27cc5c103e541f81b240edf9823c07e83bf33fefcdb3d3799573b
    • Opcode Fuzzy Hash: 35bbbf6fdbc0fc93a11726737f5210e78b3b9eb4ceb6b5381b84e71a279d6954
    • Instruction Fuzzy Hash: B6A19037B04B4686EF009B25D8447A83BA0FB68B98F524131EE0D97794CFBEE445D349
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE695450, Relevance: 6.2, APIs: 4, Instructions: 204COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CommitObject
    • String ID:
    • API String ID: 3211880563-0
    • Opcode ID: f732a343c48e7b11243f61ded7714248e099107d70f59c62a0df40da8f7503fa
    • Instruction ID: d0e5d4668acfc76ec89f6553073ccbe77f4e417879253016f6aa247743b35ac9
    • Opcode Fuzzy Hash: f732a343c48e7b11243f61ded7714248e099107d70f59c62a0df40da8f7503fa
    • Instruction Fuzzy Hash: D591DF33A08B9296E7248F14E4403B977A0FB99748F620035FB4D87A54DFBEE455EB09
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C03A4, Relevance: 6.2, APIs: 4, Instructions: 196memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Variant$ClearString$AllocFreeInitLog@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1320563993-0
    • Opcode ID: b0803d70df9f59eb6b0daff46c6f25258699d94609ce6ec8d3822e052b348449
    • Instruction ID: a2fef137aa52d8d8a84e1956a6a7e7dd7a2484ec66c76216bc047954b92a1988
    • Opcode Fuzzy Hash: b0803d70df9f59eb6b0daff46c6f25258699d94609ce6ec8d3822e052b348449
    • Instruction Fuzzy Hash: 2291AC26708B8682EF548F16E84476977A0FB98F94F524132EE5E83364CF7ED844E309
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C0DAC, Relevance: 6.2, APIs: 4, Instructions: 185COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1886302522-0
    • Opcode ID: 5e32123197f6e530974f3510dce1545b72dc838ecea19686561a075dfb4d6fe1
    • Instruction ID: 28b8b62842163f85f6e227cbc58d24912a9df0ed90a8587449895830e68dc9f0
    • Opcode Fuzzy Hash: 5e32123197f6e530974f3510dce1545b72dc838ecea19686561a075dfb4d6fe1
    • Instruction Fuzzy Hash: 7C819A37B08B4689EB009F21D4403A937A4FB68B84F524136EE1D877A4CFBEE455D349
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE697650, Relevance: 6.1, APIs: 4, Instructions: 140COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: bf7d2f9f4a68e732c691666ae4fd9053836372c8aa7ac14c8b7ace85bec2e9be
    • Instruction ID: 29433c67a3e8b905bb24848ff5089f2ce77f66c4209dea36ecc33d423ab4b378
    • Opcode Fuzzy Hash: bf7d2f9f4a68e732c691666ae4fd9053836372c8aa7ac14c8b7ace85bec2e9be
    • Instruction Fuzzy Hash: B9619273A08B4285EB108F14E44437837A0FB64B58F664135EA0D8B3A5DFBEE405E74A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BC6B0, Relevance: 6.1, APIs: 4, Instructions: 137COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$MessageTrace
    • String ID:
    • API String ID: 1039912245-0
    • Opcode ID: eab87c3bad040ad802c281fef4e361afbb57e457ddf1b92fb592e04907438328
    • Instruction ID: 303dd756b8ad0753de92587632a786f6d9909ce484eff1cdd8ff4f118dd194fe
    • Opcode Fuzzy Hash: eab87c3bad040ad802c281fef4e361afbb57e457ddf1b92fb592e04907438328
    • Instruction Fuzzy Hash: 2D519C23F04B8185EB008B55E4407A83BA0FB58B98F520136FE1D937A9DFBED946D749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BCF80, Relevance: 6.1, APIs: 4, Instructions: 134COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$MessageTrace
    • String ID:
    • API String ID: 1039912245-0
    • Opcode ID: f4bda622b49ff7b567f0ba347fa6ace6c08819afad384714299f307bfe04f714
    • Instruction ID: fd0cae2f8bb5ed8f15351a316867184f05c11ea770f0d579aff9a0514208e310
    • Opcode Fuzzy Hash: f4bda622b49ff7b567f0ba347fa6ace6c08819afad384714299f307bfe04f714
    • Instruction Fuzzy Hash: 00519B23E04B8195EB008B51E8447E937A0FB58788F510136FE1D937A8DF7AD846D749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C4980, Relevance: 6.1, APIs: 4, Instructions: 134COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$MessageTrace
    • String ID:
    • API String ID: 1039912245-0
    • Opcode ID: c311cc8ec44482173f8d08097f57f27c6aaf5cf7db08d842f1c4f08fdc9c6452
    • Instruction ID: ecdfd3590d09d3625eb8ab0c570bef366372437af773d9677aae46d681e6afff
    • Opcode Fuzzy Hash: c311cc8ec44482173f8d08097f57f27c6aaf5cf7db08d842f1c4f08fdc9c6452
    • Instruction Fuzzy Hash: 7451BE23B08B8185EB10CB51E8447A937A0FB58788F520136FE0D877A8DF7ED846D749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BD220, Relevance: 6.1, APIs: 4, Instructions: 134COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$MessageTrace
    • String ID:
    • API String ID: 1039912245-0
    • Opcode ID: 87606d565abb5e6a61d5d1776bba3100824d694806c2794bd5bb397a515d5732
    • Instruction ID: ece304eef80288659118ca6a3aefd5b671eb6bb8c55b1a04bf6e26cff6b98645
    • Opcode Fuzzy Hash: 87606d565abb5e6a61d5d1776bba3100824d694806c2794bd5bb397a515d5732
    • Instruction Fuzzy Hash: 03516B23A08B8195EB008B51E8447ED3BA0FB58B98F510136FE0D877A9DF7ED846D745
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C9860, Relevance: 6.1, APIs: 4, Instructions: 127COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1886302522-0
    • Opcode ID: d1581bb2d07d681c703d765d1fd79811265a85ddaf34115b547db56586f6fdc6
    • Instruction ID: 6c6a28c278b7d6e091a02681548d521d279e78cde55788a3cf52d04c5fed83af
    • Opcode Fuzzy Hash: d1581bb2d07d681c703d765d1fd79811265a85ddaf34115b547db56586f6fdc6
    • Instruction Fuzzy Hash: 2851E523B14B4286EF00DB62D4447B82BA1FB58B88F524032EE0D97765CFBED446D74A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6CB430, Relevance: 6.1, APIs: 4, Instructions: 126COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1886302522-0
    • Opcode ID: c369cc625ac875f3ecfe1ada6e639a2f348d7cfdbf1d3c3eb36365db132ff09c
    • Instruction ID: 7933a7af4e3f973c4583d7ee7ebdfc9a368ee2a0973e49b6afbf2947d121a9d5
    • Opcode Fuzzy Hash: c369cc625ac875f3ecfe1ada6e639a2f348d7cfdbf1d3c3eb36365db132ff09c
    • Instruction Fuzzy Hash: 05519623B04B828AEB009F21D4443B82BA0FB58B88FA24531EE0DC7795DFBED445D749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BCB60, Relevance: 6.1, APIs: 4, Instructions: 115COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$MessageTrace
    • String ID:
    • API String ID: 1039912245-0
    • Opcode ID: 120453ed8565f9170379614e1c23dc1fa0df144c57dd4348117b4b7b8c593000
    • Instruction ID: 4f4a2440ee953e377996a679d1ae76e6bfa271a3ac4ed348383f0751a2e9fbb3
    • Opcode Fuzzy Hash: 120453ed8565f9170379614e1c23dc1fa0df144c57dd4348117b4b7b8c593000
    • Instruction Fuzzy Hash: 1051E537A08B8185EB108F01E4443A97BA0FB98B98F664035FE4D83768CFBED945D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BC960, Relevance: 6.1, APIs: 4, Instructions: 115COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$MessageTrace
    • String ID:
    • API String ID: 1039912245-0
    • Opcode ID: c87b8af0dccdcf6436963b262aacb2411b31c331e2a5da98012570fa9dc51990
    • Instruction ID: 51b29870f6d4a8b383285baf1a986c2a5403d86a7cc72e7157da88e8b6e09586
    • Opcode Fuzzy Hash: c87b8af0dccdcf6436963b262aacb2411b31c331e2a5da98012570fa9dc51990
    • Instruction Fuzzy Hash: 2351B233A08B8185EB108F01E4443A97BA0FB98B98F664135FE4D83768CFBED945D749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C5330, Relevance: 6.1, APIs: 4, Instructions: 113COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1886302522-0
    • Opcode ID: a59ea228039d7c57f5712d4268c7cf3f08d321d9601c8235f5e6601fc8803a69
    • Instruction ID: a866c3031b62016aaf8d48ccd0988e1460c72b2a21272bfcffcb369965b8a4ce
    • Opcode Fuzzy Hash: a59ea228039d7c57f5712d4268c7cf3f08d321d9601c8235f5e6601fc8803a69
    • Instruction Fuzzy Hash: 92519233704F8299EB008F25D8443A83BA0FB58B58F524135EE0D8B7A5DF7AD906D349
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C1964, Relevance: 6.1, APIs: 4, Instructions: 109COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1886302522-0
    • Opcode ID: 32a1ed84f5ff6cbdc2a317871747e08a171478058c974250e4bec75c059b9008
    • Instruction ID: a72d495b287d884903b355aaa80cff1e4c510412cb47c60313b2341df863ea22
    • Opcode Fuzzy Hash: 32a1ed84f5ff6cbdc2a317871747e08a171478058c974250e4bec75c059b9008
    • Instruction Fuzzy Hash: EF518D37708B8299EB008F25D4443A83BB4FB59B48F524136EE0D87765DFBAE906D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C10AC, Relevance: 6.1, APIs: 4, Instructions: 108COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1886302522-0
    • Opcode ID: 36f3afe447136b35d089f693db5f1fd95007cb702d5374ba03df116596bdf58a
    • Instruction ID: fb0cbe2809c4c1fe977b857769c1056832a4f936a0fdbc970367a589771ae074
    • Opcode Fuzzy Hash: 36f3afe447136b35d089f693db5f1fd95007cb702d5374ba03df116596bdf58a
    • Instruction Fuzzy Hash: 91519D3B704A8189EB008F21D4487A837B4FB59B88F924136EE0C87765DF7ED946D345
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C1264, Relevance: 6.1, APIs: 4, Instructions: 106COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1886302522-0
    • Opcode ID: 9a7fdebb5e505ab30a9a369da8f58cf5266b4c208e3af23792f22d0cef4c584a
    • Instruction ID: 6371411b20ed25d8044f296156651fad5b32ea85a2cac270df40739f908b0d92
    • Opcode Fuzzy Hash: 9a7fdebb5e505ab30a9a369da8f58cf5266b4c208e3af23792f22d0cef4c584a
    • Instruction Fuzzy Hash: 3241BF37704B8189EB009F22D4443A837B4FB68B88F924136EE0C87B65DFBAD806D345
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C4DC0, Relevance: 6.1, APIs: 4, Instructions: 103COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$MessageTrace
    • String ID:
    • API String ID: 1039912245-0
    • Opcode ID: fbaf0ee92341f8a343643b57a91a2d6d7147022d8b5929b28ee5d70d63715117
    • Instruction ID: 12ccc3e1cfb5cdc2231c3d43177098dd0abdc76eeb42bbc9629a19fb9f48a265
    • Opcode Fuzzy Hash: fbaf0ee92341f8a343643b57a91a2d6d7147022d8b5929b28ee5d70d63715117
    • Instruction Fuzzy Hash: F8418D33A08B8181EB10CB05E4443697BA1FB98F48F669035EE9D87765CFBED446D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BEA40, Relevance: 6.1, APIs: 4, Instructions: 103COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$MessageTrace
    • String ID:
    • API String ID: 1039912245-0
    • Opcode ID: 65cebe7e85fad68869923de45a1c6dc6a0f4c5b3f76930934af5fb1638d3b41a
    • Instruction ID: cea28e2164573d8839dfb203b5ac9ec230d361ca5a031a9475394e9e588b30d7
    • Opcode Fuzzy Hash: 65cebe7e85fad68869923de45a1c6dc6a0f4c5b3f76930934af5fb1638d3b41a
    • Instruction Fuzzy Hash: 9E41A637A08B8981EB148F15D4443697BA1FB94F88F664036EE4D837A4CFBED846D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE699490, Relevance: 6.1, APIs: 4, Instructions: 101COMMON
    Download Yara Rule
    APIs
    • InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE699532
    • InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6EE6995DC
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CountCriticalInitializeSectionSpin
    • String ID:
    • API String ID: 2593887523-0
    • Opcode ID: d7aa9d9d91f2968b06b34865b7045171936ca24d0ca30d8338882ad14f34feec
    • Instruction ID: 843b60d23e78e0d20343b44f79697f3b135f30a949014db330f4fceb9a9cd864
    • Opcode Fuzzy Hash: d7aa9d9d91f2968b06b34865b7045171936ca24d0ca30d8338882ad14f34feec
    • Instruction Fuzzy Hash: CC41CD37508B81C6E7009F20E8803A977A8FB59F58F6A8235DE8C87364DFBAD055E705
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C5740, Relevance: 6.1, APIs: 4, Instructions: 100COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$MessageTrace
    • String ID:
    • API String ID: 1039912245-0
    • Opcode ID: b9584f33f77f9a0242073e873dc57cd1895468bc8952d8b3ee4b9bbb62dd554c
    • Instruction ID: 573e0f2ff7c9faf4f69f895541c61118ffb05092478499ec18a261cf29f60802
    • Opcode Fuzzy Hash: b9584f33f77f9a0242073e873dc57cd1895468bc8952d8b3ee4b9bbb62dd554c
    • Instruction Fuzzy Hash: DB41B533B18B8186EB009B15E8443783BA1FB94B98F564035EE0E87365CFBEE445D749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BCD60, Relevance: 6.1, APIs: 4, Instructions: 100COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@$MessageTrace
    • String ID:
    • API String ID: 1039912245-0
    • Opcode ID: f54738b4bd6dca041b2f7ccdaa5b674992994fcee8825440e4cc6399d0f7bc35
    • Instruction ID: 45ad0142e023ce24f5bc063ad338a42e7bef63aad294647949ced3c27ab1ca0a
    • Opcode Fuzzy Hash: f54738b4bd6dca041b2f7ccdaa5b674992994fcee8825440e4cc6399d0f7bc35
    • Instruction Fuzzy Hash: 1041A323B1878281EB408B15E4043B97BA1FB94B88F565036FA0DC3769CFBED546D749
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C4F80, Relevance: 6.1, APIs: 4, Instructions: 91COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1886302522-0
    • Opcode ID: 82b6bd87c5e26977d627544220043590db6c70db7cb7b7f997689c44a75a2913
    • Instruction ID: 1ae17924de56664ccc517136b822955bd1f01b4bc5ee6d78cedff41a5744f3f4
    • Opcode Fuzzy Hash: 82b6bd87c5e26977d627544220043590db6c70db7cb7b7f997689c44a75a2913
    • Instruction Fuzzy Hash: 5A418033B08B8186EB008B15E8443687BA1FB98B88F664135EF0D87365CFBED445D789
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BE8B0, Relevance: 6.1, APIs: 4, Instructions: 91COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1886302522-0
    • Opcode ID: a3d27f32a61aaecdb2da364fff48e179799047b258311492f119fc53fa5d80c6
    • Instruction ID: 8764da829e7ef37e728e89607a333a6e5fb9ed3b82ca9b7f9ebd6c5abfbdf7cf
    • Opcode Fuzzy Hash: a3d27f32a61aaecdb2da364fff48e179799047b258311492f119fc53fa5d80c6
    • Instruction Fuzzy Hash: FD41A036B08B8586EB109F05D4443687BA1FB99B88F564035EB0D83364CFBED845D74A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A2800, Relevance: 6.1, APIs: 4, Instructions: 73COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
    • String ID:
    • API String ID: 140117192-0
    • Opcode ID: 25084a94eda34ceb58a96aa41ff3d75a5d4f91fcbd2360c73a9ff6b0fb80a6b2
    • Instruction ID: 865098c7f736e535c4e0d2b0d3af0a23d10a792ec73302b88c950414a9fb4dc8
    • Opcode Fuzzy Hash: 25084a94eda34ceb58a96aa41ff3d75a5d4f91fcbd2360c73a9ff6b0fb80a6b2
    • Instruction Fuzzy Hash: C541FB36A09F0181EB508F18F85036977A4FBA8744FA24136E98EC3764DFBEE454E745
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69F700, Relevance: 6.1, APIs: 4, Instructions: 59COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID:
    • API String ID: 1886302522-0
    • Opcode ID: b6be3c73b150356a5de3958f2034a5cc5b3df8ffb96b64e79e5247703eb538fd
    • Instruction ID: 5723e5b140c19db641d364a3dff3ae1999aadefe587f69c5347cb88f6e6fe48b
    • Opcode Fuzzy Hash: b6be3c73b150356a5de3958f2034a5cc5b3df8ffb96b64e79e5247703eb538fd
    • Instruction Fuzzy Hash: 3C21A162E08A4785EB045B10A4143742F91FB69B4CFA75035E90DC73A5CFBFE84AA34E
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6A2AF8, Relevance: 6.0, APIs: 4, Instructions: 44COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
    • String ID:
    • API String ID: 140117192-0
    • Opcode ID: ed9aa5777f077f932c6f5dfef7427ec80e47ebf03f84b8b7e05b7ca09bc337f4
    • Instruction ID: f145abd573521b08aed5f3c3225976cbde62c441522af41675b66faec0a42cd4
    • Opcode Fuzzy Hash: ed9aa5777f077f932c6f5dfef7427ec80e47ebf03f84b8b7e05b7ca09bc337f4
    • Instruction Fuzzy Hash: 2621C636909F4582E7109F04F84036977A4FBA4754FA20136EA8D83B64DFBEE454EB49
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6C0058, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 205COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID: PutInstanceAsync
    • API String ID: 1886302522-2231458413
    • Opcode ID: cb329892b50c7dd1b75d8d6c9d43bf590197f44c31818c2dac67b19bf86aa5b9
    • Instruction ID: 82a1b08c87a6be8cfd353dbe8385479b904afba6f2f5d09a9c4f37a6132815f1
    • Opcode Fuzzy Hash: cb329892b50c7dd1b75d8d6c9d43bf590197f44c31818c2dac67b19bf86aa5b9
    • Instruction Fuzzy Hash: 46919D33B08B4686DF508B15D84476867A0FB69F94F124232EE5D877A4CFBEE444D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE6BFD0C, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 205COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: Log@@MemoryObjectWrite@
    • String ID: PutClassAsync
    • API String ID: 1886302522-532489750
    • Opcode ID: 5b6dfe48c10d60401f5cfe640d6128cdde0c2decd5e9d383c9bdbab7f64732f4
    • Instruction ID: 1bd97d9f529f62b310257507763ceafe41279b98500a777a9d8500350a574bb1
    • Opcode Fuzzy Hash: 5b6dfe48c10d60401f5cfe640d6128cdde0c2decd5e9d383c9bdbab7f64732f4
    • Instruction Fuzzy Hash: 98919C23A08B4685DB108F16E84476877A4FB69F90F124236FE1D833A8CFBEE444D709
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE691100, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: String$AllocFreeInitVariant
    • String ID: __ProviderHostQuotaConfiguration=@
    • API String ID: 1116590889-1272038474
    • Opcode ID: 7f7d2ff75970b7b0ff9a2af5b82b4020cbbf2af5ba14761ce883350a10001d16
    • Instruction ID: 4cc4f67a2ad3fa186b8daba1f8bf6fcbb876bd0cf154ca14241e99617f422e02
    • Opcode Fuzzy Hash: 7f7d2ff75970b7b0ff9a2af5b82b4020cbbf2af5ba14761ce883350a10001d16
    • Instruction Fuzzy Hash: C7115B36608B8682DB008B16E494379B7A0FB99BD4F564131EA4D83B28DFBED444CB05
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF6EE69ECC4, Relevance: 5.2, APIs: 4, Instructions: 201memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.492404494.00007FF6EE691000.00000020.00020000.sdmp, Offset: 00007FF6EE690000, based on PE: true
    • Associated: 00000000.00000002.492396887.00007FF6EE690000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492457989.00007FF6EE6D9000.00000002.00020000.sdmp Download File
    • Associated: 00000000.00000002.492487671.00007FF6EE6F5000.00000004.00020000.sdmp Download File
    • Associated: 00000000.00000002.492495750.00007FF6EE6F8000.00000002.00020000.sdmp Download File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6ee690000_c541a313a0492231a3_wmiprvse.jbxd
    Similarity
    • API ID: AllocHeap$memcmp
    • String ID:
    • API String ID: 3670907648-0
    • Opcode ID: 0a8a6846dda54ae822ce6bed8b7c24ae876c38b75295f3b90ec5680744d688de
    • Instruction ID: 7c9a4b1f291c5da2f8f69b6243d9ce3efd39486dd7eaf826a424f6cfd0ea4d4c
    • Opcode Fuzzy Hash: 0a8a6846dda54ae822ce6bed8b7c24ae876c38b75295f3b90ec5680744d688de
    • Instruction Fuzzy Hash: 7B918033A08B8182EB60CB51E44036977E4FB58B84F168235EF9D87B40DFBAE564E705
    Uniqueness

    Uniqueness Score: -1.00%